RecruitFlow AI is a recruitment-marketing service for US trucking carriers, operated by [Company legal name] (“we”, “us”). This policy explains what information the service handles, why, who it is shared with, how long it is kept and the choices you have.
It covers two groups of people:
- Business customers: carriers and the staff they invite who sign in to RecruitFlow AI to build offers, creatives and ad campaigns.
- Job applicants: drivers who open a carrier’s application page from an ad and send their details. The carrier is the one who reviews applications and contacts applicants; we process applicant information on the carrier’s behalf and under its instructions.
Who is responsible for your data#
For business customer accounts, [Company legal name] decides how account information is used and is responsible for it.
For job applicants, the hiring carrier decides what happens with an application (who reviews it, whether to call or text, how long to keep it). We act as the carrier’s service provider (“processor”): we store and display applicant information for that carrier only, and we do not use it for our own purposes. Questions about an application are best sent to the carrier; we will also pass on any request we receive.
Information about business customers#
- Account details: name, work email address, the organizations you belong to and your role in each, display preferences and the time of your last sign-in. Your password is stored only as a one-way scrypt hash.
- Sign-in and security records: active sessions and trusted browsers with the IP address, browser description (user agent) and time they were created or last used; two-step verification settings; one-time links for setting or resetting a password. Session, trusted-device, recovery-code and password-link tokens are stored only as SHA-256 hashes.
- Content your organization creates: recruitment offers (pay, bonuses, requirements, recruiting phone number), job-ad text you paste in to be read, brand kits including uploaded logos and colours, generated banners and ad copy, campaigns, budgets, schedules, approvals and comments.
- Ad platform connections: the account identifiers and access credentials you store for Meta, Google Ads or the Indeed job feed. Credentials are encrypted (AES-256-GCM) and are never shown again after they are saved.
- Ad performance data: daily impressions, clicks, spend and leads/conversions for your own campaigns, read from the connected ad platforms.
- Activity log: an audit trail of actions in your organization (who did what and when, with the IP address of the request) and records of AI usage for cost tracking.
- Email: invitations and password-reset emails we send to you.
Information about job applicants#
- Visits to an application page: when someone opens an application page from an ad, the visit is counted so the carrier can see which ads work. Visits are counted with a hashed visitor key; the raw IP address is not stored.
- What you submit: first and last name, phone number, email address (optional), state, years of CDL experience, and your consent to be contacted, with the time it was given. We also record which carrier, campaign and offer the application belongs to.
- Applications sent through a Meta form: some carriers’ Facebook and Instagram ads open a Meta instant form instead of the application page. When you send one, Meta passes your answers (name, phone number, email address, state and years of CDL experience) to RecruitFlow AI for that carrier, together with the time you sent it and which ad it came from. We store them the same way as an application sent on the application page, with the consent text the form showed you. Meta’s own handling of the form is covered by Meta’s privacy policy.
- What the carrier adds: the carrier’s staff can update the status of an application, add notes, and enter applicants they spoke to directly.
The application form does not ask for a Social Security number, date of birth, driver’s license number, driving record or background-check information. Please do not include such information in free-text fields.
How we use information#
- To run the service: sign-in, organizations and permissions, offers, creatives, approvals, campaigns, the job feed and applicant lists.
- To generate draft ad copy and images from a carrier’s offer, for the carrier to review and approve.
- To publish, pause and report on a carrier’s own campaigns on the ad platforms it connected, only after the carrier has approved them.
- To keep the service secure: two-step verification, detecting misuse, the audit trail and backups.
- To send account emails such as invitations and password resets.
- To alert a carrier’s staff about new applicants by email or, when they turn it on, by text message, and to send them report summaries.
- To meet legal obligations and enforce our terms.
We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not train AI models on customer or applicant data. RecruitFlow AI does not include third-party analytics or advertising trackers.
AI providers#
Drafts are generated with AI services. What is sent to them is limited on purpose:
- Anthropic (text): the structured facts of the offer (pay, bonuses, requirements, location), the campaign settings and brand details. When you ask the service to read an existing job ad, the pasted ad text is sent so the facts can be extracted; when copy is written, only the structured facts are sent, not the original ad text.
- OpenAI (images): a short description of a background scene. Text, numbers, prices, phone numbers, logos and brand names are removed from it first; the amounts and phone number on a banner are drawn by our own software, never by the image model.
Applicant information is never sent to AI providers. If no AI provider is configured, the service uses built-in simulated drafts and nothing is sent.
Meta, Google and job board data#
A carrier can connect its own Meta (Facebook and Instagram) ad account, its own Google Ads account and the Indeed job feed. Through those connections we:
- create, update, pause and read the status of campaigns, ad sets, ads and images the carrier has approved, in the carrier’s own ad account;
- read the ad account’s name, status and currency to verify the connection;
- read daily performance figures (impressions, clicks, spend, leads/conversions) for those campaigns;
- when the carrier turns on Meta instant forms for a campaign, create the application form on the carrier’s Facebook Page and receive the applications drivers submit in it (Meta notifies us of each one, and we read it with the carrier’s access token);
- publish approved job listings in an XML feed that job boards such as Indeed fetch. The feed contains job details (title, description, location, company, how to apply) and never applicant information.
