Last updated: October 2026
1. Data Controller
Workruno — Owner: Chousein Chiout
Registered under § 14 GewO (German Trade Regulation Act)
Waldstr. 124E · 65451 Kelsterbach · Germany
Email: support@workruno.com
Privacy: support@workruno.com
2. Personal Data We Collect
Account data
Name, email, company name, website, phone (from registration / settings).
Legal basis: Contract — Art. 6(1)(b) GDPR
Candidate data
CVs, contact details, notes, stage history, interview records you upload for recruitment. This data may also be processed by AI tools for analysis and matching — see Section 4.
Legal basis: Legitimate interest / contract — Art. 6(1)(b)(f) GDPR
Billing data
Subscription status, invoice history. Card details processed by Stripe only — Workruno never stores card numbers.
Legal basis: Contract — Art. 6(1)(b) GDPR
Usage data
Pages visited, features used, session duration. Google Analytics is used only if you accept marketing cookies.
Legal basis: Legitimate interest / consent — Art. 6(1)(f)(a) GDPR
Technical data
IP address, browser type, device info, session cookies.
Legal basis: Necessary for service delivery
3. Cookies
| Cookie | Purpose | Category | Duration |
|---|---|---|---|
| sb-* | Auth session (Supabase) | Necessary | Session / 1 week |
| locale | Language preference | Functional | 1 year |
| cookie-consent | Stores consent preference | Necessary | 1 year |
| _fbp / _fbc | Meta Pixel — ad performance measurement | Marketing | 90 days |
| _ga / _ga_* | Google Analytics — anonymized usage statistics | Marketing | 2 years |
Marketing cookies (Meta Pixel, Google Analytics) are only loaded if you click "Accept All" in the cookie banner.
4. Data Sharing & Third Parties
Workruno uses AI models to summarize applications, match candidates, and generate interview suggestions. In this process, candidate name, email, phone number, CV text, cover letter, and job information may be sent to US-based AI model providers. These providers process data only on our instructions; appropriate safeguards apply to transfers outside the EU (see Section 5). Providers may retain logs for a limited time (usually up to 30 days) for abuse and error review. AI output is only a suggestion — there is no automated decision, you always make the hiring decision, and the AI does not evaluate based on age, nationality, or location. We do not sell your data. Processors under contractual DPAs (current list available on request at support@workruno.com):
5. International Data Transfers
6. Data Retention
Account data: Database records are deleted immediately and permanently when you delete your account — no waiting period. All files belonging to your candidates (CV, cover letter, photo) and your company logo are deleted as well.
Candidate data: First moved to Trash (recoverable). You can permanently delete it anytime — records left untouched in Trash for 30 days are automatically and permanently deleted.
Candidate files (CV, cover letter, photo): Also deleted from storage when a candidate is permanently deleted (manually, or automatically after 30 days)
Internal backups: Internal backups of database records are retained for 14 days; data you delete may remain in backups until that period ends.
Invoices: 10 years (German commercial law: § 257 HGB, § 147 AO)
Unverified accounts: Automatically deleted after 30 days — accounts with an active subscription are excluded and reviewed manually
AI results stored in your browser: Some results (e.g. matching results) are stored only in your browser (localStorage), not on our servers
Session cookies: Deleted on logout or after inactivity
7. Your Rights
EU / EEA — GDPR (Art. 15–22)
Supervisory authority: HBDI (Hesse)
UK — UK GDPR (Data Protection Act 2018)
Supervisory authority: ICO (UK)
Turkey — KVKK (Law No. 6698)
Authority: Kişisel Verileri Koruma Kurumu (KVKK)
To exercise any rights: support@workruno.com — we respond within 30 days.
8. Security
Encrypted transmission (TLS) and encrypted storage at our infrastructure provider, database-level separation between companies' data, access control, optional two-factor authentication (2FA). Personal data breach notification within 72 hours (GDPR Art. 33–34). See Security page.
9. Changes
Material changes communicated by email and in-app notice at least 30 days before taking effect.
10. Contact
Privacy & legal: support@workruno.com
Security: Report a vulnerability