Privacy policy

This English translation is provided for convenience; the French version prevails.

This policy describes how TrueCalling ("we", "us", "our") collects, uses and protects the personal data of visitors, prospects and candidates who use the truecalling.ai website (the "Site") and its forms. It is drafted in accordance with Regulation (EU) 2016/679 ("GDPR") and French Act No. 78-17 of 6 January 1978, as amended (the "French Data Protection Act").

1. Data controller

The data controller within the meaning of Article 4(7) GDPR is:

TRUECALLING AI Corp
Corporation (Florida, United States), Florida corporate registry document No. P25000056769
4761 SW 43rd Terrace, Fort Lauderdale, FL 33314, United States
Registered agent: 5504 North Park Road, Fort Lauderdale, FL 33312, United States
EIN (Employer Identification Number): 39-4384470, issued on 16 September 2025 by the IRS
Contact: contact@truecalling.ai

Data Protection Officer (DPO): not appointed. For any question relating to your data, write to us at contact@truecalling.ai.

Representative in the European Union (Art. 27 GDPR): as TRUECALLING AI Corp is established in the United States and offers its services to European Union residents through this Site (available in French, German, Spanish, Italian, Dutch and Portuguese, among other languages), Article 27 GDPR requires the appointment of a representative in the Union. This appointment is in progress. Pending this formal appointment, you may exercise all of your GDPR rights directly with TRUECALLING AI Corp at contact@truecalling.ai.

2. Overview of processing activities

3. Processing activities in detail

3.1 Demo request

Page concerned: /en/book-a-demo and its localised equivalents.

Data collected: first and last name (required), business email (required), phone number (optional), job title / role (optional), company name (required), size of the recruiting team (required), number of hires per year (required), desired timeline (required), free-form message (optional, 2,000 characters maximum), page language (technical), and the provenance of the request (see 3.8).

Purpose: to arrange a sales demonstration of the product at your request, to follow up with you, and to send you a confirmation.

Legal basis: performance of pre-contractual measures taken at your request (Article 6(1)(b) GDPR).

Recipients: the TrueCalling sales team, which receives your request by email; you (confirmation email, without the provenance). This data is not stored in a Site database.

Processors: Vercel, Inc. (runs the form), Resend, Inc. (sends the emails) and our team's email provider. See section 6.

Retention period: 3 years from our last contact.

3.2 Contact form

Page concerned: /en/contact and its localised equivalents.

Data collected: name, email, subject (chosen from a list), free-form message (10 to 4,000 characters), page language (technical), and the provenance of the request (see 3.8).

Purpose: to answer your enquiry.

Legal basis: legitimate interest (Article 6(1)(f) GDPR) in answering the people who write to us.

Recipients: your message is emailed to contact@truecalling.ai; you receive an acknowledgement in your language (without the provenance). This data is not stored in a Site database.

Processors: Vercel, Inc., Resend, Inc. and our team's email provider.

Retention period: 3 years from our last contact.

3.3 Startup program

Page concerned: /en/startup and its localised equivalents.

Data collected: company name, website (optional), contact name, work email, role (optional), company age, team size, funding stage, expected hiring volume, country (optional), message (optional), page language; technical data: country derived from your IP address and browser identifier (user agent); provenance of the request (see 3.8).

Purpose: to assess whether your company is eligible for the startup program and to follow up with you.

Legal basis: performance of pre-contractual measures taken at your request (Article 6(1)(b) GDPR).

Recipients: your request is stored in the TrueCalling application database (without the provenance) and notified to our team by email; you receive a confirmation email.

Processors: Vercel, Inc., Supabase, Inc. (database), Resend, Inc. and our team's email provider.

Retention period: 3 years from our last contact. You may ask us to delete your request at any time.

3.4 Newsletter and Freemium waitlist

Where: the newsletter popup on the home page and the "Notify me" form for the Freemium plan on the pricing page.

Data collected: email address; page language; origin of the sign-up (newsletter popup or Freemium waitlist); fixed campaign parameters that are identical for every sign-up.

Purposes: to send you our newsletter about recruiting and sourcing; for the waitlist, to tell you when the Freemium plan launches. Both forms feed the same list: joining the waitlist also subscribes you to the newsletter, and you receive the newsletter welcome email.

