1. Who We Are and Scope

AINA is operated by Senocom Ltd ("Senocom", "AINA", "we", "us" or "our"), a company incorporated in Cyprus, registration number HE468429, registered address: Germasogeia, Kapsalion 4, Floor 2, Flat/Office 203, Block B, 4044 Limassol, Cyprus. You can contact us at main@aina-tech.com.

This Privacy Policy explains how we handle personal data when you visit aina-tech.io or use AINA candidate, career, recruitment, employer, AI-powered and related services, including the AINA Telegram bot where available (the "Service"). It applies to candidates, job seekers, employer representatives, recruiters and visitors. The Service is intended for persons aged 18 or over.

2. When We Are a Controller or Processor

Senocom is generally a data controller for AINA account administration, candidate-facing career tools, communications, product analytics, service security and our own business activities: we determine why and how these data are processed.

When an employer uses AINA to manage its recruitment process and determines how applicant information is used, that employer generally acts as controller and Senocom acts as processor under a Data Processing Agreement (DPA). For employer-controlled recruitment data, the employer’s privacy information and instructions also apply. The precise role depends on the specific processing activity, including how professional profiles are sourced and shared.

3. Personal Data and Sources

Depending on your use of the Service, we may process:

• Identity, account and business details: name, email, telephone number where supplied, account identifiers, credentials or authentication data, preferences, employer affiliation, role and permissions.
• Professional and career information: CVs, imported resume or LinkedIn information provided by the user, education, skills, career history, qualifications, location, preferences, salary expectations, job searches and applications.
• Communications and AI content: messages to the AI career coach, interview answers, recordings where the relevant feature is used, speech transcripts, summaries, assessments, generated recommendations, scores and other outputs that may relate to identifiable persons.
• Website and product activity: IP addresses, device/browser characteristics, logs, cookie or similar identifiers, traffic sources, user_id and feature usage events.
• Billing and subscription information: subscription status, billing details where required, payment amounts, transaction references and related records. We do not receive or store full payment card numbers or card security codes for ordinary card payments.
• Connected Google account data (where a recruiter enables the integration): the Google account email address, OAuth authorisation tokens, free/busy time slots, AINA-managed calendar event details, and candidate email replies retrieved through the selected Gmail feature.
• Connected AI chat and questionnaire information: which of ChatGPT or Claude a candidate connected and when, authorised AINA profile and mock-interview actions, integration usage and limits; and, for the optional website career questionnaire, email address, selected career situation, interface language, submission date and marketing preferences.

We obtain information directly from you, through your interactions with the Service, from employers or recruiters, and, where relevant sourcing features are used, from publicly available professional profiles, recruitment platforms, employer-provided information and other lawful sources. These sources may include publicly available professional information. Where Senocom independently determines the purposes and essential means of collecting or using candidate information, it acts as data controller and is responsible for providing information required under Article 14 GDPR within the applicable period, subject to lawful exceptions. Where we process candidate data solely on an employer’s documented instructions for its recruitment purposes, the employer generally acts as controller and Senocom acts as processor; the employer is responsible for applicable transparency obligations, and we assist under our DPA. Where available and legally required, more specific source information may be provided to the individual upon request or through a separate notice.

We do not ordinarily request special-category personal data (such as health information or political opinions). Please avoid including these unless necessary. Where such data are processed, an applicable Article 9 GDPR condition is required in addition to a lawful basis under Article 6.

4. Why We Process Data and Our Legal Bases

To create accounts, provide candidate profiles, career tools, job-application features and other requested services: performance of a contract or steps requested before a contract, where necessary (Article 6(1)(b) GDPR).

To operate recruiter-requested Google Calendar and Gmail integrations: performance of the relevant service contract where applicable (Article 6(1)(b)), or our legitimate interests in delivering and securing employer-requested functions where the recruiter is not personally a party to that contract (Article 6(1)(f)). Google OAuth authorisation is also required to obtain API access; it does not replace a GDPR lawful basis.

To enable candidate-authorised AINA features in ChatGPT or Claude: performance of the candidate service contract (Article 6(1)(b)); to measure connection activity, mock-interview starts and applicable usage limits for product operation and improvement: legitimate interests (Article 6(1)(f)), subject to the individual’s rights.

