Legal

Privacy Policy

Last updated: June 21, 2026

Dunross AI s.r.o. ("Dunross AI," "we," "us") operates the Klara AI pre-screening platform at app.dunross.ai (the "Service"). This Privacy Policy explains what personal data we collect, how we use it, and your rights under the EU General Data Protection Regulation (GDPR) and other applicable data protection laws.

1. Who we are

Dunross AI s.r.o.
Pod Chytárnou 46
Zaječice - Pyšely, 251 67
Czech Republic

Contact: [email protected]

For questions about your data or to exercise your rights, contact us at [email protected].

Depending on context, we act as either a data controller or a data processor. When we collect data directly from recruiters (account information, billing data) or website visitors, we act as the data controller. When recruiters use the Service to screen candidates, the recruiter is the data controller of the candidate's data and we act as the data processor on their behalf.

2. Who this policy covers

This policy applies to two groups:

  • Recruiters and HR professionals ("Users") who sign up to use Klara to pre-screen candidates for their hiring processes.
  • Job candidates ("Candidates") who are invited to complete a Klara voice interview by a recruiter using our Service.

3. What data we collect

From recruiters (Users):

  • Account information: name, email address, organization name, password (hashed)
  • Job configuration data: job descriptions, screening criteria, interview questions
  • Optional integrations: if you connect a calendar (Google Calendar or Microsoft Outlook), we receive access tokens to read your availability and create interview events on your behalf
  • Optional integrations: if you connect an email sender identity, we receive the permissions necessary to send emails on your behalf
  • Usage data: how you interact with the Service, features used, IP address, browser type, device information

From candidates:

  • Identity data provided by the recruiter when invited: name, email address, phone number (optional), preferred language (optional)
  • Voice recording of the interview conversation
  • Transcript of the interview (text version of the voice conversation)
  • Responses to screening questions
  • Pass/fail status against the recruiter's eligibility criteria
  • Technical data: IP address, browser type, device information

4. How we use this data

We process personal data for the following purposes:

Recruiter data:

  • To provide and operate the Service (contractual necessity)
  • To send service-related communications (contractual necessity)
  • To improve and develop the Service (legitimate interest)
  • To comply with legal obligations

Candidate data:

  • To conduct the AI-powered pre-screening interview (legitimate interest of the recruiter, with notice provided to the candidate before the interview begins)
  • To evaluate candidate responses against the recruiter's stated criteria
  • To deliver screening results to the recruiter who invited the candidate
  • To facilitate next-step scheduling (e.g., booking an interview) if the candidate passes screening
  • To improve and develop the Service in aggregated, anonymized form

We do NOT:

  • Sell candidate or recruiter data to third parties
  • Use candidate voice recordings or transcripts to train AI models without explicit consent
  • Make hiring decisions on behalf of the recruiter — Klara provides objective screening data only; humans make all hiring decisions

5. Legal basis for processing (GDPR Article 6)

  • Contractual necessity: for processing required to provide the Service to recruiters who have signed up.
  • Legitimate interest: for candidate pre-screening (the recruiter's interest in efficient, fair screening), balanced against candidate rights. Candidates receive clear notice before the interview begins and may decline.
  • Consent: for any optional features that require explicit candidate consent.
  • Legal obligation: for compliance with tax, accounting, and other legal requirements.

6. The EU AI Act and automated decision-making

Klara is designed to support, not replace, human hiring decisions. Klara screens candidates against objective eligibility criteria (e.g., language fluency, required certifications, availability for shift work) defined by the recruiter. The output of Klara is a structured report; the recruiter makes all hiring decisions.

Klara does not assess subjective qualities such as personality, character, or cultural fit. Candidates are informed before the interview begins that they are speaking with an AI and that their responses will be analyzed.

Under the EU AI Act, Klara operates as a transparency-compliant tool: candidates are notified of AI interaction, the system's purpose is disclosed, and human oversight is maintained for all hiring outcomes.

7. Calendar integration (Google and Microsoft)

If a recruiter chooses to connect a calendar to enable candidate self-scheduling, we request the following minimum scopes:

Google Calendar:

  • https://www.googleapis.com/auth/calendar.events: to create interview events on the recruiter's calendar when a candidate books a slot.
  • https://www.googleapis.com/auth/calendar.freebusy: to check the recruiter's free/busy availability so candidates only see truly available time slots.

