Privacy Policy

1. Introduction

Rekom ("we", "Rekom") is an artificial intelligence (AI) powered recruiting platform serving two groups of users: Company Users, meaning HR teams and recruiters who search for and shortlist candidates, and Candidate Users, meaning job seekers who create an account to search for jobs, build a CV, and track their applications. In operating this service, we process the personal data of both groups, as well as candidate profile data we obtain from third-party sources.

We are fully committed to protecting the privacy and security of the personal data you entrust to us. This Privacy Policy transparently explains what data we collect, why we collect it, how we use it, who we share it with, and what rights you have as a data subject.

This policy applies to all Rekom products and services, including the rekom.ai website, the company platform at app.rekom.ai, the candidate platform at talent.rekom.ai, and Rekom's other official channels.

If you are a Company User who connects a Google account to send outreach emails from Rekom, section 14 explains exactly what we access through Google APIs, why, and how you can revoke that access. Rekom's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

2. Data Controller Identity

In accordance with the PDP Law, the party responsible as the Personal Data Controller for this service is:

For any question or request relating to data privacy, you can reach us by email at admin@rekom.ai.

3. Data We Collect

We collect four main groups of data in operating the Rekom service:

3.1 Company User Data (HR Teams & Recruiters)

Data collected from individuals and companies that register for and use the Rekom company platform:

3.2 Candidate User Data (Job Seekers)

Data you voluntarily provide when you register for and use the Rekom candidate platform at talent.rekom.ai. Unlike the data in section 3.3, this group comes directly from you and is processed on the basis of your consent:

3.3 Candidate Profile Data from Third-Party Sources

Rekom aggregates candidate profile data from publicly available sources and from data partners that hold a valid legal basis to share such data. This data is used to enable candidate search by Company Users.

3.4 Recipients of Outreach Emails

Company Users can send recruiting emails to candidates through Rekom's Email Outreach feature. The Company User decides whom to contact and what to write, and the email is sent from the Company User's own mailbox. If you receive such an email, we process:

• Your name and email address, and the messages exchanged in that conversation, including your replies
• Whether the email was opened, recorded through a small image in the email, and which links in it were clicked, recorded through a redirect link, together with the time, IP address, and browser or email client information of that request
• Delivery failures (bounces) and unsubscribe requests

This data is used only to show the Company User the status of their outreach and to stop follow-up emails automatically once you reply, the email bounces, or you unsubscribe. Every outreach email contains an unsubscribe link. Once you use it, your address is placed on a suppression list and that Company User can no longer send you outreach emails through Rekom. You can also block open tracking by turning off automatic image loading in your email client.

4. How We Collect Data

We collect data through four main mechanisms:

4.1 Directly from You

When you register an account, complete your company profile, subscribe, contact our team, or actively use Rekom's platform features. For Candidate Users, this includes the data you fill in on your profile, the data you import from third-party accounts you connect, and the CVs you build on the platform.

4.2 Automatically

When you use the platform, our systems automatically record technical and usage data through cookies, server logs, and similar technologies. This data is used to keep the service running properly and to improve the user experience.

4.3 From Third-Party Sources

Candidate profile data is obtained from:

• Professional networking platforms and publicly available online sources
• Data partners that hold valid consent or another lawful basis from the candidates concerned
• Other sources permitted by applicable laws and regulations

4.4 From Your Connected Email Account

If you choose to connect a Gmail account, we receive data through Google APIs, limited to what is needed to send your outreach emails and to detect replies and bounces to them. Section 14 describes this in full.

5. Purposes & Legal Bases for Processing

Under Article 20 of the PDP Law, every processing of personal data must rest on a valid legal basis. Our processing purposes and their legal bases are:

6. Sharing Data with Third Parties

Rekom does not sell your personal data to any third party for commercial purposes. We only share data in the following circumstances:

6.1 Candidate Profiles Shown to Company Users

Rekom's core function is to connect companies with candidates. Accordingly, the candidate profiles described in sections 3.2 and 3.3 can be found, viewed, and saved to a shortlist by Company Users subscribed to our platform.

