Privacy Policy

Clarvo Oy, Business ID 3386508-6 ("Clarvo", "we", "us"), respects your privacy. This Privacy Policy describes how we collect, use, share, and protect personal data under the General Data Protection Regulation (GDPR), the EU AI Act, and other applicable legislation.

1. To Whom Does This Policy Apply?

Clarvo operates a dual-model architecture to ensure strict data governance. This Privacy Policy applies to three distinct categories of individuals:

1.1 Talent Users

When you register and use our talent-facing Services (websites, browser extension, AI career agent). For this data, Clarvo acts as a Data Controller, processing information to deliver our career services and facilitate recruitment matching.

1.2 Business Users (Recruiters)

When you use the Clarvo recruitment sourcing platform as an authorized user of a business customer. For account creation and system usage, Clarvo acts as a Data Controller. However, for data generated by you inside the platform (e.g., private notes, connected email outreach, specific pipelines), Clarvo acts strictly as a Data Processor on behalf of your employer organization, which is the controller for candidate data it processes through the platform.

1.3 Potential Candidates (Talent Database)

Professionals whose publicly available professional data is indexed in our search engine. For this data, Clarvo acts as an independent Data Controller, processing information based on our Legitimate Interest to facilitate recruitment matching.

1.4 Ancillary Service Users

When we process data for career services (CV reviews, consulting, workshops).

2. Data Controller

Clarvo Oy · Business ID: 3386508-6 · Merimiehenkatu 36 D 611, 00150 Helsinki · privacy@clarvo.ai

3. How We Collect Data

Directly from you: Registration, profiles, subscriptions, contact forms, and communications.
Public sources (the open web): Professional data from publicly accessible sources, including public professional networking profiles, search engines, and corporate websites—directly or via data providers.
Data partners: Verified contact details when an employer identifies a match.
Automatically: Cookies, server logs, and similar technologies. Analytics cookies are consent-based.
Integrations: When Business Users explicitly opt-in to connect email or LinkedIn for outreach.

4. Processing Activities

4.1 Talent Account and Profile

Purpose: Account administration, profile, and CV management.

Basis: Contract (Art. 6(1)(b)).

Retention: While account is active; deleted within 30 days of account deletion.

4.2 Algorithmic Matching

Purpose: AI-assisted matching of profiles to opportunities, including generating candidate fit scores, surfacing relevant skills, and creating profile summaries to support sourcing efforts.

Basis: Contract (Art. 6(1)(b)).

Retention: While active; interaction data up to 36 months.

4.3 Candidate Identification and Enrichment

Purpose: Identify candidates from publicly available sources and enrich with public professional data.

Basis: Legitimate Interest (Art. 6(1)(f)).

Retention: Maximum 1 month if not linked to an active account or active recruitment process.

Inferred Professional Characteristics

To provide a more effective search experience, Clarvo's AI models may generate inferred professional characteristics—such as standardizing job titles, estimating years of experience, or categorizing skill sets—based solely on publicly available information within a candidate's profile.

4.4 Business User Accounts

Purpose: Manage Business User accounts, platform access, and subscription records.

Data: Name, email, title, company, login credentials, activity logs.

Basis: Contract (Art. 6(1)(b)).

Retention: Duration of relationship + 12 months.

4.5 Recruitment Sourcing

Purpose: Enable search, discovery, evaluation, and outreach to candidates.

Basis: Legitimate Interest (Art. 6(1)(f)) for public sourcing; Contract (Art. 6(1)(b)) for platform features.

Note: When processing on behalf of a Business User's organization, Clarvo is a data processor. The organization is the controller.

4.6 Email and LinkedIn Integration

Purpose: Outreach via connected Gmail and LinkedIn (opt-in only).

Google API Disclosure: Clarvo's use and transfer to any other app of information received from Google APIs will strictly adhere to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is not used for advertising.

