Privacy Policy

We collect information you provide directly — your name, contact details, resume, work history, education, certifications, and any documents you choose to upload. Recruiters additionally provide company details for verification. We also collect information automatically, including device type, browser, IP-derived approximate location, and how you interact with the platform (pages viewed, messages sent, searches performed).

If you sign in with Google, Apple, or Microsoft, we receive the name and email address associated with that account, subject to your permission at the time.

• To operate the core service — matching applicants with recruiters, enabling messaging, scheduling interviews, and tracking hiring progress
• To verify recruiter and company identities before granting messaging access
• To run automated fraud and authenticity screening on messages and offers
• To send account, security, and service notifications
• To improve the platform through aggregated, de-identified analysis
• To comply with legal obligations and enforce our Terms of Service

Your applicant profile is shared with recruiters according to the visibility setting you choose — Public, Recruiter-only, or Private. We do not sell your personal information. We share information with service providers who help us operate the platform (hosting, email delivery, payment processing) under contractual confidentiality obligations, and with authorities where required by law.

• Change your profile visibility at any time in Settings & Privacy
• Hide your contact information so recruiters must message you in-app
• Disable new messages from recruiters entirely
• Export a copy of your data
• Delete your account and associated data

If you are located in the European Economic Area, you have the right to access, correct, delete, or port your personal data, and to object to or restrict certain processing. You may also lodge a complaint with your local data protection authority. See our GDPR Privacy Notice for the full detail, or contact us using the details below.

California residents have the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. Kestrion does not sell personal information as defined under the CCPA. See our CCPA Privacy Notice for full detail.

We retain account information for as long as your account is active. Following account deletion, we retain a limited set of records where required for legal, security, or fraud-prevention purposes, then delete or anonymize the remainder within a reasonable period. See our Data Retention Policy for full detail.

We encrypt data in transit (TLS 1.3) and at rest (AES-256), apply role-based access controls internally, and run continuous vulnerability scanning. No system is perfectly secure, and we encourage enabling two-factor authentication on your account. See our Security & Privacy Statement.

Questions about this policy or a data request? Reach us at privacy@kestrion.com or visit our Contact page.