To send the career preparation plan requested through the website questionnaire: steps taken at the individual’s request or performance of a service (Article 6(1)(b), where applicable). To assess completion, registration and purchase conversion by matching the submitted email to a later AINA account: legitimate interests in improving the Service (Article 6(1)(f)), subject to any separate consent required for tracking technologies. Optional career tips and AINA news are sent only where the individual opts in, on the applicable consent basis.

To support employer-led recruitment: the employer determines its applicable lawful basis where Senocom acts as processor. Where Senocom independently determines the purposes and essential means of candidate sourcing or matching, we assess legitimate interests (Article 6(1)(f)) where appropriate, including an interests-balancing assessment, or another applicable lawful basis.

To operate, secure, troubleshoot and improve the Service: legitimate interests (Article 6(1)(f)) where appropriate, and other applicable grounds depending on the activity.

To conduct optional website/product analytics and use non-essential tracking technologies: consent (Article 6(1)(a)) where required. Necessary technical and security processing may use a different applicable basis.

To administer subscriptions and payments: contract (Article 6(1)(b)) and legal obligations for applicable accounting/tax records (Article 6(1)(c)).

To send marketing communications: consent where required or another permitted basis under applicable direct marketing laws; you may opt out.

To comply with law and defend legal claims: legal obligation (Article 6(1)(c)) or legitimate interests (Article 6(1)(f)), as applicable.

If we rely on legitimate interests, we assess whether the processing is necessary and whether individuals’ rights override those interests. Where processing is based on consent, you may withdraw it at any time without affecting earlier lawful processing.

5. AI-Assisted Features, Recording and Profiling

AINA uses third-party AI and speech-processing providers for CV analysis, career guidance, interview preparation and delivery, transcription, matching and candidate assessment. Depending on the relevant feature, necessary CV, professional profile, conversation and transcript data may be provided to these vendors.

Speech-to-text functionality may use providers such as Deepgram. Provider involvement and the scope of data shared depend on the enabled feature and the actual technical configuration.

Before AI-assisted interviews, candidates are informed about AI use and that their voice may be recorded and transcribed. AI-generated scores and assessments may involve profiling. AI-generated recommendations and assessments are advisory and may contain inaccuracies. Final recruitment decisions are made by human employers or recruiters.

In some cases an employer may apply predefined, objectively justified mandatory screening criteria based on a candidate’s direct answers to application questions, but only where permitted by applicable law. Automated rejection must not be based solely on an AI-generated assessment in violation of the law. Where GDPR requirements concerning solely automated decisions producing legal or similarly significant effects apply, the required conditions, transparency and safeguards, including applicable rights to challenge a decision, must be respected.

6. Who Receives Personal Data

Where relevant, personal data may be received by employers and authorised recruiters; infrastructure and hosting providers; AI model, speech and communications vendors; Google where recruiters connect Gmail or Calendar; OpenAI or Anthropic when candidates connect AINA in ChatGPT or Claude; analytics and messaging providers; payment services; advisers; and competent authorities upon lawful request. Connected AI chat services may receive AINA data only within the permissions authorised by the candidate and process it under their own privacy terms. Sharing of candidate information and access by employers must comply with the applicable restrictions on personal-data use and disclosure.

The specific vendors depend on the enabled features and may change. Depending on the actual relationship, recipients may act as processors, sub-processors or independent controllers. We use applicable contractual and technical safeguards. Candidate information may be made available to multiple employers in relevant sourcing or shared database features as described by the Service; this processing requires a separate assessment of legal basis, transparency and roles.

7. Connected Google Accounts — Calendar and Gmail

Recruiters can optionally connect a Google account to AINA. Each permission is requested through the Google authorisation screen for the feature selected by the recruiter. Connecting a Google account is not required to use unrelated AINA features.

Google Calendar free/busy (calendar.freebusy): AINA retrieves busy and available time ranges for interview scheduling. The free/busy response does not include meeting names, descriptions or attendees.

