Privacy Policy

1. Introduction

Kynto SAS ("Kynto", "we", "our") is committed to protecting the privacy and personal data of all individuals who interact with our website and platform. This Privacy Policy explains how we collect, use, store, and protect personal data in compliance with the General Data Protection Regulation (GDPR) and the Google API Services User Data Policy, including its Limited Use requirements.

2. Who We Are

3. Our Role Under GDPR

Kynto acts as a data processor under the GDPR. Our customers (companies using the platform) act as data controllers with respect to candidate and recruitment-related personal data processed through Kynto.

For a full overview of our GDPR commitments, including data retention, candidate rights, subprocessor framework, and AI compliance, please visit our GDPR page.

4. Personal Data We Process

4.1 User (Client) Data

• • First and last name
• • Professional email address
• • Company name and role
• • Authentication and account data
• • Connection data (IP address, logs, device information)
• • Billing data (processed via Stripe)

4.2 Candidate Data (processed on behalf of customers)

• • CVs and application documents
• • Professional background, experience, and skills
• • Contact details
• • Evaluation notes and recruitment feedback
• • AI-generated scores and summaries
• • Interview transcriptions and recordings
• • Messages exchanged with candidates (email, LinkedIn, WhatsApp)

4.3 Sourcing Prospect Data (processed on behalf of customers)

• • Professional profile information (name, position, company, experience, location)
• • Professional contact details obtained through enrichment
• • Messages exchanged as part of a sourcing campaign

4.4 Recipients of Personal Data

• • Authorized users of the customer's organization, according to their role and the jobs they can access
• • Kynto's subprocessors, for the technical operation of the service (see section 7)
• • Third-party AI assistants that the customer chooses to connect to Kynto (see section 9)
• • The recipients of messages sent through the platform: candidates, prospects and interviewers
• • Kynto staff, only where needed to provide support or ensure security

Kynto does not intentionally collect sensitive data categories as defined under Article 9 GDPR. If such data is present in candidate documents, it is processed solely under the responsibility of the data controller.

5. Legal Bases for Processing

We process personal data on the following legal bases:

• • Contract performance, to deliver the Kynto platform and its features to our customers
• • Legitimate interests, to ensure platform security, reliability, and service improvement
• • Legal obligation, to comply with applicable laws and regulations
• • Consent, for optional cookies and non-essential features, where required

6. Infrastructure and Data Location

All personal data processed through Kynto is hosted exclusively within the European Union:

• • Application hosting: Vercel (EU)
• • File storage (CVs, transcriptions, recordings): Amazon Web Services S3 (region: eu-west-3, Paris, France)

Both providers operate under Standard Contractual Clauses (SCCs) in compliance with GDPR requirements for international data transfers where applicable.

7. Subprocessors

Kynto works with a carefully selected set of GDPR-compliant technical subprocessors. A Data Processing Agreement (DPA) is in place with each of them.

The full and up-to-date list of our subprocessors is available on our Subprocessors page.

8. Use of Artificial Intelligence

Kynto uses AI technologies to support recruitment processes, including CV analysis, candidate scoring, and interview assistance. These features operate exclusively as decision-support tools. All AI outputs must be reviewed and validated by a human user.

Kynto does not perform automated decision-making within the meaning of Article 22 GDPR.

AI models used by Kynto:

• • are not trained on customer or candidate data
• • operate in no-training / no-retention mode
• • are hosted within the European Union

Data received from Google APIs is never used to develop, improve or train AI or machine learning models (see section 10).

9. AI Assistants Connected by the Customer

Users can connect a third-party AI assistant, such as Claude (Anthropic), ChatGPT (OpenAI) or Mistral (Mistral AI), to their Kynto account through the Kynto connector, which uses the Model Context Protocol (MCP). The connection is set up by the user, with their own Kynto account, and can be revoked at any time from Settings > Integrations > AI assistants. How the connector works is described on our AI assistants page.

When the assistant uses the connector, Kynto returns the data needed for the user's request, limited to the user's organization and permissions. Depending on the request, this can include:

• • job postings and recruitment pipelines
• • candidate profiles, contact details, CV content, AI scores and analyses
• • interview transcriptions, evaluation notes and interviewer feedback
• • messages exchanged with candidates and sourcing prospects
• • sourcing campaign and prospect data
• • names and email addresses of team members and end-client employees
• • company library documents and recruitment metrics
• • interview availability computed from connected calendars (free time slots only)

The provider of the assistant receives this data as a recipient chosen by the customer, and processes it under the customer's own agreement with that provider. It is not a Kynto subprocessor. Kynto does not access the user's conversations with the assistant: it only receives the requests the assistant sends to the connector.