Legal basis: your consent (Article 6(1)(a) GDPR), given by submitting the form. You may withdraw it at any time, without giving a reason.

Recipients: your address is stored in the TrueCalling application database; a welcome email is sent to you.

Processors: Vercel, Inc., Supabase, Inc. (database) and Resend, Inc. (welcome email).

Retention period: until you unsubscribe. To unsubscribe, write to contact@truecalling.ai.

3.5 CV drop

Page concerned: /en/cv-drop and its localised equivalents.

Data collected: first name, last name, email, phone (optional), LinkedIn profile URL (optional), target role (optional), your CV (PDF, DOC, DOCX, JPG or PNG, 10 MB maximum) and the information it contains, page language; technical data: country derived from your IP address and browser identifier (user agent); provenance of the drop (see 3.8).

Purpose: as stated on the page, to make your profile visible to companies hiring through TrueCalling and to get back to you if an opportunity matches.

What happens after you submit:

• your CV and details are stored in the TrueCalling application (database and private file storage);
• our team receives an email with your contact details, the name and size of the file (not the CV itself) and the provenance of the drop; you receive a confirmation email;
• the text of your CV is extracted (using character recognition when the file is an image or a document that cannot be read directly), then analysed by an artificial intelligence model that computes a compatibility score against the open jobs of TrueCalling's client companies;
• your profile is added to the CV library of the companies whose jobs match best, up to 3 companies per drop;
• when a candidate record is created at one of these companies, a search for work and personal email addresses and phone numbers may be run with a contact-enrichment provider (FullEnrich), based on your name, your current employer or your LinkedIn profile.

The score is a decision aid for recruiters: no decision producing legal effects or similarly significantly affecting you is taken solely by automated means. You may obtain human intervention, express your point of view and contest an assessment (Article 22 GDPR) by writing to contact@truecalling.ai.

Legal basis: performance of pre-contractual measures taken at your request (Article 6(1)(b) GDPR).

Recipients: our team; the recruiters of the client companies (3 at most) to which your profile is put forward.

Processors: Vercel, Inc., Supabase, Inc. (database and storage), OpenAI (analysis and score), OCR.space (character recognition), FullEnrich (contact enrichment), Resend, Inc. and our team's email provider.

Retention period: 2 years from our last contact with you. You may ask at any time for your CV to be removed, including from the CV libraries of the companies it was put forward to.

3.6 Job application

Page concerned: the job offers published under /en/apply and its localised equivalents.

Data collected: full name, email, phone, LinkedIn profile URL (optional or required depending on the job), location, CV in PDF format (5 MB maximum) and its text; Cloudflare Turnstile anti-bot check (see 3.11).

Purpose: to pass your application on to the company that published the job. Your application is added to that company's CV library. No message is sent to you automatically: the recruiter decides on the next step.

Assessment of your CV: your CV is analysed by an artificial intelligence model (OpenAI). The following are recorded on your candidate record:

• a compatibility score against the job;
• the skills in your CV that match the job and those that are missing;
• a short summary, written by the model, comparing your CV with the job;
• a "resilience" score, estimated by the model from your career path or, failing that, calculated by fixed rules that take into account, in particular, the number of employers, positions held for less than a year (which lower the score) and senior or management positions;
• a "digital reputation" score, estimated by the model or, failing that, calculated from the elements of online presence mentioned in your CV (LinkedIn profile, GitHub, personal website, publications, certifications, open source contributions, public speaking).

These scores and this summary are a decision aid for the recruiter: no decision producing legal effects or similarly significantly affecting you is taken solely by automated means. You may obtain human intervention, express your point of view and contest an assessment (Article 22 GDPR) by writing to contact@truecalling.ai.

Legal basis: pre-contractual measures taken at your request (Article 6(1)(b) GDPR).

Roles: the company that published the job decides what happens to your application; for this processing it is the data controller and TRUECALLING AI Corp acts on its behalf, as stated in the candidate information notice.

Processors: Vercel, Inc., Cloudflare, Inc. (Turnstile), Supabase, Inc. (database and storage) and OpenAI (analysis and score).

Retention period: 2 years after the end of the recruitment process you applied to. You may ask us to delete your application at any time.

3.7 Job search

Page concerned: the job search engine at /en/apply.

Text search: your query (500 characters maximum) and the filters you choose are sent to the TrueCalling application, which uses an artificial intelligence model (OpenAI) to interpret the query and rank the jobs. When you do not attach a CV, the query is not stored.

