Privacy Policy

How Urjob collects, uses, shares and protects personal data — including the AI processing involved in recruitment.

Version 1.0 · Last updated 2026-07-28

This policy explains how ScaleX Innovation SARL ("Urjob", "we", "us") handles personal data on the Urjob recruitment platform.

It is written to meet the transparency requirements of the EU General Data Protection Regulation (GDPR) and equivalent laws. Please read section 2 first: it explains who is responsible for which data, which determines who you should contact about your rights.

1. Who we are

ScaleX Innovation SARL, a company registered in Tunisia under RNE 1834205F, with its registered office at Route de Mahdia km 0.5, Immeuble Al Janah Al Dhahabi, 3000 Sfax Médina, Tunisia.

For any privacy question or to exercise your rights, contact privacy@scalexi.ai.

2. Our two roles: controller and processor

The Platform is used by employers and recruitment agencies ("Customers") to manage their hiring. That creates two distinct relationships:

We are the data controller for the data of our Customers and their Authorised Users — account details, billing information, support correspondence and how the Platform is used. This policy governs that processing.
We are a data processor for candidate data that a Customer uploads or collects through the Platform — CVs, profiles, applications, interview material. The Customer is the controller and decides why and how that data is used. We act on their documented instructions.

3. If you are a candidate

If your CV or application is on the Platform, the employer or agency you applied to is responsible for that data. Please direct requests to access, correct or delete it to them in the first instance — they decide what happens to it.

If you contact us directly, we will help where we can and will forward your request to the relevant Customer. We cannot delete a Customer's data on your behalf without their instruction, except where the law requires us to act. You can reach us at privacy@scalexi.ai.

4. What data we process

Account data: name, work email, phone number, job title, profile photo, company, language and interface preferences.
Authentication data: password (stored only as a bcrypt hash — never in plain text), session and refresh tokens, sign-in timestamps and IP address, and OAuth identifiers if you sign in with Google, Microsoft or LinkedIn.
Customer content: job descriptions and uploaded documents, candidate CVs and profiles, applications, notes, tags, pipeline status and messages.
Interview data: scheduling details, written assessment answers, and — where AI-assisted interviews are used — audio and transcripts of the interview.
AI-derived data: information extracted from documents, generated summaries and questions, and matching scores.
Usage and technical data: pages viewed, actions taken, device and browser information, and server logs kept for security and troubleshooting.
Billing data: plan, subscription status, invoices and credit consumption. Card details are handled by our payment provider, not stored by us.

5. Why we process it, and on what legal basis

To provide the Platform and perform our contract with you — legal basis: performance of a contract.
To authenticate you and keep accounts secure — performance of a contract and our legitimate interest in security.
To provide AI-assisted features you choose to use — performance of a contract; for candidate data, on the Customer's instructions.
To send service messages such as verification, password reset and important notices — performance of a contract.
To bill you and keep accounting records — performance of a contract and legal obligation.
To monitor, debug and improve the Platform, and to prevent abuse and fraud — our legitimate interest in operating a reliable, secure service.
To send marketing about our products — consent, which you may withdraw at any time.
To comply with legal obligations and to establish or defend legal claims — legal obligation and legitimate interest.

6. AI processing — what happens to your content

We use third-party AI providers to deliver certain features. This means content you submit may be transmitted to those providers for processing. Specifically:

Documents you upload (job descriptions, CVs) are sent to AI providers to extract structured information such as job title, responsibilities, skills and experience.
Job and candidate information is used to generate summaries, interview questions and matching scores.
In AI-assisted interviews, the interview audio is transmitted to the AI provider in real time to conduct the conversation, and a transcript is produced.
Our AI providers process this content to deliver the feature to us. We contract for it not to be used to train their general-purpose models.
AI outputs are decision support. They do not by themselves make decisions about anyone, and Customers are contractually required to apply human review (see section 12).

8. International transfers

We are established in Tunisia, and some of our providers are in the United States. Personal data originating in the European Economic Area may therefore be transferred outside it.

Where that happens, we rely on appropriate safeguards — principally the European Commission's Standard Contractual Clauses, together with technical and organisational measures such as encryption in transit. You may request a copy of the relevant safeguards using the contact address below.

9. How long we keep data

Account data: for the life of the account, then up to 12 months after closure, unless a longer period is required by law.
Customer content, including candidate data: for as long as the Customer maintains it on the Platform. The Customer controls this and may delete it. On termination, we delete or anonymise it within 90 days unless the Customer requests an earlier deletion or the law requires retention.
Interview recordings and transcripts: retained per the Customer's configuration; deleted with the associated record.
Security and server logs: typically up to 12 months.
Billing and accounting records: for the period required by tax and commercial law, generally 10 years.

10. How we protect data

Encryption in transit using TLS 1.2 or 1.3, with HSTS enforced.
Passwords stored only as bcrypt hashes; session cookies set HttpOnly, Secure and SameSite so they cannot be read by scripts in your browser.
Refresh tokens are rotated on use, with automatic revocation of the whole token family if a used token is replayed — which limits the impact of a stolen token.
Role-based access control, so Authorised Users only see what their role permits, and strict separation between Customers' data.
Databases and internal services are not exposed to the public internet; only the web tier is reachable.
No security measure is perfect. If a breach affects your personal data and is likely to present a risk to you, we will notify the competent supervisory authority and, where required, you — without undue delay.

11. Your rights

Subject to applicable law, you have the right to access your personal data, to have it corrected, to have it erased, to restrict or object to processing, to receive it in a portable format, and to withdraw consent where processing is based on consent.

To exercise these rights, contact privacy@scalexi.ai. We will respond within one month, and will tell you if we need longer. We may need to verify your identity first.

If your data is held by a Customer as controller, we will pass your request to them (see section 3).

You also have the right to lodge a complaint with your local data protection supervisory authority. In Tunisia, this is the Instance Nationale de Protection des Données Personnelles (INPDP).

12. Automated decision-making

We do not make decisions producing legal or similarly significant effects about you based solely on automated processing.

The Platform produces AI-generated rankings, scores and summaries to help recruiters review applications. These are decision support: our Terms require Customers to apply meaningful human review before any recruitment decision. If you believe a decision about you was made by automated means alone, contact the employer or agency concerned, and you may also contact us.

13. Cookies

We use a small number of strictly necessary cookies. These keep you signed in (an HttpOnly session cookie and a refresh-token cookie), maintain your selected workspace, and protect against cross-site request forgery. Because they are essential to deliver a service you have requested, they do not require consent.

We do not use advertising cookies or third-party tracking cookies. If we introduce non-essential analytics in future, we will ask for your consent first and update this policy.

14. Children

The Platform is intended for professional use and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child's data has been provided to us, contact us and we will delete it.

15. Changes to this policy

We may update this policy. The version and effective date are shown at the top of this page. Where a change materially affects how we use personal data, we will notify you by email or in the Platform before it takes effect.

16. Contact

Privacy questions and rights requests: privacy@scalexi.ai.

ScaleX Innovation SARL, Route de Mahdia km 0.5, Immeuble Al Janah Al Dhahabi, 3000 Sfax Médina, Tunisia.