Limited Use & AI Training Restriction: Data obtained through Google Workspace APIs, Microsoft Graph APIs, or any other connected messaging integration is never used to develop, improve, or train generalized artificial intelligence (AI) or machine learning (ML) models. Processing of this data is strictly confined to providing the email outreach and syncing functionality to the specific User.

Basis: Contract (Art. 6(1)(b)) and Consent (Art. 6(1)(a)) via OAuth.

Retention: While connected; deleted within 30 days of revocation.

4.7 Analytics

Purpose: Understand usage and improve the platform. Analytics cookies are consent-based and declinable.

Basis: Legitimate Interest (Art. 6(1)(f)) and Consent (Art. 6(1)(a)).

Retention: Up to 24 months.

4.8 Payment Processing

Purpose: Subscription payments and billing via Stripe. Clarvo does not store full payment card numbers.

Basis: Contract (Art. 6(1)(b)).

Retention: Billing records 7 years per Finnish Accounting Act.

4.9 Communication and Marketing

Purpose: Communicate about new opportunities, platform updates, and gather feedback. You can opt out of marketing at any time by emailing privacy@clarvo.ai or clicking "Unsubscribe" in any marketing email.

Basis: Consent (Art. 6(1)(a)) for marketing; Legitimate Interest (Art. 6(1)(f)) for service communications.

Retention: Until consent is withdrawn or account is deleted.

4.10 Security and Fraud Prevention

Purpose: Detect and prevent fraud and security incidents.

Basis: Legitimate Interest (Art. 6(1)(f)).

Retention: Up to 24 months.

4.11 Legal Obligations

Purpose: Compliance with law and dispute resolution.

Basis: Legal Obligation (Art. 6(1)(c)) and Legitimate Interest (Art. 6(1)(f)).

Retention: 7 years for accounting; as needed for disputes.

5. Sources of Candidate Data & Sensitive Data

5.1 Sources of Candidate Data (The Open Web)

For candidates in our Talent Database, we collect professional data from publicly accessible sources on the open web. This includes public professional networking profiles (e.g., LinkedIn public profiles), search engines, and corporate websites.

5.2 Strict Prohibition on Sensitive Data

We strictly limit our data collection to professional and employment-related information. Clarvo does not actively seek out, collect, or process Special Categories of Personal Data (such as health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, or trade union membership) from public sources.

If our automated systems encounter such data on a public profile, it is explicitly excluded from our search and matching algorithms.

6. AI Processing, Sourcing, and Human Oversight

Clarvo utilizes artificial intelligence (AI) to assist our Customers in the discovery and recruitment process. Our AI models analyze public professional profiles to generate candidate fit scores, surface relevant skills, and create profile summaries to support sourcing efforts.

6.1 No Automated Decision-Making

Clarvo operates strictly as a decision-support tool. Our AI does not make automated hiring decisions, nor does it automatically reject candidates. All final decisions regarding whether to engage, interview, or hire a candidate are made exclusively by human recruiters using the platform.

This approach ensures compliance with GDPR Article 22 (restrictions on automated individual decision-making) and aligns with the EU AI Act's requirements for human oversight in high-risk AI systems.

6.2 AI Safeguards

AI provides recommendations only. No automated decisions with legal effects without human involvement.
Candidate names and direct identifiers are not sent to third-party AI model providers.
No Special Category data, demographics, or protected characteristics are sent to AI models.
Clarvo classifies its AI as high-risk under EU AI Act Annex III (Employment) and is pursuing full compliance by August 2026.

6.3 Transparency and Explainability

If you would like to better understand how Clarvo's AI makes recommendations, or would like a decision reviewed by a human member of our team, you are welcome to contact us at privacy@clarvo.ai.

7. Third-Party API Integrations & Limited Use

7.1 Authentication APIs (SSO)

If you choose to log in to Clarvo using Single Sign-On via Microsoft or Google, Clarvo requests only delegated access to basic profile information (e.g., openid, profile, email, User.Read) to verify your identity. We do not request or access broader workspace data during authentication.