We do NOT read the content, attendees, or details of any existing calendar events beyond their busy/free status. We only create events that the recruiter or candidate has explicitly initiated through Klara.

Microsoft Outlook (via Microsoft Graph):

  • Calendars.ReadWrite: to read availability and create interview events.

To identify the connected account and show its email and name in your settings, Klara also requests the standard OpenID Connect sign-in scopes (openid, email, profile). For Microsoft, Klara additionally requests offline_access, which is required to refresh access without asking you to sign in again. These scopes do not grant access to message, file, or contact content.

We follow Google's API Services User Data Policy, including the Limited Use requirements, and we follow Microsoft's API Terms of Use.

8. Data sharing and third parties

We share data only with the following categories of recipients:

  • Service providers who help us operate the Service under contract, including: cloud hosting and infrastructure providers, database providers, AI inference providers (for natural language processing of interview conversations), voice processing providers (for speech-to-text and text-to-speech), email delivery providers, and content delivery network (CDN) providers. All service providers are contractually bound to process data only on our instructions and to GDPR-compliant standards. A current list of our specific sub-processors is available to customers on request.
  • The recruiter who invited the candidate: candidate data (including responses and screening outcome) is shared with the recruiter to enable hiring decisions.
  • Legal authorities if required by law.

We do not transfer personal data outside the EU/EEA except to service providers who guarantee equivalent protection through Standard Contractual Clauses (SCCs) or other approved mechanisms.

8.5 Business transactions

If Dunross AI s.r.o. is involved in a merger, acquisition, sale of assets, or other corporate restructuring, personal data may be transferred to the acquiring or successor entity as part of that transaction. We will notify affected users and ensure that the acquiring entity is bound to process personal data in accordance with this Privacy Policy or a substantially equivalent policy.

9. Data retention

  • Candidate data (including screening responses and outcomes): retained for 24 months from the screening date unless the recruiter requests longer retention for an active hiring process or shorter retention upon candidate request, subject to legal exceptions.
  • Voice recordings of interviews: retained for 12 months from the screening date, then automatically deleted.
  • Recruiter account data: retained for the duration of the account, plus 3 years after account closure for legal and tax compliance requirements.
  • Aggregated, anonymized data: may be retained indefinitely for Service improvement, as it no longer constitutes personal data.

Recruiters may delete individual candidate records at any time. Candidates may request deletion of their own data directly with us at any time.

10. Your rights under GDPR

You have the right to:

  • Access your personal data
  • Correct inaccurate data
  • Delete your data ("right to be forgotten"), subject to legal exceptions
  • Restrict or object to processing
  • Receive your data in a portable format
  • Withdraw consent at any time (where consent is the legal basis)
  • Lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů) or your local data protection authority

To exercise any of these rights, contact [email protected]. We will respond within 30 days.

Candidates can exercise these rights directly with us, regardless of the recruiter who invited them.

Where requests under these rights are manifestly unfounded, excessive, or repetitive, we may either charge a reasonable fee considering the administrative costs of taking the requested action, or refuse to act on the request, in accordance with Article 12(5) of the GDPR.

11. Security

We protect personal data with appropriate technical and organizational measures, including:

  • Encryption of data in transit (TLS) and at rest
  • Encryption of OAuth access and refresh tokens
  • Access controls and authentication
  • Regular security reviews
  • Incident response procedures

No system is perfectly secure. In the event of a personal data breach affecting your data, we will notify you and the relevant data protection authority as required by law.

In the event of a personal data breach likely to result in a risk to the rights and freedoms of affected individuals, we will notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, in accordance with Article 33 of the GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly, unless one of the exceptions in Article 34(3) of the GDPR applies.

12. Cookies and tracking

The Service uses essential cookies necessary for authentication and core functionality. We do not use advertising or third-party tracking cookies.

13. Children's data

The Service is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children.

14. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email to active Users, and the "Last updated" date at the top of this policy will be revised.

15. Contact

For privacy questions, requests, or concerns:

  • Email: [email protected]
  • Postal: Dunross AI s.r.o., Pod Chytárnou 46, Zaječice - Pyšely, 251 67, Czech Republic

If you are not satisfied with our response, you have the right to lodge a complaint with the Czech Office for Personal Data Protection (www.uoou.cz) or your local data protection authority within the EU.

