Privacy policy

This English translation is provided for convenience; the French version prevails.

This policy describes how TrueCalling ("we", "us", "our") collects, uses and protects the personal data of visitors and prospects on the truecalling.ai website (the "Site"). It is drafted in accordance with Regulation (EU) 2016/679 ("GDPR") and French Act No. 78-17 of 6 January 1978, as amended (the "French Data Protection Act").

1. Data controller

The data controller within the meaning of Article 4(7) GDPR is:

TRUECALLING AI
Corporation (Florida, United States)
5504 North Park Rd, Fort Lauderdale, FL 33312, United States
EIN (Employer Identification Number): 39-4384470, issued on 16 September 2025 by the IRS
Contact: contact@truecalling.ai

Data Protection Officer (DPO): not appointed. Appointing a DPO is not mandatory for the current processing (no large-scale processing, no special categories of data within the meaning of Article 9 GDPR, no systematic monitoring). For any question relating to your data, write to us at contact@truecalling.ai.

Representative in the European Union (Art. 27 GDPR): as TRUECALLING AI is established in the United States and offers its services to European Union residents through this Site (available in 8 European languages), Article 27 GDPR requires the appointment of a representative in the Union. This appointment is in progress. Pending this formal appointment, you may exercise all of your GDPR rights directly with TRUECALLING AI at contact@truecalling.ai.

2. Overview of processing activities

3. Processing activities in detail

3.1 Demo booking

Page concerned: /reserver-une-demo and its localised equivalents.

Data collected: first and last name (required), business email (required), phone number (optional), job title / role (optional), company name (required), size of the recruiting team (required), number of hires per year (required), desired timeline (required), free-form message (optional, 2,000 characters maximum), originating locale (technical).

Purpose: to arrange a sales demonstration of the product at your request, to follow up with you, and to send you a confirmation.

Legal basis: performance of pre-contractual measures taken at your request (Article 6(1)(b) GDPR).

Processor: Resend, Inc. (United States): transactional email provider. Transfer governed by the EU-U.S. Data Privacy Framework (DPF).

Retention period: 3 years from our last contact, in line with the commercial prospecting period recommended by the CNIL.

3.2 Newsletter sign-up

Data collected: email address only.

Purpose: to send you editorial content about AI sourcing on a periodic basis (approximately once a week).

Legal basis: your freely given, explicit consent (Article 6(1)(a) GDPR), confirmed by double opt-in.

Processor: Beehiiv, Inc. (United States). Transfer governed by the DPF.

Retention period: until you unsubscribe. An unsubscribe link is included in every email.

3.3 Contact form

Data collected: name, email, subject, free-form message.

Legal basis: legitimate interest (Article 6(1)(f) GDPR).

Note: as at the date of this policy, the contact form is not yet connected to an actual server-side email dispatch (implementation in progress). This policy will be updated as soon as routing is enabled.

3.4 Cookies and local storage

See the dedicated cookie policy. In short, the site uses no advertising trackers and no third-party audience measurement tools.

4. Your GDPR rights

In accordance with Articles 15 to 22 GDPR, you have the following rights at any time:

• Right of access (Art. 15): obtain a copy of the data concerning you.
• Right to rectification (Art. 16): correct inaccurate or incomplete data.
• Right to erasure (Art. 17): request the deletion of your data.
• Right to restriction of processing (Art. 18).
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format.
• Right to object (Art. 21) to processing based on legitimate interest.
• Right to withdraw your consent at any time.

How to exercise these rights? Write to us at contact@truecalling.ai specifying the right you wish to exercise. We will respond within one month (Article 12(3) GDPR), extendable by two months for complex requests.

Complaint to the CNIL: if you consider that your rights are not being respected, you may lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

5. Security

• HTTPS / TLS encryption across the entire Site
• Encryption at rest with our processors
• Strict access control on administrator accounts
• Anti-spam (honeypot) fields on forms
• Server-side validation of all inputs (Zod)
• Secrets (API keys) stored in encrypted environment variables

6. Transfers outside the European Union

This policy covers visitors to the truecalling.ai website. If you are a candidate and were contacted through our platform (for example by Emily), the full list of processors and the transfer mechanisms that apply to you can be found in the candidate information notice.

For visitors to the site, our processors established in the United States are:

• Vercel, Inc. (hosting of the site and edge functions): EU-U.S. Data Privacy Framework (DPF — active certification, HR Data covered).
• Cloudflare, Inc. (CDN and Turnstile anti-bot protection on forms): DPF (HR Data covered).
• Resend, Inc. (transactional emails for the contact form): DPF.
• Beehiiv, Inc. (newsletter — explicit opt-in): DPF.

These transfers are authorised by the European Commission's adequacy decision of 10 July 2023 concerning the DPF. This can be verified at dataprivacyframework.gov.

7. Changes to this policy

We may amend this policy to reflect changes to the Site. The date at the top of this document indicates the last update. For any substantial change, we will take reasonable steps to inform you.