Google Calendar events on owned calendars (calendar.events.owned): this permission allows access to events on calendars owned by the recruiter. AINA uses it to create, reschedule and cancel interview events booked through AINA, and in normal operation changes or deletes only events it created. The scope itself permits broader calendar-event access than this limited operational use.

Gmail (gmail.send and gmail.readonly): when the recruiter enables email communication, AINA may send candidate messages from the connected Gmail account. The read-only scope technically allows access to mailbox messages and settings; AINA uses that access to identify candidate replies to AINA-related messages and present relevant replies in the candidate chat, rather than to review unrelated correspondence.

We retain the connected Google account address and the OAuth tokens needed for these features. AINA does not sell Google user data, use it for advertising or train general-purpose AI or machine-learning models on it. Human access to Google API data is restricted to the user’s affirmative agreement, necessary security activities, legally required access or other cases expressly permitted by Google’s Limited Use rules.

Recruiters can disconnect Google in AINA or revoke authorisation in their Google account settings. Disconnecting revokes the connection and deletes the stored OAuth tokens used by AINA. Our use and transfer of information received from Google APIs comply with the Google API Services User Data Policy, including the Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy.

8. AINA Connected to ChatGPT and Claude

Candidates may connect AINA to ChatGPT (OpenAI) or Claude (Anthropic). Public vacancy searches can be used without an AINA account: the chat sends AINA the search criteria and AINA returns publicly available vacancies. AINA does not receive the rest of the chat conversation for this search.

To access account-based features, the candidate signs in to AINA and uses AINA’s consent screen to authorise the selected chat. Within the granted permissions, the connected chat may read and update the candidate’s AINA profile and CV, create mock interviews, and retrieve interview status, feedback and assessments.

Data returned by AINA to a connected chat becomes part of that chat interaction and is processed by OpenAI or Anthropic under the respective provider’s privacy terms. AINA does not receive unrelated parts of the conversation and does not use them to train AI models.

We record which chat was connected and when, and connection, interview-start and usage-limit events to operate and improve the Service. Candidates can disconnect a chat under AINA Settings > General > Connected Chats. This blocks further AINA account access through that connection; data already received by the chat provider may remain subject to that provider’s terms.

9. Website Career Questionnaire

Visitors may complete the career questionnaire on aina-tech.io and provide an email address on its final step without creating an AINA account. We record the email address, the career situation selected, interface language, date of submission and whether the visitor opted in to career tips and AINA news.

We use these data to deliver the requested preparation plan and measure the progression from questionnaire submission to registration and purchase. To measure this progression, we may match the questionnaire email address to an AINA account later created using the same email address. Optional promotional emails are sent only to visitors who opted in, and an unsubscribe option is provided in each such email.

The visitor may request deletion of questionnaire personal data by contacting main@aina-tech.com, subject to any applicable legal exceptions.

10. Cookies and Analytics

Necessary technologies support core functions and security. Optional analytics and marketing technologies, including session replay, are disabled until the relevant consent is given through our cookie-consent mechanism where required. They remain optional; users can reject them and later withdraw consent through cookie settings.

Our analytics services include Google Analytics (Google Ireland Limited), Amplitude (Amplitude, Inc.; United States), PostHog (PostHog, Inc.; EU-hosted project) and Yandex Metrika (Yandex LLC). They may process page views, clicks, referral and UTM data, device/browser information, technical identifiers and product events. Amplitude receives an internal user_id and product-usage events rather than account email addresses in the described implementation; an internal user_id may still be personal data. PostHog may record on-page sessions to help identify usability problems. Replay capture is configured to mask typed input and contact details such as email addresses and telephone numbers. These data are not necessarily anonymous. See our Cookies Policy: https://aina-tech.io/legal/cookies-policy.

11. International Transfers

Senocom is incorporated in Cyprus. The currently confirmed primary AWS hosting region for AINA is Frankfurt, Germany (eu-central-1). Access to information or specific operations may also occur outside the European Economic Area, including through AI, analytics and communication providers, subject to applicable law.

Where a recruiter connects Google services, Google may process account information and API data according to its applicable terms. Candidate-authorised sharing with ChatGPT or Claude involves processing by OpenAI or Anthropic respectively. Our EU-hosted PostHog project stores its analytics data in the EU, without implying that all other recipients process data exclusively in the EEA.

