Privacy Policy

This Privacy Policy explains how Medicalware S.r.l. ("Shortli", "we", "us") collects, uses, shares, and protects personal data when you use our recruiting SaaS platform. We are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR - EU Regulation 2016/679) and applicable Italian data protection laws.

The Data Controller is: Medicalware S.r.l. Via della Ricerca Scientifica, Rome, Italy VAT: IT12651051000 Email: hello@shortli.ai For Candidate Data uploaded by Users, the User is the Data Controller and Shortli acts as Data Processor.

We collect and process the following categories of personal data: Account Data: name, email address, profile picture (obtained via Google OAuth or a Microsoft account). Candidate Data (uploaded by Users): full name, email, phone number, date of birth, location, LinkedIn/GitHub URLs, work experience, skills, education, languages, salary information, availability, work preferences, full CV text and, where present in it, identification numbers such as tax codes or IBANs. Derived Candidate Data (generated by the Service): a Candidate Code assigned to each CV within the Organization, a structured version of the CV rebuilt by artificial intelligence, Pseudonymised Versions of the CV file at two levels (without contact details, photo and source branding; and additionally without the candidate's name), and AI-written summaries and evaluations of the candidate. Billing Data: fiscal entity type, business name or personal name, VAT number, tax ID (codice fiscale), SDI code, PEC email, billing address. Payment card details are processed exclusively by Stripe and never stored on our servers. Usage Data: API operations performed, AI model usage (tokens consumed), search queries, email sending logs (recipient, subject, timestamp, status), activity history on candidates. Technical Data: IP address, browser type, device information collected automatically during access to the Service.

We process personal data based on the following legal grounds: Contract performance (Art. 6(1)(b) GDPR): processing necessary to provide the Service, manage your account, process payments, and fulfill our contractual obligations. Legitimate interest (Art. 6(1)(f) GDPR): improving the Service, preventing fraud, ensuring security, and sending service-related communications. Legal obligation (Art. 6(1)(c) GDPR): compliance with tax, accounting, and invoicing requirements under Italian law. Consent (Art. 6(1)(a) GDPR): where specifically required, such as for optional email permissions via OAuth.

We process personal data for the following purposes: - Providing and maintaining the Service - User authentication and account management - CV analysis using artificial intelligence (metadata extraction, skill identification, candidate matching) - Generating Pseudonymised Versions of CVs (removal of contact details, photo and identifying data; replacement of the name with a Candidate Code) for sharing with the User's clients and other external recipients - Sending emails on behalf of Users to candidates - Processing payments and managing subscriptions - Generating and submitting electronic invoices (Italian SDI system) - Sending system notifications (trial reminders, billing alerts, team invitations) - Monitoring service usage and enforcing plan limits - Improving and developing new features

For every CV uploaded by a User, the Service automatically generates Pseudonymised Versions intended for sharing with external recipients. The text of the CV is processed by Anthropic Claude models, which rebuild it in a structured form and identify contact details; deterministic rules then remove email addresses, phone numbers, postal addresses, date and place of birth, social profile links, identification numbers, the photo, document metadata and the branding of the original source. At the higher level, the candidate's name is also replaced by the Candidate Code. Texts written by AI about the candidate (summaries, strengths, rankings) are filtered by the same rules before being stored. These versions are pseudonymised, not anonymised: the User retains the link between the Candidate Code and the candidate's identity, so they remain personal data and are protected in the same way as the original CV. The process is automated and best-effort: residual identifying elements may remain, and the User reviews the result before sharing it. The User decides, for each shortlist, which level is disclosed to which recipient. Shortli never discloses Candidate Data to third parties on its own initiative. Pseudonymised Versions and the rebuilt structured version are stored alongside the original CV, regenerated when the candidate's name or contact details are edited, and deleted together with the CV.

We share personal data with the following third-party processors, each bound by data processing agreements: Anthropic, LLC (USA): CV text analysis, candidate ranking, natural language processing, structured rebuilding of CVs and detection of contact details for pseudonymisation via Claude AI models. Google Cloud Platform (USA): secure storage of uploaded CV files and of their Pseudonymised Versions; authentication via Google OAuth; email sending via Gmail API. Microsoft Corporation (USA): authentication via Microsoft account (Microsoft Entra ID); email sending via Microsoft Graph, only for Users who connect their Outlook mailbox. Stripe, Inc. (USA): payment processing and subscription management. Stripe is PCI-DSS certified. Resend, Inc. (USA): delivery of system transactional emails. MongoDB, Inc. (USA/EU): database hosting via MongoDB Atlas. Vercel Inc. (USA): hosting of the Service and of the public website; cookieless audience and performance measurement on the public website (Vercel Web Analytics and Speed Insights), based on aggregated data that does not identify individual visitors. Sentry (Functional Software, Inc., USA; data stored in the EU): monitoring of application errors. Error reports contain technical data only (stack trace, page, browser), without request contents, cookies or account details.

