Privacy policy

1.Who we are

Aluna operates from Bogotá, Colombia, and is the controller of the personal data recorded on the platform. When a client company uploads CVs of its own candidates, that company acts as controller and Aluna as processor, following its instructions.

2.What we collect

We separate two groups, because their origin and use differ.

• From platform users: name, email, hashed password, company, role within the team, and activity logs inside the product.
• From candidates: name, email, phone, city, CV and its contents, salary expectation, LinkedIn profile if provided, and the full transcript of the screening interview conducted over WhatsApp or email.
• Technical data: IP address, browser type, and timestamps, needed to operate the service and audit access.

3.What we use it for

• Analysing CVs and producing a fit score against the vacancy's requirements.
• Running the screening interview automatically and summarising its results.
• Ranking candidates and generating reports for the recruiting team and the end client.
• Operating accounts, billing, support, and platform security.
• Meeting legal obligations and responding to requests from competent authorities.

4.Legal basis

Processing candidate data rests on their prior, express, and informed authorisation, collected in the application form before any information is submitted. That authorisation is severable: a candidate may accept data processing and decline AI analysis, in which case the application proceeds without an automated score.

Processing platform account data rests on performance of the service contract.

5.The role of artificial intelligence

Aluna uses language models to read CVs, conduct interviews, and propose a score. That score is a recommendation, not a decision.

No application is rejected automatically by a model. The decision to advance or discard is always made by a member of the recruiting team, who can see the evidence behind every score. Any candidate may request human review of their evaluation by writing to us.

6.Who we share data with

We do not sell personal data or transfer it for advertising. We share it only with the providers needed to operate the service, under processing agreements:

• Anthropic — the language models that analyse CVs and conduct interviews.
• Meta Platforms — sending and receiving messages through the WhatsApp Business API.
• Resend — transactional email delivery.
• Cloudflare R2 — encrypted CV storage.
• Neon — managed database.
• Railway — application runtime infrastructure.
• Polar — payment and subscription processing.

7.International transfers

Several of these providers run servers outside Colombia, mainly in the United States. By authorising processing you accept that transfer. We require each provider to offer contractual security and confidentiality guarantees equivalent to our own.

8.How long we keep it

• Application data, including the CV and interview transcript: while the selection process is active and for twelve months after it closes, unless deletion is requested earlier.
• Platform account data: while the account is active and for twenty-four months after cancellation, for accounting and tax obligations.
• Access audit logs: twenty-four months.

9.Security

CVs are held in private storage and are never publicly addressable: every download passes a session check, generates a signed link that expires in five minutes, and is written to the audit log. Passwords are stored hashed. Access within each organisation is limited by role.

10.Your rights

As a data subject you may access, update, rectify, and delete your information, request proof of the authorisation given, be informed of how your data has been used, revoke that authorisation, and file complaints with the Colombian Superintendence of Industry and Commerce.

To exercise them, just write to us. See the contact section at the end of this page.

11.Changes

If we change this policy substantially we will announce it on the platform before it takes effect. The date of the last update appears at the top of this document.