This policy explains how JD Swipe handles personal data of people who visit the website, recruiters who use the app, and candidates who take a skills check. Candidates see a short notice before they start; it is repeated at the end of this page. This page is the full picture.
1. Controller and contact. KRUPIARSKY sp. z o.o., Lompy 49, 47-320 Gogolin, Poland, KRS 0001201989, NIP PL1990135158, privacy@jdswipe.com. We are established in the European Union (Poland).
2. Our role.
- For recruiters' accounts, billing and the website we are the controller – we decide what happens with the data.
- For candidate data we are the processor – we act on behalf of the company that invited the candidate, which is the controller. Candidates should direct requests about their check to that company; we help it respond (see Annex 1 to the Terms).
3. What we process, why and on what basis.
| Who | Data | Why | Legal basis | Kept for |
|---|---|---|---|---|
| Website visitor | Internet address, browser type, pages requested | Keeping the site secure and working | Legitimate interest (Art. 6(1)(f)) | 14 days |
| Website visitor | Pages viewed on the public site, approximate location, device and browser type, a random visitor id (Google Analytics 4) | Seeing which public pages are useful | Consent (Art. 6(1)(a)) – only after you click “Analytics only” or “Allow all” in the cookie bar | 2 months (events), 14 months (visitor id); you can withdraw any time via “Cookie settings” |
| Website visitor who clicked a Google ad | That the visit came from an ad (click id), and whether it later led to a confirmed sign-up or a purchase (order id and net amount) – no name or e-mail | Measuring which ads work, so we do not pay for ones that don't | Consent (Art. 6(1)(a)) – only after you click “Allow all” in the cookie bar | Up to 90 days (Google Ads click cookies); you can withdraw any time via “Cookie settings” |
| Recruiter | E-mail, name, password (stored as a hash), company name | Your account and login | Contract (Art. 6(1)(b)) | Account lifetime + 30 days after you close it |
| Recruiter | Time and internet address of login attempts | Stopping password guessing | Legitimate interest | 30 days |
| Recruiter | Job Descriptions, skill areas, generated cards, projects, team, balance and orders | Providing the service and billing | Contract | Account lifetime; accounting records 5 years after the end of the tax year, as Polish tax law requires |
| Recruiter | Company name, invoice address, VAT number, orders and payments received | Invoicing and VAT | Contract / legal obligation (tax law) | 5 years after the end of the tax year |
| Recruiter | Service e-mails (confirmations, balance warnings, invitations, receipts) | Running the service | Contract | n/a |
| Candidate | The label and e-mail the recruiter entered, the single-use link (stored hashed) | Delivering the check, telling the candidate when a paused check reopens | We are the processor; the recruiter's basis is usually legitimate interest or steps before a contract (Art. 6(1)(b)/(f)) | 90 days after the check |
| Candidate | Answers, response times, skips, whether the page was left, browser type | Scoring, signals, keeping the check fair | Processor for the recruiter | 90 days after the check |
| Candidate | Voice recordings (at most 3 × 20 seconds), transcript, the AI's review of each one | Seeing whether the candidate can explain an answer, noticing outside help | Processor; the recruiter switches the feature on and the candidate chooses to record or to skip – skipping is always possible and is shown to the recruiter as a fact, never as a wrong answer | 90 days after the check |
| Candidate | The report: how the answers compare with the Job Description per skill area, signals, suggested interview questions | Supporting the recruiter's decision | Processor | 90 days after the check |
4. Automated processing and AI. Cards, scores and the summary (meets / close to / below the Job Description) are produced automatically by software and AI models (Google Gemini). They describe how the answers compare with the recruiter's own Job Description; they do not assess the person. The report advises; it does not decide. Recruiters agree in our Terms not to base a hiring decision on it alone, so no decision with legal or similarly significant effect is taken by automated means (Art. 22). Voice recordings are reviewed for what is said and for anything unusual – we do not build voice profiles, do not identify people by voice, and do not try to read emotions, stress or personality from voice or behaviour. JD Swipe is an AI system used in recruitment; under the EU AI Act such systems count as high-risk, with the detailed obligations for providers and deployers applying from 2 December 2027 (and some already earlier). The service is built around human oversight: signals are observations for the recruiter, and nothing rejects a candidate automatically. What we send to the AI provider is the Job Description, the cards, the candidate's answer and the recording – never the candidate's name or e-mail. We use Google's paid Gemini service, under terms that forbid using our data to improve Google's products; Google keeps requests only briefly, to detect abuse and meet legal duties.