If you registered as a Candidate User, the limits are as follows:

• What Company Users can see is the professional profile you completed — the data you intended prospective employers to see.
• What is not shared: your job search conversation history, the jobs you saved, the application statuses you recorded, and your password.
• Company Users are bound by Terms of Service requiring them to use candidate data solely for legitimate recruiting purposes.

6.2 Service Providers Supporting Our Operations

We work with trusted service providers that support platform operations, including:

• Cloud infrastructure and hosting — to store and run the platform
• Payment providers — to process transactions securely
• Analytics services — to understand platform usage (data aggregated/anonymised)
• Email and communication services — to deliver notifications and updates
• Google (Gmail API): to send outreach emails from, and read replies to them in, the mailbox a Company User connects
• AI model providers: to power AI features such as candidate search, match scoring, and drafting suggested replies. Section 14.5 explains the stricter rules that apply when the input comes from a connected Gmail account
• Customer support tools — to help us respond to User requests

All of these service providers are bound by confidentiality agreements and may only process data on Rekom's instructions.

6.3 Legal Obligations

We may disclose personal data where required by law, a court order, or a formal request from a competent government authority in accordance with applicable regulations.

6.4 Protecting Rights and Safety

Where necessary to protect the rights, safety, or legitimate interests of Rekom, our Users, or the public — including preventing fraud, security breaches, or illegal acts.

6.5 Corporate Transactions

In the event of a merger, acquisition, reorganisation, or asset sale, data may be transferred to a successor entity. We will give notice before your data becomes subject to a different privacy policy.

7. Cross-Border Data Transfers

As a platform operating in Southeast Asia, some of the data we process may be stored on or accessed from infrastructure located outside Indonesia, including but not limited to countries in the Asia-Pacific region.

In accordance with Article 56 of the PDP Law, every transfer of personal data abroad is carried out by ensuring that:

• The destination country provides a level of personal data protection equal to or higher than that required by the PDP Law, or
• Adequate safeguards or agreements are in place with the data recipient in the destination country, or
• Valid consent has been obtained from the data subject after adequate information about the transfer has been provided.

Rekom ensures that each of our international infrastructure partners meets strict security and data protection standards, including security certifications such as ISO/IEC 27001 or equivalent.

8. Data Retention & Deletion

We retain personal data only for as long as necessary for the purposes described in this policy, or for as long as required by applicable law:

Once the retention period ends, data is permanently deleted or anonymised so it can no longer be attributed to a specific individual.

9. Data Security

Rekom applies reasonable technical and organisational measures to protect personal data from unauthorised access, disclosure, alteration, or destruction, including:

• Encryption in transit using TLS/HTTPS for all communication between users and our servers
• Encryption at rest for sensitive data in our databases
• Role-based access control limiting data access to employees who need it
• Multi-factor authentication for internal access to systems holding personal data
• Regular security audits and monitoring to detect potential vulnerabilities
• Standardised incident response procedures for handling potential data breaches

10. Your Rights as a Data Subject

Under Law No. 27 of 2022 on Personal Data Protection, you hold the following rights over the personal data we process:

For Candidate Users: Withdrawing Your Profile from Search

If you no longer want to be discoverable by companies but still want to use job search, the CV builder, and the application tracker, you do not need to delete your account. Email admin@rekom.ai with the subject "Withdraw Profile from Search" along with your account email address, and we will remove your profile from candidate search results.

You can re-enable it at any time through the same email address. We process this request within the same timeframe as the other data subject rights requests below.

How to Submit a Request

To exercise your rights, email admin@rekom.ai with the subject "Data Subject Rights Request" and include:

• Your full name and the email address registered to your Rekom account
• The type of request you are making (access, rectification, erasure, and so on)
• Any additional information relevant to your request

We will respond to your request within 14 (fourteen) business days of receiving it.