A list of competent data protection authorities across the European Union is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

16. Google API Services

Klara integrates with Google Calendar and other Google API Services to support recruiter workflows, in particular for scheduling interviews with candidates. This section explains how Klara accesses, uses, stores, and protects data obtained through Google API Services.

16.1 Scope of Google data accessed

When a recruiter using Klara connects their Google account through Google OAuth, Klara may access the following categories of Google user data, subject to the scopes the recruiter explicitly authorizes:

  • Google Calendar data — your free/busy availability (via https://www.googleapis.com/auth/calendar.freebusy) and the interview events Klara creates or manages on your behalf (via https://www.googleapis.com/auth/calendar.events). As stated in Section 7, Klara does not read the titles, attendees, or descriptions of your other existing events.
  • Google account profile information — including the recruiter's name and email address, accessed via the OpenID Connect scopes openid, email, and profile, solely to identify the account and display it within Klara.

Klara does not access Gmail content, Google Drive content, Google Contacts, or any other Google user data outside the scopes explicitly listed above.

16.2 Purpose of accessing Google user data

Klara accesses Google user data exclusively for the following purposes:

  • To check the recruiter's calendar availability so candidates can be offered interview slots that align with the recruiter's schedule.
  • To create calendar events for scheduled interviews between the recruiter and candidates, including video conferencing links where applicable.
  • To update or cancel previously created interview events when scheduling changes occur.
  • To display the recruiter's Google account email and name within the Klara administrative interface so the recruiter can confirm which account is connected.

Klara does not access Google user data for any purpose other than those explicitly disclosed above.

16.3 Storage and retention of Google user data

Klara stores the minimum amount of Google user data necessary to operate the integration. Specifically:

  • OAuth tokens (access and refresh tokens) are stored in encrypted form to maintain the recruiter's connection to their Google account. Tokens are stored until the recruiter disconnects their Google account or revokes access through their Google account settings, at which point they are deleted.
  • Calendar event identifiers for events that Klara has created are stored to enable later updating or cancellation of those events. These identifiers are deleted when the associated screening record is deleted in accordance with our retention schedule (see Section 9).
  • Free/busy availability is read on demand at the time of scheduling and is not persisted by Klara. Calendar event content (titles, descriptions, attendees of events not created by Klara) is not stored.

Klara stores Google user data only on infrastructure operated by sub-processors disclosed in our Sub-processor List, available at https://dunross.ai/subprocessors.html.

16.4 Sharing of Google user data

Klara does not sell, rent, or otherwise transfer Google user data to third parties for advertising, marketing, or any commercial purpose unrelated to the user-facing features the recruiter has authorized.

Klara shares Google user data only with the sub-processors necessary to operate the Klara service (such as hosting providers and infrastructure operators), under contractual obligations of confidentiality and data protection. The current list of sub-processors is published at https://dunross.ai/subprocessors.html.

16.5 Limited Use compliance

Klara's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

  • Klara only uses Google user data to provide and improve the user-facing features that the recruiter has authorized.
  • Klara does not use Google user data for serving advertisements.
  • Klara does not allow humans to read Google user data, except (i) with the explicit consent of the recruiter whose data is being accessed, (ii) where necessary for security purposes (such as investigating abuse), (iii) to comply with applicable law, or (iv) where the data has been aggregated and anonymized and is used for internal operations in accordance with applicable privacy and other laws.
  • Klara does not transfer or use Google user data to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models.

16.6 Revoking access

Recruiters may revoke Klara's access to their Google account at any time by:

  • Disconnecting the integration within the Klara administrative interface; or
  • Visiting their Google account security settings at https://myaccount.google.com/permissions and removing Klara from the list of connected applications.

Upon revocation, Klara deletes the associated OAuth tokens and ceases all access to the recruiter's Google account. Calendar events that Klara previously created in the recruiter's calendar are not automatically deleted by revocation; the recruiter retains those events and may delete them manually.

16.7 Children's data

Klara is not directed to or intended for use by individuals under the age of 16. Klara does not knowingly process Google user data of individuals under 16.