5. Who receives data. Hetzner Online GmbH (hosting, Finland); Google (AI processing, EU/US); a payment service provider, where you pay online (an independent controller for the payment itself; named on the payment page); our bank and accountant (invoices and payments, Poland); Brevo / Sendinblue SAS (transactional e-mail, France); Google Ireland Ltd (Google Analytics and Google Ads conversion measurement, only with your consent). We do not sell data, we do not build advertising profiles and we do not use ad personalisation or remarketing. Authorities receive data only where the law requires it.
6. International transfers. Data is stored in the EU (Finland) and we are established in the EU (Poland). Our staff may access the systems remotely from outside the EU (Montenegro) for support and operations; that access relies on the EU Standard Contractual Clauses. Transfers to Google rely on the EU–US Data Privacy Framework and the Clauses.
7. Cookies. Recruiters who log in get one strictly necessary cookie that keeps them signed in; it disappears after 12 hours or when they log out. People invited to view shared reports get a similar short-lived cookie for that view only. Candidates get no cookies at all and are never measured. On the public pages (home, pricing, legal pages, sign-in and sign-up) we ask what we may use. “Analytics only”: Google Analytics 4 sets its cookies (_ga, _ga_*, up to 14 months) and receives your page views, with IP anonymisation on. “Allow all”: in addition, Google Ads may set its measurement cookies (_gcl_au, _gcl_aw, up to 90 days) so we can see whether a visit from one of our ads later led to a sign-up or a purchase; ad personalisation and remarketing stay off. If you decline or do not answer, nothing is loaded. Inside the app, for people who said yes, only two moments are recorded: e-mail confirmed (sign-up) and payment received (order id and net amount) – never the content of your Job Descriptions, candidates or reports. Nothing is measured in the admin area or during a candidate’s check. Your choice is kept in your browser, not in a cookie, and “Cookie settings” in the footer lets you change it.
8. Your rights. Under the GDPR you may ask for access, correction, erasure, restriction and portability of your data, and object to processing based on legitimate interest. Write to privacy@jdswipe.com; we answer within one month. Candidates: we forward your request to the company that invited you, which decides on it, and we help it respond. You may complain to a supervisory authority – in Poland the President of the Personal Data Protection Office (UODO, uodo.gov.pl), or the authority of your own member state.
9. Security. We protect data with measures appropriate to the risk – encrypted connections, hashed links and passwords, answer keys that stay on the server, access to systems limited to named people, encrypted backups kept for 30 days, and more. The full list is in section 8 of Annex 1 to the Terms; a detailed description is available to customers on request.
10. Children. The service is not for anyone under 16; recruiters may not invite minors.
11. Changes. We post changes here with a new effective date and tell recruiters about material changes by e-mail or in the app. Version 1.3 – effective 19 October 2026 (controller changed from POLAKO d.o.o., Montenegro, to KRUPIARSKY sp. z o.o., Poland; payments by invoice instead of Paddle).
Candidate Privacy Notice
Who is checking you. The company that sent you the link invited you to this skills check as part of a recruitment – JD Swipe is for job applicants only, not for assessing people who already work for the company. They decide why your data is processed and are your contact for any questions or requests about it. If you were asked to take this check as a current employee, tell us via the “Something not working?” link on the check page; our terms do not allow that use. JD Swipe (KRUPIARSKY sp. z o.o., Gogolin, Poland) runs the check on their behalf.
What is recorded. Your answers (true / false / skip) and how long each one took; whether you left the page during a card; the type of browser you use; the label or e-mail you were invited with. If voice explanations are on, up to three recordings of at most 20 seconds each, made only when you press the microphone button – you can skip every one of them. Skipping is shown to the recruiter as a fact, not as a wrong answer.
What is not recorded. No camera, no screen, no keystrokes, no location. The microphone is off except during a recording you start yourself. Nothing is read from your device.
How it is used. Your answers are scored automatically against cards written for this specific job. Recordings are transcribed and reviewed by an AI model to see whether the explanation matches the answer and to flag anything unusual (for example a second voice or text being read aloud). The recruiter receives a report showing, for each skill area, how your answers compare with the level the job ad asks for, these signals and suggested interview questions. The report supports the recruiter's judgement; no hiring decision is made by the software alone. The recruiter may share the report with the people who decide on the hire.
Where and for how long. Data is stored in the EU (Finland) and processed with the help of Google's AI service and our hosting provider. Everything about your check, including recordings, is deleted automatically 90 days after you finish.
Your rights. You can ask the recruiter for a copy of your data, for a correction or deletion, and you can object to the processing. You can also write to privacy@jdswipe.com and we will pass your request on. You may complain to the data protection authority in your country.
By pressing Start you confirm that you have read this notice. (No separate consent is collected for the check itself; the recruiter's lawful basis applies. The microphone step uses your browser's own permission prompt and is optional.)