EMPFLX Privacy Notice

1. About EMPFLX and contact

EMPFLX is operated by Mageo IT Ltd., General Yosif V. Gourko 62A Str., Sofia 1142, Bulgaria. Contact info@empflx.com about this notice, your information, or a privacy request.

EMPFLX supports candidate profiles, job discovery, recruiter collaboration, applications, interviews, document exchange and recruitment workflows. This notice describes the platform and its optional external AI connection. Mageo IT Ltd. is responsible as controller for EMPFLX account administration, support and service security. Stripe handles payment and billing processing. Recruiter organizations are responsible for their recruitment decisions and their recruitment-related candidate notices. Contact info@empflx.com if you need help identifying the responsible organization or directing a privacy request.

2. Information used by the service

Account information includes names, email addresses, contact and location details, account role and status, password credentials, preferences and records of Terms acceptance. Passwords are stored as hashes, rather than as readable passwords.

Candidates can provide professional experience, education, skills, career interests, employment preferences, availability, CVs, introduction videos and other supporting files. Applications can include a submitted profile, workflow status, interview proposals and responses, offer documents, cancellations and related communications.

Recruiter information includes recruiting groups and memberships, positions, shortlists, invitations, candidate assessments and recruitment actions. Stripe handles payment and billing processing. EMPFLX maintains subscription status, payment-provider identifiers and usage information. Support messages and administrative communications can contain information supplied by their authors.

Technical information is used for authentication, request handling, security and operating the service. AI connection records include the client identity, approved access, expiration, revocation and use timestamps. The platform stores hashes of opaque OAuth access tokens. It also stores account-level AI connection history.

Information can come from you, an authorized recruiter or colleague, recruitment activity in EMPFLX, payment services, and connected services used for a requested feature. Recruiters should tell candidates about information they introduce into EMPFLX and any disclosure to an external AI client.

3. Why information is used

Information is used to provide accounts and recruitment workflows; display profiles and jobs according to access rules; manage applications and collaboration; send relevant invitations and notifications; respond to support requests; manage subscriptions and usage; protect the service; and administer the service and applicable obligations.

For processing for which Mageo is responsible, we use account, service and subscription information to perform our agreement with you or take steps you request before entering it. We rely on legitimate interests in keeping EMPFLX secure, preventing abuse and repeated introductory trials, and responding to service enquiries, subject to the applicable balancing of individual interests and rights. We process information to meet applicable legal obligations where required. Where a feature requires consent, we explain the specific choice and how it can be withdrawn.

Terms acceptance and authorizing an AI connection do not amount to blanket consent to all processing of personal information. Recruiters must have an appropriate basis and provide required notices for their recruitment processing, including sharing candidate information with an external AI client.

4. Public jobs and authorized recruitment access

Public jobs can be browsed without an EMPFLX account. A recruiter must explicitly mark a position public. Public discovery includes only published positions that accept candidates and whose position and recruiting group are not archived. The public API exposes position information and a portal application link, not internal group identifiers, recruiter or candidate identities, applications, or stored-file paths. Anonymous application links lead to portal login and a separate explicit application action. An authenticated candidate can also instruct a connected AI client to submit an application using explicitly approved candidate write access. Browsing a job or approving a connection alone does not submit an application.

Candidate profile visibility, applications and recruiting information are governed by account roles, current group membership and the relevant visibility and workflow rules. Recruiters and collaborators receive access appropriate to their accounts; the public job listing does not provide that access.

5. AI features and external AI connections

Where enabled, EMPFLX AI features use Google Gemini through a billing-enabled API project to process relevant CV text, professional profiles, job requirements or application context for parsing or matching. Provider processing is subject to the applicable service configuration and provider arrangements.

Recruiters and candidates can separately connect a compatible AI client, such as ChatGPT, using OAuth. Public job tools require no login. Protected tools require an active recruiter or candidate account and role-specific approved scopes. Read access can disclose permitted account, candidate and application information to that chosen client. Write access can change permitted recruiting data, record assessments, send invitations or initiate workflow changes. Access never overrides the recruiter's existing permissions. Standard external AI recruiting access requires Pro, Business or Enterprise where subscription enforcement applies; account entitlements and deployment settings can affect availability. Candidate access covers the connected candidate's own profile/account, applications, interviews/offers and notifications. Candidate write access requires consent and can apply to jobs, edit owned records, respond to workflows, delete owned profile files and update notifications. Candidates do not require a recruiter subscription. File uploads and credential changes remain in EMPFLX.