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. Shortli requests only the https://www.googleapis.com/auth/gmail.send scope, which is send-only and grants no access to read, retrieve, or store Gmail messages or other Google user data. It is used solely to send emails on the user's behalf. Shortli does not use, transfer, or sell Google user data — raw, aggregated, or derived — to create, train, or improve foundational or generalized machine learning or artificial intelligence models. No Google user data is transferred to our third-party AI provider. Our AI features operate exclusively on recruiting data (job descriptions and candidate CVs) provided directly by users within Shortli.

If you sign in with a Microsoft account, Shortli receives your name and email address from Microsoft (Microsoft Entra ID). Shortli asks for permission to send email (Microsoft Graph Mail.Send) only when you choose to connect your Outlook mailbox. This permission is send-only and grants no access to read, retrieve, or store your messages or other Microsoft data. It is used solely to send, on your behalf, the emails you compose in Shortli. You can stop sending from your mailbox at any time in Shortli settings, and revoke the permission from your Microsoft account (https://account.microsoft.com/privacy/app-access for personal accounts; for work accounts, through your IT administrator). Shortli does not use data received from Microsoft to create, train, or improve artificial intelligence models, and does not transfer it to its third-party AI provider.

Some of our third-party processors are located in the United States. For these transfers, we rely on: - EU Standard Contractual Clauses (SCCs) approved by the European Commission - The processor's certification under recognized frameworks - Supplementary technical and organizational measures to ensure adequate protection You may request a copy of the applicable transfer safeguards by contacting us at hello@shortli.ai.

Active account data: retained for the duration of your active account and Subscription. Deleted data: when you delete items (CVs, shortlists, job descriptions, clients), they are moved to a trash folder. Data remains in the trash until you permanently delete it manually. Once permanently deleted, data is removed from our systems and cannot be recovered. The Pseudonymised Versions, the Candidate Code and the rebuilt structured version of a CV follow the CV and are deleted together with it. Billing records: retained for 10 years as required by Italian tax law. Usage logs: retained for 24 months for service improvement and dispute resolution. Trials ended without a subscription: the organisation's data is retained for 90 days after the end of the trial and then deleted, with two email reminders to the primary owner (14 and 3 days before); accounts left without any organisation are deleted with it. You can delete your account from the account settings or by writing to hello@shortli.ai. The deletion takes place 7 days after the request and can be cancelled until then; afterwards all associated personal data is permanently removed, except where retention is required by law (billing records). We keep a technical record of deletions that contains only identifiers, and for 12 months a keyed fingerprint (HMAC) of the email address, used only to prevent a new free trial with the same address.

Under the GDPR, you have the following rights regarding your personal data: Right of access: obtain confirmation of whether your data is being processed and receive a copy. Right to rectification: correct inaccurate or incomplete data. Right to erasure: request deletion of your personal data when it is no longer necessary for the purposes collected. Right to data portability: receive your data in a structured, machine-readable format. Right to restriction: request limitation of processing in certain circumstances. Right to object: object to processing based on legitimate interest. Right to withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior processing. Right to lodge a complaint: file a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) at www.garanteprivacy.it. To exercise your rights, contact us at hello@shortli.ai. We will respond within 30 days. You can also exercise the right to erasure directly by deleting your account from the account settings.

Shortli uses only essential cookies required for the Service to function: Session cookie (next-auth.session-token): maintains your authenticated session. This is a technical cookie strictly necessary for the Service. Locale cookie (NEXT_LOCALE): stores your language preference (English, Italian, German, French or Spanish). We do not use advertising cookies or third-party tracking cookies. On the public website we measure visits and page performance with Vercel Web Analytics and Speed Insights, which do not use cookies and do not identify individual visitors. No consent banner is required.

We implement appropriate technical and organizational measures to protect personal data, including: - Encryption of data in transit (TLS/HTTPS) - OAuth-based authentication (no passwords stored) - JWT token-based sessions with expiration and refresh rotation - Access controls and organization-level data isolation - Signed webhook verification for payment processing - Regular security monitoring - Principle of least privilege for service accounts - Pseudonymisation of CVs shared with external recipients (contact details, photo and, at the higher level, name removed)

The Service is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 16, we will take steps to delete it promptly.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or through a notice within the Service at least 30 days before taking effect. The "Last updated" date at the top of this page indicates when the policy was last revised.

For any questions or requests regarding this Privacy Policy or your personal data, contact us at: Medicalware S.r.l. Via della Ricerca Scientifica, Rome, Italy VAT: IT12651051000 Email: hello@shortli.ai