1Introduction
Oodser Ltd ("Oodser", "we", "us", or "our") is incorporated under the laws of Rwanda and operates a global professional intelligence platform accessible at oodser.com. This Privacy Policy explains how we collect, use, store, transfer, and protect personal data when you use the Oodser platform, including all associated products, tools, APIs, and services (collectively, the "Platform").
This Policy applies to all users globally, including professionals, companies, recruiters, and any third party accessing the Platform. By using Oodser, you acknowledge that you have read and understood this Policy.
Where applicable, this Policy is designed to comply with the Rwanda Data Protection and Privacy Law No. 058/2021, the European Union General Data Protection Regulation (GDPR), the UK GDPR, India's Digital Personal Data Protection Act 2023 (DPDP Act), and other applicable data protection frameworks.
2Data Controller
The data controller responsible for your personal data is:
- Oodser Ltd
- Registered in Rwanda
- Contact: data@oodser.com
Where Oodser processes personal data on behalf of a company using the Platform (for example, candidate data processed through the Applicant Tracking System), that company acts as the data controller and Oodser acts as a data processor, governed by a separate Data Processing Agreement.
3Data We Collect
3.1 Data You Provide Directly
- Identity data: name, email address, phone number, profile photograph
- Professional data: work history, educational background, skills, certifications
- Application data: CV/resume uploads, cover letters, application responses
- Communications: messages sent through the Platform's encrypted messaging system
- Event data: event registrations, attendance, and participation records
- Review data: company encounter reviews and ratings you submit
- Account credentials: username, password (stored in hashed form)
3.2 Data Collected Automatically
- Behavioral data: interactions with the Platform including clicks, searches, applications submitted, pipeline movements, and session activity
- Device and technical data: IP address, browser type, operating system, device identifiers
- Usage data: pages visited, features used, time spent, navigation patterns
- Log data: server logs, error reports, API call records
3.3 Data from Third Parties
- OAuth authentication data when you connect via Oodser OAuth on third-party platforms
- Google account data when you sign in with Google or connect Google Calendar (see Section 11)
- Employer-verified work history data when an employer confirms your employment record
- Data from partner HR companies or staffing firms using Oodser's ATS on your behalf
4How We Use Your Data
4.1 Platform Operations (Contractual Necessity)
- Creating and maintaining your professional profile
- Facilitating job applications, hiring workflows, and ATS operations
- Enabling communications between professionals and companies
- Processing event registrations and attendance
- Providing collaborative hiring tools to employer accounts
4.2 Platform Improvement (Legitimate Interest)
- Improving AI-based job matching and content recommendations
- Analysing behavioral patterns to enhance platform functionality
- Detecting and preventing fraud, abuse, and security threats
- Conducting internal research and product development
4.3 Intelligence and Analytics (Legitimate Interest / Consent)
- Generating anonymised and aggregated workforce intelligence insights
- Contributing anonymised behavioral data to Oodser's professional intelligence graph
- Providing institutional-grade analytics to governments, development finance institutions, and enterprise buyers in anonymised, non-personally identifiable form
4.4 Legal Compliance
- Complying with applicable laws and regulatory obligations
- Responding to lawful requests from public authorities
- Enforcing our Terms of Service and protecting legal rights
5AI and Automated Processing
Oodser uses artificial intelligence and automated processing in the following ways:
- Job and candidate recommendations based on profile and behavioral data
- Content feed personalisation
- Candidate screening assistance within the ATS (employer-facing tool)
- Anomaly detection and fraud prevention
Where automated processing significantly affects you — for example, influencing a hiring decision — Oodser requires a human reviewer (the employer or recruiter) to make the final determination. You have the right to request human review of any automated decision that materially affects you. To exercise this right, contact us at data@oodser.com. See our AI Processing Disclosure for full details.
Oodser maintains audit logs of all AI-influenced decisions and can provide explanations of algorithmic outputs upon request.
6Data Storage and Security
Your data is stored on Amazon Web Services infrastructure located in EU North (Stockholm). Oodser implements the following security measures:
- Encryption at rest and in transit (TLS 1.2+)
- Access controls and role-based permissions
- Regular security audits and penetration testing
- Incident response procedures with mandatory breach notification
Despite these measures, no system is entirely secure. In the event of a data breach that poses a risk to your rights, we will notify you and relevant authorities as required by law.
7International Data Transfers
Oodser operates globally. Your data may be processed in countries outside your country of residence. When transferring personal data from the European Economic Area (EEA) or UK to non-adequate countries, Oodser relies on Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms as applicable.
Data transferred to and from Rwanda is governed by Rwanda's Data Protection Law. Data involving Indian users is handled in compliance with India's DPDP Act 2023.