Assessments supplied by the recruiter's AI client are saved with client/source/model labels separately from EMPFLX provider-generated matching scores. They are not verified provider results. Recruiters should review the professional information and output, limit information to what is necessary, and make their own employment decisions. EMPFLX does not make final hiring decisions.

EMPFLX's published Terms state that it does not use user CVs, profiles, applications or content to train general-purpose AI models or for unrelated advertising or commercial use, except under a separate lawful arrangement. This describes EMPFLX's own use; it is not a promise about an independently chosen AI client's retention, training or other practices. Review that client's privacy terms and settings before connecting it or sharing candidate information.

Connections can be reviewed and revoked in EMPFLX. Revocation stops future authorized access through that connection. It does not erase information already received by the external client or reverse completed actions. Password changes, account deletion, binary file transfer and payment completion continue in the portal rather than being completed in the chat.

6. Hosting and other recipients

EMPFLX uses Google Cloud hosting, Google Workspace for service email and Stripe for payment and billing processing. Enabled AI features use Google Gemini through a billing-enabled API project. Configured services can also include object storage. Recruiters, their authorized colleagues and selected external AI clients can receive information as described above. Information may also be disclosed where applicable obligations require it.

EMPFLX uses Cloudflare Turnstile to protect sign-in, registration, password recovery, account activation and signed-out contact forms from automated abuse. The verification widget connects directly to Cloudflare, which receives technical browser and network information to perform the check. EMPFLX sends the resulting verification token to Cloudflare for validation. See the Cloudflare Turnstile Privacy Addendum (https://www.cloudflare.com/turnstile-privacy-policy/).

EMPFLX serves international users. Hosting, provider processing, recipient access and customer arrangements can involve different countries. Do not assume that every copy is stored or processed only within the EU. Providers may process information internationally under their applicable standard data-processing terms, including standard contractual clauses where applicable. Contact info@empflx.com for information about applicable safeguards or to request a copy.

Applicable provider terms include Google Cloud terms (https://cloud.google.com/terms), Google Workspace terms (https://workspace.google.com/terms/premier_terms/), Gemini API terms (https://ai.google.dev/gemini-api/terms) and Google processor terms (https://business.safety.google/processorterms/), and Stripe's data-processing terms (https://stripe.com/legal/dpa). These describe the providers' respective services; they do not give an external AI client access beyond the account holder's approved EMPFLX permissions.

7. Account deletion and retained information

You can request account deletion through the authenticated portal. The flow verifies the current password and explicit confirmation. Personal account records and associated uploads are removed through the account-deletion process: personal database records are deleted when the transaction commits, and upload deletion is initiated immediately afterwards. Shared recruiting groups, positions and other users' information are retained. An account that is the sole owner of a group must resolve ownership or remove the group before it can be deleted.

Account and profile information is kept until account deletion, subject to the limited retained information described below. Recruitment records are kept while needed for recruitment purposes. Billing records are kept for the applicable legal requirements.

We review support records, notifications and security logs and delete them when they are no longer needed.

A minimal fingerprint of the normalized account email and its creation timestamp is retained to prevent repeated introductory trials. This is a limited eligibility record, not a retained copy of the deleted profile.

Residual copies can remain in rotating backups until those backups are replaced through their normal rotation. Deleting an EMPFLX account does not erase copies already obtained by recruiter organizations, email recipients, payment providers or external AI clients; their responsibilities and retention arrangements apply to those copies.

8. Cookies, security and your choices

EMPFLX uses browser cookies for sign-in and to bind an OAuth approval request to the initiating browser. It stores account preferences and cookie-choice information. Access controls, secure connections, password hashing and scoped, expiring OAuth credentials are part of the implementation. These measures are not a guarantee that incidents cannot occur.

You can update account and profile information, manage profile visibility and notification preferences, review or revoke AI connections, and use the account-deletion flow. Avoid unnecessary sensitive information, government identifiers and unrelated personal details in profiles, uploads or AI requests.

Depending on the laws applicable to you and the processing concerned, you may be able to request access, correction, erasure, restriction, portability or objection, and withdraw consent where processing relies on it. You may also have the right to complain to the competent data-protection authority. Contact info@empflx.com so the appropriate responsible party can assess your request; identity checks may be needed. These rights can have legal conditions and exceptions.

9. Changes

We publish the current version of this notice on the EMPFLX website with its effective date. We provide notice of material changes when required by applicable law.

Optional Google sign-in

Optional Google sign-in: if you choose this method, EMPFLX receives your Google account identifier, verified email address, and name to create or connect your account. We do not store Google access or refresh tokens or request access to Gmail, Drive, or other Google content. Email/password sign-in remains available. Existing accounts are connected only after you confirm your EMPFLX password.