Privacy Policy
Last updated: 1 August 2026
1. Who we are, and in what capacity
Pedro Jorge Fernandes Carvalho, tax number 205318762, trading as Parthumanally ("we", "us"), acts in two different capacities, and it matters which one applies. For your own account data, we are the data controller. For the candidate data you upload into your organization, you are the controller and we are your processor: we handle it on your instructions, for you, and never for our own purposes. Contact us at info@parthumanally.com for any privacy question or request.
2. Data we collect about you
When you create an account: your name, work email, password (stored only as a bcrypt hash, never in readable form), organization name and interface language. If you sign in with Google instead, we receive your name and email from Google. If you only leave your email to open the shared demo, that is all we store. We never collect payment card details, ID documents, or special categories of data. The legal basis is performance of our contract with you (GDPR Art. 6(1)(b)) for accounts, and your consent (Art. 6(1)(a)) for the demo form.
3. Candidate data you upload
CVs, names, contact details, application notes and AI screening scores belong to your organization, not to us. We process them only to run the service you asked for: parsing CVs, scoring them against the criteria you defined, and producing shortlists and interview guides. We do not use them to train any model, we do not share them with other customers, and we do not use them for our own marketing. You remain responsible for having a lawful basis to process those candidates' data and for informing them, as their controller.
4. Where your data is processed
Everything runs on our own server in Oracle Cloud, region eu-madrid-1 (Spain, European Union). The AI that screens CVs runs locally on that same machine: CV content is not sent to any external AI provider, does not leave the EU, and is not used to train third-party models. There is no international transfer of candidate data outside the EU.
5. Who else is involved
Resend delivers our transactional emails (account verification, password reset, notifications) as our processor, and therefore sees the recipient email address, never CV content. Oracle Cloud hosts the server. If you sign in with Google, Google processes that sign-in. When you set a password, we check it against known breaches using Have I Been Pwned, sending only the first five characters of its hash, never the password itself. We do not sell your data, and we share it with nobody else.
6. How long we keep it
Candidate data is deleted 12 months after that candidate's most recent application, or 3 months on the free plan, since a free account that has been abandoned no longer has a purpose to justify keeping it. Audit and AI usage records are kept for 24 months because they are our proof of compliance, such as human review and cost. Demo-form emails are kept for at most 24 months of inactivity. Deleting a candidate also deletes their applications and notes.
7. Automated decisions and human review
Our AI produces a score and a written justification for each candidate, but it does not decide anything on its own: no candidate is rejected, advanced or hired automatically. Every screening is presented to a person in your team, who decides. Each AI run is logged, so a decision can be traced back and explained afterwards.
8. Security
Access is separated by organization at the database level (row-level security), so one customer's queries cannot reach another's data. Passwords and API keys are stored only as hashes, two-factor authentication is available and mandatory for platform administrators, and admin actions are recorded in an audit log.
9. Your rights
Under the GDPR you can ask us to access, correct, delete, or export your data, or object to / restrict how we use it. Write to info@parthumanally.com and we act on it. If you are a candidate whose CV was uploaded by a company using Parthumanally, that company is the controller, so ask them first; write to us and we will forward your request to them. You can also lodge a complaint with your local data protection authority.