Search with your CV: you can attach your CV (PDF, 10 MB maximum). Its text is extracted on our server, then sent to OpenAI to find the closest jobs. Your CV is also stored as a CV drop, together with the query you typed (kept as the "target role"), the email address found in the CV if there is one, the country derived from your IP address and the browser identifier. It follows the processing described in 3.5: analysis by the artificial intelligence model, which also uses the query you typed; being put forward to at most 3 client companies, which receive the query as the title of the role sought; contact search.

Legal basis: performance of the search service you request (Article 6(1)(b) GDPR); for storing your CV and the query you typed, and passing them on to companies, our legitimate interest in connecting candidates with hiring companies (Article 6(1)(f) GDPR). You may object at any time by writing to contact@truecalling.ai: your CV and the related query will then be deleted.

Retention period: without an attached CV, the query is not kept; with a CV, the CV and the query you typed are kept as a CV drop, for 2 years from our last contact with you (see 3.5).

3.8 Request provenance

Forms concerned: demo request, contact, startup program and CV drop.

Data: when you submit, the form attaches to your request:

• the page you came from: the page path for a page of the Site, the domain name only for an external site (for example www.google.com, never the full address), or "(direct)";
• the entry page, when you reached the form without reloading the page;
• the form page;
• the campaign parameters in the page address (utm_source, utm_medium, utm_campaign), if any.

This information is computed from what your browser already tells the page; nothing is stored on your device. It appears only in the internal email sent to our team: not in the confirmation email sent to you, and not in the application database.

Purpose: to know which pages and campaigns bring in requests, so that each sales request can be attributed to its source.

Legal basis: legitimate interest (Article 6(1)(f) GDPR) in measuring how well our pages and campaigns work. The data is kept to the strict minimum (domain name only for an external site). You may object by writing to contact@truecalling.ai.

Retention period: the same as the request it is attached to.

This information is not sent to our audience measurement tools. Only conversion events with no identifying data are, and only with your consent (see 3.9).

3.9 Audience measurement

With your "Analytics" consent (cookie banner):

• Google Analytics 4 (Google LLC) sets cookies (_ga, _ga_*) and measures page views, visit duration and source, device and browser type and approximate location.
• Conversion events are sent to Google Analytics and Vercel Web Analytics: request sent (form type, page that led to it), newsletter or waitlist sign-up, job application or CV drop (type, job identifier), click to the demo page or to the application (page of the click), page language. They never contain your name, email, phone number, the text you type or the content of your CV.
• The Site also provides for the PostHog tool (hosted in the European Union), subject to the same consent; it is not enabled as at the date of this policy.

Without consent (before you choose or after you refuse):

• the Google Analytics script is loaded for every visitor in "consent mode": it sets no cookie, but sends Google signals with no identifier (timestamp, browser, referring page, consent state);
• Vercel Web Analytics and Vercel Speed Insights are active for every visitor. They set no cookie. Vercel Web Analytics records the page visited, the referring page, some address parameters, approximate location, operating system, browser and device type; according to Vercel, the visit is recognised by a hash computed from the request. Speed Insights measures page loading performance (country, browser, network type).

Legal basis: your consent (Article 6(1)(a) GDPR) for Google Analytics with cookies and for conversion events; our legitimate interest (Article 6(1)(f) GDPR) in measuring the Site's traffic and performance for cookieless measurement.

Retention period: Google Analytics cookies: 2 years at most (set by Google); event data in Google Analytics: 14 months. Your choice in the banner is kept for 13 months.

3.10 Visit tracking by lemlist

Only with your "Marketing" consent (cookie banner, box unticked by default, or the "Accept all" button): lemlist's visitor tracking script is loaded. It may place an identifier on your browser and sends lemlist the pages you view and technical connection data, including your IP address.

Ticking "Marketing" also gives Google, through Google Analytics consent mode, your agreement to the storage and use of data for advertising purposes. The Site currently contains no advertising tag (Google Ads or other).

Purpose: to let our sales team recognise visits from companies and contacts it already follows in its prospecting campaigns, so it can choose the right time to get back to them.

Legal basis: your consent (Article 6(1)(a) GDPR), which you may withdraw at any time (see 3.12).

Recipient: lemlist (France).

