1. Data we process
From the Customer (hiring company): company profile, team composition, manager profile, role requirements, billing information.
From candidates (uploaded by Customer): resumes, interview transcripts, optional contact information, optional public-profile signals scraped from public sources only with Customer's lawful basis.
2. Lawful basis (GDPR Art. 6 / equivalent)
Customer data: contract performance and legitimate interest in delivering the Platform.
Candidate data: the Customer is the data controller; Manera acts as a data processor under a Data Processing Agreement. The Customer must establish its own lawful basis (consent, legitimate interest, legal obligation) before uploading candidate data.
3. How we use data
- To score candidates against the Customer's disclosed role and team context
- To generate PDF evaluation reports for the Customer
- To improve Platform quality through aggregated, anonymized analytics only
- We do NOT sell personal data. We do NOT train third-party AI models on Customer or candidate data. We do NOT share data across Customers.
4. Data retention
Candidate resumes and interview transcripts are retained for the duration of the active hiring cycle plus 12 months for audit purposes, then permanently deleted — unless longer retention is required by law in the Customer's jurisdiction.
Customers can request immediate deletion of any candidate record via [email protected]. We respond within 30 days.
5. Your rights (GDPR / CCPA / CPRA / Quebec Law 25 / PIPEDA / LGPD / PDPA / DPDPA)
- Right of access — request what we hold about you
- Right of rectification — correct inaccurate data
- Right of erasure — request deletion
- Right of portability — machine-readable export
- Right to object — to automated decision-making
- Right to withdraw consent — where processing is consent-based
- Right to lodge a complaint with your local data protection authority (CNIL, ICO, CAI-Quebec, OPC-Canada, DPC-Ireland, etc.)
6. International transfers
Data is processed in Canada. EU/UK data transfers use Standard Contractual Clauses. Québec-specific data is processed locally under Law 25 requirements.
7. Security
Encryption at rest and in transit. Access on need-to-know basis. Mesh-wide signed API calls. Annual third-party penetration testing. Incident notification within 72 hours of detection where required by law.