Any transfer subject to Chapter V GDPR must have a valid transfer mechanism and, where necessary, additional safeguards. The available mechanisms include European Commission adequacy decisions, Standard Contractual Clauses and other lawful mechanisms where applicable. You may contact us at main@aina-tech.com to request information about the safeguards applicable to your data and how to obtain a copy of, or access to, them.

12. Retention and Deletion

We keep personal data only for as long as necessary for the purposes described above, taking into account the service used, whether an account remains active, employer instructions, applicable legal requirements, the nature of the information and the need to establish, exercise or defend legal claims.

Account and career-profile data are generally retained while the account or relevant service is active and for any additional justified period.

Employer-controlled recruitment records may be retained after a vacancy closes, including for future recruitment, only where the employer has an appropriate lawful basis, has provided any required notices and has established appropriate retention criteria. Senocom acts on documented employer instructions under the DPA.

Interview recordings, transcripts and AI-generated assessments are retained according to the purposes for which they were collected, applicable employer instructions, account settings where relevant and defined retention arrangements.

Analytics records are retained in accordance with our retention criteria and provider settings; cookie lifetimes do not necessarily equal server-side event retention.

For Google integrations, we retain the connected account address and access tokens only while required to operate the enabled integration and remove or invalidate them on disconnection; associated messages or calendar information are subject to applicable retention obligations.

For AI chat connections, we retain connection history and necessary usage/limit records for service operation and legitimate product improvement purposes. Disconnecting prevents future access to AINA through that connection; data already transferred to an external chat may remain there under that provider’s policies.

Questionnaire submissions, including unregistered email addresses and opt-in records, are retained only for the relevant preparation-plan, conversion-measurement and permitted messaging purposes, subject to lawful retention needs and erasure rights.

Billing and transaction records are retained as required by applicable contractual, tax and accounting obligations.

When information is no longer required, we delete or anonymise it unless another lawful basis justifies continued retention. Where appropriate, backup and third-party deletion follows applicable retention procedures. Individuals may request erasure subject to legal exceptions.

13. Required Information and Consequences

Where information is marked as required for registration, an application or a feature, it is necessary to provide that feature or process the request. If you choose not to provide it, the associated service may be unavailable. Optional profile, marketing and analytics information is not required to use unrelated core features.

14. Your Rights and Complaints

Where GDPR applies, you may have the right to access your data, correct it, request erasure or restriction, receive portable data where applicable, object to processing based on legitimate interests, and object to direct marketing at any time. You may withdraw consent without affecting the lawfulness of earlier processing. Rights concerning automated decision-making apply where the relevant legal conditions are met.

Send requests to main@aina-tech.com. We ordinarily respond within one month under GDPR, subject to permitted extensions and exceptions. If data are processed for an employer as controller, we may direct your request to that employer and assist with its response. You may complain to a competent EU supervisory authority, including the Cyprus Commissioner for Personal Data Protection.

15. Users in Other Jurisdictions

If another country’s personal-data legislation applies to particular processing, its mandatory rules on lawful bases, security, transparency, data localisation, international transfers and data subject rights must be respected. This Policy does not replace separate notices, consents, regulatory filings or technical measures required by applicable law.

Our authorised contact in the Russian Federation for personal-data enquiries and complaints is Dmitry Ivanovich Zavadsky (Завадский Дмитрий Иванович), main@aina-tech.com. This appointment does not automatically designate him as a GDPR Data Protection Officer and does not replace Senocom’s own controller responsibilities, where applicable.

16. Security, Updates and Contact

We implement technical and organisational measures appropriate to the risks, such as restricted access, secure communication, confidentiality obligations, logging and operational safeguards. No system is entirely free from security risk.

We may update this Policy when our practices or legal requirements change. The current version will be made available on our website, with additional notice where legally required.

Senocom Ltd | Registration No. HE468429 | Germasogeia, Kapsalion 4, Floor 2, Flat/Office 203, Block B, 4044 Limassol, Cyprus | Email: main@aina-tech.com | https://aina-tech.io