7.2 Email and Messaging Integrations

If a User explicitly opts-in to connect their external email account or LinkedIn profile (via our EEA-hosted integration partner, Unipile) for candidate outreach, Clarvo requests only the specific OAuth permissions necessary to send and read emails related strictly to candidate communication.

7.3 Compliance with Limited Use Policies

Clarvo's use and transfer to any other app of information received from Google APIs will strictly adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained through Google Workspace APIs, Microsoft Graph APIs, or any other connected messaging integration is never used to develop, improve, or train generalized AI or ML models.

7.4 AI Sub-processor Data Retention

When Clarvo utilizes third-party AI providers (e.g., OpenAI, Google Gemini) via secure enterprise API endpoints to support our platform's functionality, we enforce strict data retention limits. We contractually require these providers to retain data for a maximum of 30 days solely for security and abuse monitoring, after which it is permanently deleted. Customer Data and Candidate Data are never used to train these providers' underlying foundation models.

8. Data Sharing

8.1 Processors

We use sub-processors per our documented instructions. Categories include: infrastructure (Azure), AI (OpenAI, Google Gemini), communication (Unipile, SendGrid, Google Gmail API), payments (Stripe), analytics (Google Analytics, Microsoft Clarity). A full list is available on our Sub-processor List.

8.2 Independent Controllers

We may share data with employers (to facilitate the recruitment process), authorities (where legally required), and external advisors (under strict confidentiality agreements).

8.3 No Sale of Personal Data

Clarvo does not sell, rent, or trade your personal data to third parties for commercial purposes. Data is only shared with our business customers (employers) to facilitate the recruitment process, or with strictly vetted sub-processors who provide the underlying infrastructure for our services under strict confidentiality agreements.

9. International Transfers

Core data is stored in the EEA (Azure Sweden Central). Where sub-processors operate outside the EEA, transfers are protected by EU Standard Contractual Clauses or equivalent mechanisms.

10. Your Rights

Under GDPR, you have the following rights:

Access: Obtain a copy of any personal data we hold about you.
Rectification: Correct errors or gaps in your personal data.
Erasure: Request that we delete your personal data.
Restriction: Limit or restrict certain processing of your personal data.
Objection: Object to processing, including the use of your data for sourcing purposes.
Data Portability: Ask to receive your data in a portable, transferable format.
Complaint: Lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).

10.1 Right to Object to Sourcing

If you are a candidate whose professional data was collected from publicly available sources (our "Talent Database"), you have the absolute right to object to this processing. If you wish to have your profile removed from Clarvo's search database, please email us at privacy@clarvo.ai, and we will promptly remove your data and ensure your profile is not re-indexed in the future.

Contact: privacy@clarvo.ai. Response within one month.

11. Security

AES-256 encryption at rest, TLS 1.2+ in transit
Azure ISO 27001 and SOC 2 Type II certified, Sweden Central
Strict access controls, MFA, regular security reviews
Data residency exclusively within the EEA

We regularly review our technical and organizational measures to ensure they remain effective in protecting your personal data. If a data breach occurs that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority in accordance with GDPR requirements.

12. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required by law. Specific retention periods are outlined in Section 4 for each processing activity.

Upon request, we will delete your personal data except where we are legally or commercially required to retain it (e.g., billing records under the Finnish Accounting Act). Where deletion is not technically possible in full, we will implement safeguards to prevent further use of the data.

13. Cookies

We use cookies on our websites. Analytics and marketing cookies are consent-based and declinable via the cookie banner. See our Cookie Policy for details.

14. Changes to This Policy

Clarvo may amend this Policy from time to time. If changes are material, we will notify you via email or by clearly signposting them on our website. The latest version is always available on our websites.

15. Contact Us

If you have questions or concerns about this Privacy Policy or your personal data, please contact us:

Email: privacy@clarvo.ai
Address: Clarvo Oy, Merimiehenkatu 36 D 611, 00150 Helsinki, Finland
Business ID: 3386508-6