11. Data Deletion Requests

If you do not want your personal data held by Rekom, you have the right to request its deletion. This section explains who can submit a deletion request, how to do it, how long it takes, and what happens once we have processed it.

11.1 Who Can Submit a Request

• Company Users — for your account and company data.
• Candidate Users — for your account, professional profile, CVs, job search history, and all other data you created on the platform.
• Individuals without a Rekom account — if your profile came from a third-party source as described in section 3.3, you still have the right to request deletion even though you never registered with Rekom.

11.2 How to Submit a Request

Email admin@rekom.ai with the subject "Data Deletion Request" and include the following:

• Your full name as it appears on the data you want deleted
• The email address of your Rekom account — or, if you do not have an account, a link to or screenshot of your profile page on Rekom so we can locate the data in question
• One identity document for verification (you may redact part of the identity number). We use this document solely to confirm the request comes from you, and we delete it once the request has been processed
• The scope of your request: deletion of all data, or only specific parts of it

We verify identity to protect you — without this step, someone else could misuse the deletion process to remove your data without your knowledge.

11.3 Processing Timeline

11.4 What Happens After Deletion

• Your profile is removed from the search index, so Company Users can no longer find, view, or save it.
• Your account and everything in it — profile, CVs, saved jobs, and application history — is permanently deleted and cannot be restored.
• We keep one minimal record: a hashed marker of your identity on an internal suppression list. It exists solely to ensure your data does not re-enter our systems if it reappears at a third-party source, and it is not used for any other purpose.

11.5 Limitations You Should Know About

Under the PDP Law, there are situations where we cannot delete all data immediately:

• Legal obligations — transaction and payment data must be retained for at least 5 years for tax and accounting purposes. This data is segregated and not used for any other purpose.
• Dispute resolution — data needed for ongoing legal proceedings is retained until the dispute is finally resolved.
• Copies held by Company Users — data a Company User downloaded or saved into their own systems before we processed your request is outside Rekom's control, because that company acts as a separate data controller. At your request, we can forward your deletion request to the Company Users on record as having saved your profile.
• Anonymised data — aggregate data that can no longer be linked to you personally falls outside the scope of deletion.

11.6 Alternatives to Deletion

If what you actually want is to stop being discoverable by companies — rather than to delete your account — you can choose to withdraw your profile from search results as described in section 10. You can also use your right to rectification if your data simply needs correcting, or your right to object if you want to limit only certain processing purposes.

12. Cookies & Tracking Technologies

Rekom uses cookies and similar technologies to keep the platform working properly and to improve your experience. The types of cookies we use are:

You can manage your cookie preferences through your browser settings. Note that disabling certain cookies may affect platform functionality.

Tracking in outreach emails: emails sent through Email Outreach contain a small image that records when the email is opened, and links that pass through Rekom to record clicks. These do not set cookies. Automated opens, such as image prefetching by email providers, are flagged and not counted as real opens. Section 3.4 explains what is recorded and how recipients can opt out.

13. Protection of Children's Data

Rekom's services are designed and intended solely for individuals aged 18 (eighteen) and over in a professional context. We do not knowingly collect personal data from individuals under the age of 18.

If you become aware that someone under the age of 18 has submitted personal data to us without valid consent, please contact us immediately at admin@rekom.ai and we will promptly take the steps needed to delete that data.

14. Google User Data and Connected Email Accounts

Company Users can connect a Google account so that Rekom can send recruiting outreach emails from their own Gmail address and recognise when candidates reply. Connecting a mailbox is optional and is only needed for the Email Outreach feature. This section describes what Rekom does with data received through Google APIs ("Google user data"). Where it is more specific than the rest of this policy, this section prevails.

14.1 Permissions We Request and Why

Rekom does not request permission to delete your email, change your labels or settings, or access your Google Contacts, Calendar, or Drive.