3.11 Hosting, security and technical logs

• The Site is hosted by Vercel. The server functions that receive your forms run in the United States (Washington region). Vercel keeps technical logs (IP address, browser, page requested, date and time).
• If sending an email or storing a request fails, the content of the form is written to the server log so that the request is not lost.
• To limit abuse, the number of submissions per IP address is capped; this count is kept in server memory and not stored. The forms also include an invisible anti-bot field.
• The job application form (3.6) uses Cloudflare Turnstile, loaded from challenges.cloudflare.com: Cloudflare receives your IP address and information about your browser to check that you are not a bot.
• On the job board, company logos are loaded from third-party servers (Google, company websites, Clearbit): as with any image, these servers receive your IP address and information about your browser.

Legal basis: legitimate interest (Article 6(1)(f) GDPR) in running and protecting the Site.

3.12 Cookies, local storage and withdrawing consent

Details are in the cookie policy. A banner lets you accept, refuse or choose audience measurement (3.9) and marketing (3.10). Your choice is kept for 13 months in your browser's local storage. To change it or withdraw your consent, clear the truecalling.ai site data in your browser (or the tc-consent-v1 local storage entry): the banner will appear again.

4. Your GDPR rights

In accordance with Articles 15 to 22 GDPR, you have the following rights at any time:

• Right of access (Art. 15): obtain a copy of the data concerning you.
• Right to rectification (Art. 16): correct inaccurate or incomplete data.
• Right to erasure (Art. 17): request the deletion of your data.
• Right to restriction of processing (Art. 18).
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format.
• Right to object (Art. 21) to processing based on legitimate interest (for example request provenance or the storage of a CV used for a job search).
• Right to withdraw your consent at any time (newsletter, audience measurement, marketing), without affecting processing already carried out.
• Rights relating to automated analysis (Art. 22): obtain human intervention, express your point of view and contest an assessment of your CV.

How to exercise these rights? Write to us at contact@truecalling.ai specifying the right you wish to exercise. We will respond within one month (Article 12(3) GDPR), extendable by two months for complex requests. If your CV has been put forward to client companies, we pass your rectification or erasure request on to them (Article 19 GDPR).

Complaint to the CNIL: if you consider that your rights are not being respected, you may lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

5. Security

• HTTPS / TLS encryption across the entire Site
• Encryption at rest with our processors
• Strict access control on administrator accounts
• Anti-spam (honeypot) fields on forms, Cloudflare Turnstile on the job application form and a cap on submissions per IP address
• Server-side validation of all inputs (Zod)
• Checks on the real type and size of uploaded files; CVs stored in private, non-public storage
• Secrets (API keys) stored in encrypted environment variables

6. Recipients, processors and transfers outside the European Union

This policy covers the people who use the truecalling.ai website. If you are a candidate and were contacted through our platform (for example by Emily), the full list of processors that apply to you can be found in the candidate information notice.

Recipients: authorised TrueCalling staff; for CVs and job applications, the recruiters of the client companies concerned (3.5 to 3.7); our processors, who act on our instructions.

Where form data is hosted: the data stored by the TrueCalling application (startup program, newsletter, CVs, job applications) is kept in a Supabase database hosted in the Amazon Web Services Frankfurt region (Germany). The Site's server functions, which receive your forms before passing them on, run in the United States (Vercel).

Our processors established in the United States (the data they receive may be processed in the United States):

• Vercel, Inc.: hosting of the Site and its server functions (run in the United States), Web Analytics, Speed Insights.
• Resend, Inc.: sending emails (confirmations, internal notifications, welcome email).
• Supabase, Inc.: application database and file storage, hosted in Frankfurt (Germany); access from the United States by this provider remains possible.
• OpenAI: CV analysis, compatibility score and job search.
• FullEnrich: candidate contact search (3.5).
• Cloudflare, Inc.: Turnstile anti-bot protection on the job application form.
• Google LLC: Google Analytics.

Our processors established in the European Union: OCR.space (a9t9 software GmbH, Germany), character recognition on CVs; lemlist (France), visit tracking with your consent (3.10).

Notification emails are also received in our team's business mailbox, hosted by an email provider.

7. Changes to this policy

We may amend this policy to reflect changes to the Site. The date at the top of this document indicates the last update. For any substantial change, we will take reasonable steps to inform you.