Privacy Policy

Controller: Evalgist BV, KBO 1037.260.590, VAT BE 1037.260.590, with its registered office at Bosstraat 13, 9820 Merelbeke, Belgium (privacy@evalgist.ai).

Evalgist Shortlist (“Shortlist”) helps organisations evaluate candidate documents against the selection criteria for a particular vacancy. This policy explains which personal data Evalgist BV handles, why it is used, how long it is kept, and which choices and rights people have.

Evalgist has two different privacy roles

Evalgist is the controller for data used to run its own service: shared Evalgist account and access data, purchases and accounting, contact and support messages, security records, and basic product analytics that exclude candidate and project content. In that role, Evalgist decides why and how the data is used.

For personal data submitted to a Shortlist project, or generated from that data (“Project Personal Data”), the person or organisation using Shortlist is the controller and Evalgist is its processor. This includes personal data about candidates and other people mentioned in uploaded documents, notes, or project records. The person or organisation decides why the data is used, which criteria apply, and what action to take.

If you are a candidate whose information was placed in Shortlist, the person or organisation conducting the recruitment is normally your main privacy contact. Evalgist will direct a request concerning Project Personal Data to that person or organisation and help it respond where required. The Data Processing Agreement governs Evalgist’s processor role.

Data Evalgist processes as controller

Most of this information comes directly from the account holder. Evalgist also receives authentication and session information from its login provider, payment status from its payment provider, and technical events from the service itself.

Account and access. Name, email address, account and organisation identifiers, signup source, authentication, and session information are used to create and operate the shared Evalgist account, provide Shortlist, and keep access secure. The legal basis is performance of the service agreement and Evalgist’s legitimate interest in protecting the service.

Purchases and accounting. Billing and company details, VAT information, purchases, payment status, invoice references, and credit transactions are used to process payments, maintain credit balances, issue invoices, prevent fraud, and meet tax and accounting duties. The legal basis is performance of the purchase, legal obligations, and legitimate interests in preventing fraud and resolving payment disputes.

Contact and support. Evalgist uses contact details and the content of correspondence to answer questions and provide requested support. Depending on the contact, the legal basis is taking requested steps, performing the service agreement, or Evalgist’s legitimate interest in customer support.

Security and diagnostics. IP address, device and browser details, login and security events, timestamps, stack traces, and request metadata may be used to secure Shortlist, investigate abuse or incidents, and fix errors. The legal basis is Evalgist’s legitimate interest in providing a secure and reliable service and, where relevant, a legal obligation.

Basic product analytics. Page and workflow events, timestamps, typed event metadata, and a pseudonymous account identifier help Evalgist understand whether key product flows work and where they fail. These analytics exclude resumes, candidate names, extracted text, criteria, assessments, notes, and other project content. The legal basis is Evalgist’s legitimate interest in improving Shortlist without analysing candidate content.

Project Personal Data processed for customers

Project Personal Data can include vacancy information and criteria; resumes, application forms, motivation letters, and related files; names, contact details, employment history, education, qualifications, skills, references, and other information in those files; and reviewer names, notes, statuses, and decisions.

Shortlist also generates extracted text, OCR results, candidate profiles, summaries, supporting passages, assessments, broad match bands, comparisons, proposed rankings, exports, and project audit information. Evalgist processes this data only to operate, secure, support, and delete Shortlist as the customer uses and configures it.

Evalgist does not use Project Personal Data for advertising or to train models made available to other customers or general-purpose models. Evalgist does not select or reject candidates. Shortlist supplies assessments and supporting material to the customer, which remains responsible for human review and any decision affecting a candidate.

AI processing

Document analysis and OCR requests are routed through OpenRouter with Zero Data Retention enabled. Requests are sent only to endpoints that OpenRouter designates as not retaining prompts and responses. The current model publishers and their roles are identified in the Subprocessors register.

Zero Data Retention limits retention by the AI routing and inference providers; it does not mean that the Shortlist project itself disappears after each analysis. Project uploads, extracted content, assessments, and other project records remain in Shortlist until the customer deletes them or Shortlist deletes the project data after credit expiry as described below.

Service providers and access

Evalgist uses providers for application hosting, authentication, database and file storage, AI routing and inference, transactional email, payments, accounting, analytics, and error monitoring. The Subprocessors register identifies the current providers, their roles, known processing locations, and privacy information.