14.2 What We Access and What We Store

• Rekom periodically checks for new messages in the connected mailbox and compares each one against the conversations started from Rekom, using Gmail thread identifiers and email headers. Messages that do not belong to an outreach conversation are not stored; they are processed automatically, in memory only, to make that comparison.
• For messages that do belong to an outreach conversation, we store the sender, recipients, subject, body, date, and thread identifiers, so the conversation can be shown in Rekom and the sequence can stop.
• For bounce notices about an outreach email, we store the fact that the email bounced and the affected address, so Rekom stops sending to it.
• We also store the connected email address, the OAuth access and refresh tokens (encrypted with AES-256-GCM), and a synchronisation marker that tells us which messages we have already checked.

14.3 How We Use Google User Data

We use Google user data only to provide and improve the Email Outreach features you can see and use in Rekom:

• Sending the emails you write or schedule
• Detecting replies and bounces and stopping follow-up emails automatically
• Showing outreach conversations and their status in your Rekom inbox and campaign dashboard
• Drafting a suggested reply with AI, only when you ask for it (section 14.5)
• Keeping the integration secure and fixing problems with it, such as detecting a mailbox that can no longer be reached

14.4 Limited Use

In particular:

• We use Google user data only to provide or improve the user-facing features described in section 14.3.
• We do not transfer Google user data to others, except as necessary to provide or improve those features, to comply with applicable law, for security purposes, or as part of a merger, acquisition, or sale of assets after obtaining your explicit prior consent.
• We do not use Google user data for advertising, including retargeting, personalised, or interest-based advertising.
• We do not sell Google user data, and we do not use it to determine creditworthiness or for lending purposes.
• Rekom staff do not read Google user data, unless you give us your explicit agreement for specific messages (for example, when you ask our support team to look into a problem), it is necessary for security purposes such as investigating abuse, it is necessary to comply with applicable law, or the data has been aggregated and anonymised for internal operations.
• We do not use Google user data to develop, improve, or train generalised or non-personalised artificial intelligence or machine learning models.

14.5 AI Features and Google User Data

When you click Draft with AI on an outreach conversation, the messages in that conversation are sent to our AI model provider, OpenAI, solely to generate a suggested reply that is shown only to you. This happens only when you request it. The suggestion is never sent automatically; you can edit or discard it before sending. OpenAI processes this data through its API under terms that do not permit it to use API data to train its models, and Rekom does not use it to train any model either.

14.6 Sharing and Security

Google user data is shared only with the service providers needed to run the features above (our cloud hosting provider, and OpenAI when you request an AI draft), who are bound by confidentiality obligations. It is never sold, and inside Rekom it is visible only within the account that connected the mailbox. Google user data is encrypted in transit with TLS, OAuth tokens are encrypted at rest, and access inside Rekom is restricted to the systems that need it.

14.7 Revoking Access and Deleting Your Data

• Revoke from Google at any time: go to myaccount.google.com/permissions and remove Rekom. Rekom loses access to your mailbox immediately, and no further emails are sent or read.
• Disconnect in Rekom: in Settings, under Email, disconnect the mailbox to delete its stored credentials. If the mailbox is still used by an outreach campaign, Rekom will ask you to remove those campaigns first, or you can contact us.
• Delete stored messages: email admin@rekom.ai to have the Google user data we hold about your mailbox deleted, following the timeline in section 11. Deleting your Rekom account also deletes this data.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, changes to the service, or new legal obligations. We will mark any change by updating the "Last updated" date at the top of this document.

For material changes that could significantly affect your rights, we will give advance notice through:

• An email to the address registered to your account, and/or
• A prominent notice displayed inside the platform

Your continued use of Rekom's services after a policy change takes effect will be treated as your acceptance of the updated policy.

16. How to Contact Us

If you have questions, concerns, or requests about this Privacy Policy or how we handle your personal data, please contact us at: