Privacy Policy

1. Introduction

Speed Recruiting ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered recruitment platform, including our WhatsApp screening service.

We comply with the Personal Data Protection Act 2010 (PDPA) of Malaysia and other applicable data protection laws.

2. Information We Collect

2.1 Personal Information

• Name and contact details (email, phone number)
• Professional information (resume, work history, qualifications)
• Account credentials
• Organization details (for employers)

2.2 WhatsApp Communication Data

• WhatsApp phone number (encrypted and masked for privacy)
• Messages exchanged during AI screening interviews
• Screening session metadata (timestamps, completion status)

2.3 Technical Data

• IP address and device information
• Browser type and settings
• Usage data and analytics

3. How We Use Your Information

• To provide and maintain our recruitment platform services
• To conduct AI-powered screening interviews via WhatsApp
• To match candidates with suitable job opportunities
• To generate screening reports and assessments for employers
• To provide AI-powered screening assessments (Note: Anthropic's API does not use your data for model training)
• To communicate with you about our services
• To comply with legal obligations

4. Data Security

We implement industry-standard security measures to protect your data:

• AES-256-GCM encryption for sensitive data including WhatsApp messages
• Phone number masking to protect candidate identity
• Secure HTTPS connections for all data transmission
• Role-based access control for organizational data
• Regular security audits and monitoring

5. Data Sharing and Disclosure

We may share your information with:

• Employers (for candidates who participate in screening)
• Service providers (cloud hosting, AI processing)
• Legal authorities when required by law

We do not sell your personal data to third parties.

6. Third-Party Services

Our platform integrates with the following third-party services:

• WhatsApp Business API (Meta) for messaging
• Anthropic Claude AI for screening conversations
• Supabase for authentication and database services
• OpenAI Whisper for transcribing optional voice answers
• Resend for sending email notifications
• Vercel for application hosting and request logs

Each service has its own privacy policy and data handling practices.

Your data may be transferred to and processed in the following locations:

• Anthropic (Claude AI): United States
• OpenAI (Whisper, voice transcription): United States
• Supabase (database and authentication): AWS ap-southeast-1 (Singapore)
• Vercel (hosting): Singapore compute region; operational logs may be processed elsewhere
• Resend (email delivery): Tokyo, Japan
• Meta (WhatsApp): United States

6.1 Cross-Border Data Transfers

Section 129 of the Personal Data Protection Act 2010 (PDPA) governs transfers of personal data outside Malaysia. As amended by the Personal Data Protection (Amendment) Act 2024 and in force since 1 April 2025, the previous "whitelist" of approved destinations has been removed. A transfer is permitted where one of the conditions in Section 129 is met — including where the destination has a law substantially similar to the PDPA, where the recipient ensures an adequate level of protection, or where we have taken reasonable precautions and exercised due diligence through contractual safeguards.

Each recipient below is engaged under written data processing terms that require it to process personal data only on our instructions and to maintain a level of protection consistent with the PDPA 2010. Where we have negotiated a separate data processing agreement (DPA) with a recipient, this is stated against that recipient.

• Anthropic (United States): AI processing of screening conversations. A DPA is in place ensuring data protection standards equivalent to PDPA requirements. Anthropic's API does not use your data for model training.
• Meta (United States): WhatsApp Business API for messaging. A DPA is in place ensuring data protection standards equivalent to PDPA requirements.
• OpenAI (United States): transcription of optional voice answers. Engaged under OpenAI's data processing terms; API inputs are not used for model training.
• Resend (Japan): delivery of notification emails. Receives your name, email address and the position you applied for. Engaged under Resend's data processing terms.
• Vercel (Singapore): application hosting. Application compute runs in the Singapore region; operational request logs may be processed in other regions operated by Vercel. Engaged under Vercel's data processing terms.

7. Automated Screening Assessment

Your interview is conducted by an AI interviewer, and your answers are assessed by an AI model against the competencies the employer selected for the role. The assessment produces a score for each competency, a weighted overall score, and a short written summary.

This assessment is a recommendation, not a decision. A person at the hiring organization reviews it and makes the hiring decision. You may request a copy of your assessment, including the per-competency scores, their weights and the comments recorded against them, using the access right described below.

8. Your Rights Under PDPA

Under the Personal Data Protection Act 2010, you have the right to:

• Access your personal data held by us
• Correct any inaccurate personal data
• Withdraw consent for data processing
• Request deletion of your personal data
• Object to processing of your personal data

To exercise these rights, please contact us using the details below.

9. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law. Screening session data is retained for the duration specified by the employer, after which it may be anonymized or deleted.

• Candidate personal information: 2 years from last activity
• Screening session data: 1 year from completion
• Audit logs: 7 years

10. Children's Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal data from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Data Protection Officer (DPO)