Current register: evalgist.ai/subprocessors

Project content is processed automatically by Evalgist systems and the listed providers. Evalgist personnel do not routinely view it. Any exceptional access needed for support, security, incident investigation, or compliance is limited to authorised people who need it and are bound by confidentiality.

Evalgist does not sell personal data. It may disclose data where a legal requirement applies or where reasonably necessary to establish, exercise, or defend a legal claim.

Processing locations

Shortlist project database and file storage are hosted in Ireland. AI processing may take place outside the European Economic Area (“EEA”) and is not represented as EU-only. Account, email, payment, analytics, and other service data may also be handled in the locations stated in the Subprocessors register.

Where a provider processes personal data outside the EEA, Evalgist uses that provider under its applicable service and data-processing terms, including the international transfer safeguards required for that processing. OpenRouter’s Zero Data Retention setting is an additional retention safeguard, not an international transfer mechanism.

Retention and deletion

Shortlist projects. Shortlist keeps a project's uploads, extracted text, and results while the customer has usable credits. When the last usable credits expire, Evalgist deletes all of the customer's Shortlist project data 30 days later, unless new credits are added before then. Evalgist sends reminders before credits expire and during the 30 days.

Earlier deletion. A customer can delete a project or an individual candidate earlier. Project deletion removes all content associated with that project from active Evalgist systems. Removing one candidate deletes that candidate’s uploads and derived content while leaving the rest of the project available. Deleting the shared Evalgist account deletes all Shortlist project data.

Backups and limited records. Protected backup copies may remain until overwritten in the normal backup cycle and are not available for normal product use. Evalgist may retain minimal deletion, security, or compliance records that do not preserve project content, and records that law requires it to keep.

Account and contact data. Account data is kept while the shared Evalgist account is active and afterwards only for the limited period needed to close the service, maintain security, or resolve an outstanding issue. Support correspondence is kept while needed to handle the request and related security or dispute matters.

Invoices, payments, and credits. These records are stored separately from projects and are not deleted with a project or account. Invoices and supporting accounting records are retained for the statutory Belgian accounting and tax period, currently generally 10 years from 1 January following the date of issue, and longer where a specific legal rule applies. Payment and credit records are kept for the corresponding legal period and, where needed, to administer balances, prevent fraud, or resolve disputes.

Security, diagnostics, and analytics. These records are kept only for as long as reasonably needed to protect, troubleshoot, and improve the service. Retention depends on the type of event, its security relevance, and the provider involved; it does not extend the retention of candidate or project content.

Cookies and product analytics

Shortlist uses the session technology needed for login and account security. PostHog analytics are configured without analytics cookies or browser persistence, autocapture, Session Replay, heatmaps, advertising pixels, surveys, or anonymous visitor experiments. Sentry Session Replay is also disabled.

When someone creates an account from a campaign link, Shortlist may store the campaign source on the authenticated product profile. Full referrer URLs and candidate or project content are not sent to product analytics. If Evalgist later introduces optional cookies or similar browser storage, it will request consent where the law requires it.

Privacy rights

For data for which Evalgist is controller, a person may ask for access, correction, deletion, restriction, or portability, or object to processing based on legitimate interests. Where processing is based on consent, consent may be withdrawn at any time. Which rights apply depends on the data and reason for processing.

Requests can be sent to privacy@evalgist.ai. Evalgist normally responds within one month. If a request concerns Project Personal Data, Evalgist will direct it to the customer acting as controller or assist that customer with its response.

Evalgist does not use account, billing, support, security, or analytics data to make solely automated decisions with legal or similarly significant effects. Shortlist outputs are generated for the customer; questions about how they were used in a recruitment decision should be addressed to that customer.

You have the right to lodge a complaint with a data protection supervisory authority.

Security

Evalgist uses technical and organisational measures appropriate to the risks of the service, including access controls, encryption in transit and at rest for hosted systems, EU project storage, limited administrative access, monitoring, protected backups, and Zero Data Retention routing for AI requests.

Changes and contact

Evalgist may update this policy when Shortlist, its providers, or applicable law changes. The date above shows the latest version. Active customers will receive notice before a material change where practical.

Privacy questions and requests may be sent to privacy@evalgist.ai.