Privacy Policy

• visitors to our website at www.routedai.com and any subdomains (“Site”);
• business customers and their authorised users who access our platform and API (“Services”); and
• working professionals whose publicly available profile information appears in our workforce-intelligence database as a result of our data-aggregation activities.

1. Data Controllers & EU Representative

2. What Information We Collect

2.1 Professional Profile Data (Workforce Intelligence Database)

• Full name, current and historical job titles, and seniority level;
• Current and past employers, industries, and geographic locations (city, region, country);
• Educational background and institutions attended;
• Publicly listed professional skills, certifications, and areas of expertise;
• Tenure data and career-transition patterns derived from public profiles;
• Compensation benchmarks derived from public salary disclosures and job-posting data; and
• Algorithmically inferred professional characteristics (e.g., estimated seniority band or functional area) derived from the above publicly available information.

2.2 Business Customer & Contact Information

• Name, business email address, phone number, job title, and organisation name;
• Account credentials and billing information;
• Communications exchanged with our sales, support, or customer-success teams; and
• Contract, order, and payment information.

2.3 Website & Platform Usage Data

• Device and browser type, operating system, and IP address;
• Pages visited, features used, time spent, and referring/exit URLs;
• Search queries and filters applied within the platform; and
• Error logs and performance diagnostics.

2.4 Job Application Information

3. Legal Bases for Processing (GDPR)

• Legitimate Interests (Art. 6(1)(f)):Building and maintaining our workforce-intelligence database; providing benchmarking and analytics to customers; securing and improving our platform; and fraud prevention. We conduct a balancing test to ensure our interests do not override individuals’ fundamental rights and freedoms.
• Contract Performance (Art. 6(1)(b)): Processing customer and authorised-user data as necessary to deliver the Services contracted for.
• Consent (Art. 6(1)(a)):Where required by law — for example, for non-essential cookies or direct marketing to individuals. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Legal Obligation (Art. 6(1)(c)): Processing required to comply with applicable laws, court orders, or regulatory requirements.

4. How We Use Your Information

4.1 Workforce Intelligence & Platform Services

• Building, maintaining, deduplicating, and continuously refreshing our professional-profile database;
• Providing customers with workforce benchmarking, attrition forecasting, skills-gap analysis, compensation intelligence, and competitive talent-market insights;
• Enabling API integrations so customers can embed workforce data in their own analytics tools and HR systems;
• Generating aggregated, de-identified statistical reports and trend analyses that do not identify any individual; and
• Improving data accuracy and coverage through algorithmic enrichment and standardisation.

4.2 Customer Relationship & Support

• Responding to enquiries, demo requests, and support tickets;
• Administering accounts, contracts, and billing;
• Sending service communications (security alerts, product updates, policy changes); and
• Marketing our products to existing and prospective customers — you may opt out at any time.

4.3 Research, Development & Product Improvement

• Analysing usage patterns to improve platform functionality and user experience;
• Training and evaluating internal machine-learning models using de-identified or aggregated data; and
• We do not permit third-party AI providers to train their own models on your personal data.

4.4 Legal & Compliance

• Complying with applicable laws and regulatory requirements;
• Responding to lawful requests from courts or government authorities;
• Detecting, preventing, and investigating fraud, abuse, or security incidents; and
• Establishing, exercising, or defending legal claims.

5. How We Share Your Information

• Business Customers: We provide Professional Profile Data to subscribing organisations for workforce analytics, talent benchmarking, and HR decision-making, pursuant to our customer agreements and applicable data-processing addenda.
• Service Providers: We engage third-party vendors for cloud hosting, data processing, analytics, email delivery, payment processing, fraud detection, and CRM services. These providers may only process data on our instructions, must maintain appropriate security standards, and may not use data for their own purposes.
• AI & Technology Partners: We may use third-party AI providers to support specific platform features. We prohibit these providers from training their own models on your personal data and require deletion of personal data within 30 days unless retention is required by law.
• Professional Advisers: Lawyers, auditors, accountants, and insurers, where necessary in connection with the professional services they render to us.
• Law Enforcement & Regulators: Where legally required, or where we in good faith believe disclosure is necessary to comply with a legal obligation, protect rights, or prevent harm.
• Business Transfers: In connection with a merger, acquisition, sale of assets, or insolvency proceedings, personal information may be transferred to a successor entity subject to equivalent privacy protections.

6. International Data Transfers

• Standard Contractual Clauses (SCCs) approved by the European Commission; and
• Other legally recognised transfer mechanisms as required by EU law.

7. How Long We Keep Your Information

• Professional Profile Data: Retained for as long as it remains relevant, accurate, and necessary for the purposes described in this Policy, with periodic accuracy reviews. Individuals may request deletion at any time (see Section 10).
• Customer & Contact Information: Retained for the duration of the customer relationship and up to seven (7) years thereafter to satisfy legal, contractual, and tax obligations, unless a shorter period is required.
• Unsuccessful Job Applicants: Retained for no longer than three (3) years from the date of collection, unless you consent to a longer period.
• Website & Usage Data: Retained for up to 26 months for analytics and security purposes, after which it is deleted or irreversibly anonymised.
• Marketing Consent Records: Retained until consent is withdrawn, plus an additional period as required for compliance documentation.

8. Cookies & Tracking Technologies

• Strictly Necessary: Essential for the Site to function (e.g., session management, security). Cannot be disabled.
• Functional: Remember your preferences and settings to enhance your experience.
• Analytics: Help us understand how visitors interact with the Site (e.g., Google Analytics). Data is aggregated and de-identified where possible.
• Marketing: Enable interest-based advertising on third-party platforms. Only used with your consent where required by law.

9. Security

• Encryption of data in transit (TLS/HTTPS) and at rest;
• Access controls based on the principle of least privilege;
• Regular security assessments, penetration testing, and vulnerability management;
• Employee training on data-protection obligations; and
• Incident-response procedures compliant with applicable breach-notification laws, including 72-hour notification to supervisory authorities where required under GDPR.

10. European Data Protection Rights (GDPR)

• Right of Access (Art. 15): Request a copy of the personal data we hold about you and information about how we process it.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal data.
• Right to Erasure / ‘Right to be Forgotten’ (Art. 17): Request deletion of your personal data where there is no compelling reason for continued processing.
• Right to Restriction of Processing (Art. 18): Request that we limit how we process your data in certain circumstances (e.g., while accuracy is contested).
• Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible.
• Right to Object (Art. 21): Object to processing based on legitimate interests or for direct-marketing purposes. Where you object to direct marketing, we will cease processing without delay.
• Right to Withdraw Consent: Withdraw any consent given at any time, without affecting the lawfulness of processing prior to withdrawal.
• Right Not to Be Subject to Solely Automated Decisions (Art. 22): Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you.

11. Opting Out & Data Rights Requests

11.1 Opt Out of Processing

11.2 Do Not Sell or Share My Personal Information (CCPA)

• Email: privacy@routedai.com with subject line “Do Not Sell My Personal Information”
• Online: Submit a request via our Data Rights page at www.routedai.com/data-rights

11.3 Other Data Subject Requests

• Your full name and the email address associated with your profile;
• The type of request you are making; and
• Any additional information that helps us locate your data (e.g., current employer, LinkedIn URL).

12. Children’s Data

13. Third-Party Links & Services

14. Changes to This Policy

15. How to Contact Us