For this feature, Kynto stores:

• • the access granted to the assistant: access tokens expire after one hour and renewal tokens after 60 days without use, and both are invalidated immediately upon revocation
• • a log of each request (account, tool used, parameters, date, IP address), kept for 12 months for security and audit purposes

10. Use of Google User Data

When a user connects their Google account, Kynto uses the following Google data, only to schedule interviews and keep them up to date:

• • Google Calendar: the busy periods of the calendar (free/busy information, without event titles, descriptions or participants), to compute available interview slots
• • Google Calendar: the interview events that Kynto creates, which it can update or delete and whose changes it follows to keep interviews in sync
• • basic account information (name and email address)

Interview slots computed from these busy periods are shown in Kynto, proposed by Kynto's AI assistant and, at the user's request, provided to a third-party AI assistant that the user has connected to Kynto (see section 9), only to schedule interviews. Kynto does not read the content of calendar events other than the interview events it created.

Mailboxes, including Gmail mailboxes, are connected through our messaging provider Unipile, with Unipile's own Google authorization (see our Subprocessors page). Kynto then keeps only the emails exchanged with the organization's candidates and sourcing prospects, to show them in the Kynto inbox; the content of emails from other senders is not stored. These messages can be read by Kynto's AI assistant and, at the user's request, by an AI assistant the user has connected to Kynto (see section 9). They are never used to develop, improve or train AI or machine learning models.

Google user data received through Kynto's own Google authorization is:

• • used only to provide these user-facing features
• • never used for advertising, analytics or profiling, and never sold
• • never used to develop, improve or train AI or machine learning models
• • not stored, except for the authorization tokens and the identifiers of the events Kynto creates
• • only shared with a third party when needed for a feature the user requests, as described above

Kynto's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace APIs will adhere to the Google Workspace API User Data and Developer Policy.

11. Cookies

Kynto uses cookies strictly necessary for the website and the platform to work (authentication, session management, security, and remembering your cookie choices). These are always active.

With your prior consent, and only for the categories you accept, we also use:

• • Analytics cookies: Google Analytics, through Google Tag Manager, on kyntoai.com, and PostHog (hosted in the EU) on kyntoai.com and app.kyntoai.com, to measure audience and improve the service. On kyntoai.com, PostHog records pages viewed, clicks and session replays: visitors stay anonymous and form fields are always masked.
• • Marketing cookies, affiliate program: when you arrive through a partner's link, we record that partner's code in a first-party cookie (kynto_ref, kept 60 days, shared between kyntoai.com and app.kyntoai.com) so that partner can be credited if you subscribe. No third party is involved.
• • Marketing cookies, OpenAI Ads: the ChatGPT Ads Measurement Pixel measures whether our ads shown in ChatGPT lead to actions on our sites (page views, pricing page visits, demo bookings, pricing requests, sign-ups and trial starts). It sets an attribution cookie (__oppref). Only the type of action is sent to OpenAI: no form content, no contact details, and no candidate data.
• • Marketing cookies, advertising tags: advertising tags managed through Google Tag Manager, which only run when marketing cookies are accepted.

None of these tools is loaded before you accept its category. Refusing analytics cookies does not prevent marketing cookies from working, and the other way round.

You may accept, refuse, or customize these categories in the cookie banner, and change your choice at any time via the "Cookie settings" link in the footer of kyntoai.com or the cookie preferences of the platform. Withdrawing your consent stops the corresponding tools and deletes the cookies they had set.

12. Data Retention

Candidate data is automatically deleted 24 months after the closure of the relevant recruitment process, unless otherwise requested by the customer or required by law.

User (client) account data is retained for the duration of the contractual relationship and deleted upon account termination, subject to applicable legal retention obligations.

Access granted to a connected AI assistant expires after 60 days without use, and the log of its requests is kept for 12 months (see section 9).

13. Your Rights

In accordance with the GDPR, you have the right to access, rectify, delete, port, restrict, or object to the processing of your personal data.

Candidates may also submit a deletion or portability request directly via our Privacy Portal, without needing to contact the company that collected their data.

All other requests may be submitted to: privacy@kyntoai.com

14. Updates to This Policy

This Privacy Policy may be updated periodically. The latest version will always be available on the Kynto website. Continued use of the platform following any update constitutes acceptance of the revised policy.

15. Contact

For any questions regarding this Privacy Policy or the processing of your personal data:

privacy@kyntoai.com