8Data Retention
We retain personal data for as long as necessary to fulfil the purposes described in this Policy, subject to the following:
- Active account data: retained for the duration of your account plus 24 months
- Application and hiring data: retained for 36 months from the date of application
- Communications: retained for 24 months from the date of the conversation
- Anonymised behavioral data: retained indefinitely for intelligence purposes
- Legal hold data: retained as required by applicable law
You may request deletion of your personal data at any time, subject to legal retention obligations. See Section 10 for your rights and our Data Retention Policy for the full retention schedule.
9Data Sharing
Oodser does not sell your personal data. We share data only in the following circumstances:
- With employers and recruiters: when you apply for a role or engage with a company on the Platform
- With service providers: infrastructure, analytics, and security vendors operating under data processing agreements
- With partner HR firms: where they use Oodser's ATS on behalf of an employer with whom you have engaged
- With institutional buyers: only in aggregated, anonymised, non-personally identifiable form
- Legal compliance: where required by law, court order, or governmental authority
- Business transfers: in the event of a merger, acquisition, or asset sale, subject to standard confidentiality protections
Data received from Google APIs is subject to additional restrictions described in Section 11.
10Your Rights
Subject to applicable law, you have the following rights regarding your personal data:
- Right of access: obtain a copy of your personal data we hold
- Right to rectification: correct inaccurate or incomplete data
- Right to erasure: request deletion of your data, subject to legal retention requirements
- Right to restriction: limit how we process your data in certain circumstances
- Right to data portability: receive your data in a structured, machine-readable format
- Right to object: object to processing based on legitimate interest
- Right not to be subject to automated decisions: request human review of automated decisions that significantly affect you
- Right to withdraw consent: where processing is based on consent, withdraw it at any time
To exercise any of these rights, contact us at data@oodser.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority. Candidates can find more detail in our Candidate Rights Policy.
11Google User Data
Oodser (oodser.com), operated by Oodser Ltd, lets you sign in with your Google account and, if you are a recruiter or hiring team member, connect your Google Calendar to schedule interviews. This section explains exactly what Google user data the Oodser app accesses, how we use, store, share, and protect it, and how you can have it deleted.
11.1 Data We Access
- Google Sign-In (scopes: openid, email, profile): your name, email address, profile picture, and Google account identifier
- Google Calendar (scope: https://www.googleapis.com/auth/calendar.events), only if you choose to connect it: permission to create, update, and delete calendar events, including Google Meet links, for interviews you schedule on Oodser
11.2 How We Use It
- Sign-in data is used only to create your Oodser account, authenticate you, and display your name and photo on your profile
- Calendar access is used only to add interviews you schedule to your calendar, attach a Google Meet link, invite the candidate and interviewers, and keep that event in sync when the interview is rescheduled or cancelled
- We only work with events that Oodser created. We do not read, list, or analyse any other events on your calendar
- Google user data is never used for advertising, retargeting, or personalised ads, never sold, and never used to determine credit-worthiness or for lending purposes
11.3 Sharing and Disclosure
- Interview details (title, time, Google Meet link) are shared with the attendees you invite, as part of the calendar invitation you send
- Our hosting provider, Amazon Web Services (EU North, Stockholm), stores the data on our behalf under a data processing agreement and cannot use it for any other purpose
- We do not sell, rent, or transfer Google user data to data brokers, advertising platforms, or any other third party, except where required by law or as part of a merger or acquisition with prior notice to you
11.4 Storage and Protection
- Google OAuth access and refresh tokens are encrypted at rest and are never exposed to other users or to Oodser staff in plain text
- All data is encrypted in transit (TLS 1.2+); access to production systems is restricted by role-based permissions
- We store the identifier of each interview event we create so we can update or cancel it later
11.5 Retention and Deletion
- Sign-in data is kept while your account is active and deleted when you delete your Oodser account
- Calendar tokens are kept only while your calendar is connected. When you disconnect it from your Oodser settings, we revoke our access with Google and delete the tokens immediately
- You can also remove Oodser's access at any time from your Google Account permissions page
- To request deletion of any Google user data we hold, email data@oodser.com. We act on requests within 30 days
11.6 AI and Machine Learning
Google user data, including data obtained through Google Workspace APIs, is not used to develop, improve, or train generalised or non-personalised artificial intelligence or machine learning models, and is not transferred to any third-party AI provider.
11.7 Limited Use
13Children
Oodser is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, contact us at data@oodser.com and we will delete it promptly.
14Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email or a prominent notice on the Platform at least 30 days before changes take effect. Continued use of the Platform after changes constitutes acceptance of the updated Policy.
15Contact
For any questions, concerns, or requests relating to this Privacy Policy:
- Email: data@oodser.com
- Company: Oodser Ltd
- Jurisdiction: Rwanda
- Website: oodser.com
Related policies
These documents form part of your agreement with Oodser and explain how we handle your data.