Data received from Meta and Google is used only to manage and report on the connected customer’s own campaigns inside RecruitFlow AI. It is not sold, not used for advertising or profiling, not combined across customers and not shared except with the sub-processors listed below as needed to run the service. Disconnecting an integration deletes its stored credentials. We comply with the Meta Platform Terms and Developer Policies.
RecruitFlow AI’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: Google data is used only to provide and improve the user-facing campaign features of RecruitFlow AI, is not transferred to others except as needed for those features, for security or to comply with law, is not used for advertising, and is not read by people unless the customer asks us to, for security purposes or as the law requires.
Ad spend is billed by Meta and Google directly to the carrier’s own ad account. We do not receive or store payment card details for ad spend.
Who we share information with#
We share information only with these service providers, and only for the purpose shown:
| Provider | Purpose | Data involved |
|---|---|---|
| [Hosting provider] | Server, database, file storage and backups | All service data |
| [Email provider] | Delivering account emails, new-applicant alerts and report summaries to staff | Staff name and email address, email content (alerts include the applicant's name, phone, email, state, CDL years and campaign) |
| Twilio (only when SMS alerts are enabled) | Texting staff who asked to be alerted about new applicants | Staff phone number; the applicant's first name and last initial, phone number and the campaign name |
| Anthropic | Drafting ad copy and reading job ads | Offer, campaign and brand details |
| OpenAI | Generating background images | A scene description with no personal data |
| Sentry (only when error tracking is enabled) | Reporting server errors | Error details, request method and path, user and organization ids; no cookies, request bodies, emails or IP addresses |
| Meta Platforms | Publishing and reporting on the carrier's Meta ads | Approved ads and images; performance figures read back |
| Publishing and reporting on the carrier's Google Ads | Approved ads and images; performance figures read back | |
| Indeed and other job boards | Reading the public job feed | Approved job listings only |
We may also disclose information when the law requires it, to protect the rights and safety of people or the service, or as part of a merger or sale of the business, in which case this policy continues to apply to it.
Calls and text messages to applicants#
When you send an application, you agree that the hiring carrier may call and text you about driving jobs at the phone number you gave, which may include automated calls or texts. The carrier contacts you, not RecruitFlow AI; RecruitFlow AI does not itself call or text applicants. Message and data rates may apply, and message frequency varies.
How to stop calls and texts
- Reply STOP to any text message from the carrier.
- Tell the carrier’s recruiter on a call that you do not want to be contacted.
- Email [Contact email] with the phone number you used. We will record the opt-out and pass it on to the carrier.
Carriers are required by our terms to honor opt-outs and to follow the Telephone Consumer Protection Act and other laws on calls and texts.
How long we keep information#
- Account and organization data is kept while the customer account is active and deleted within [Retention period after account closure] after the account is closed, unless the law requires us to keep it longer.
- Sign-in records: sessions stop working after 7 days by default, trusted browsers after 60 days, password-reset links after 1 hour and invitation links after 7 days. Expired sessions and used or expired password links are deleted a day after they stop working; expired trusted browsers and unfinished two-step sign-ins are deleted at the next nightly clean-up.
- Visits to an application page are deleted automatically about 13 months (395 days) after the visit by default.
- Applicant information is kept until the carrier deletes it in its account, a verified deletion request is completed, or the carrier’s account is deleted. If the service is configured with a fixed retention period for applications, older applications are also deleted automatically each night.
- Activity log and performance data are kept for the life of the customer account. When an application is deleted, the log keeps only that a deletion was made, without the applicant’s name, phone number or email address.
- Backups are taken nightly and kept for 14 days, after which they are deleted. Deleted data disappears from backups as they roll off.
How we protect information#
- All traffic is encrypted in transit with HTTPS.
- Passwords are stored as scrypt hashes; session, trusted-device, recovery-code and password-link tokens only as SHA-256 hashes.
- Ad platform credentials and two-step verification secrets are encrypted with AES-256-GCM and are never returned by the service.
- Two-step verification (authenticator app codes with one-time recovery codes) is available to every user, and sign-in attempts are rate limited.
- Each organization’s data is kept separate, access is limited by role, and important actions are recorded in an audit trail.
- Nothing is published to an ad platform without a person’s approval.
- Backups are stored with access restricted to the server operator.
No system is perfectly secure. If we learn of a breach affecting your information, we will notify affected customers and individuals as the law requires.
Your choices and requests#
Business customers can view and update their account details and security settings in the app, and organization owners can manage members. To get a copy of your data, correct it or delete your account, email [Contact email].
Job applicants can ask the carrier they applied to, or email us, to see, correct or delete their application. The carrier’s owner or admin can export a copy of an application or delete it in the app. Because we act for the carrier, we confirm requests sent to us with that carrier and they are carried out there.
Step-by-step instructions are on the data deletion page.
California privacy rights#
This section applies to California residents under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA).
Categories of personal information
In the last 12 months the service has collected:
- Identifiers: name, email address, phone number, IP address.
- Professional or employment-related information: role in a carrier’s organization; for applicants, state and years of CDL experience.
- Internet or network activity: sign-in records, audit trail, counted visits to application pages.
- Sensitive personal information: account login credentials (email and password), used only to let you sign in securely.
Sources, purposes and the service providers that receive each category are described above. We do not sell or share personal information as those terms are defined in the CCPA, we have not done so in the last 12 months, and we do not knowingly sell or share information of consumers under 16. We use sensitive personal information only for the purposes the CCPA permits, so the right to limit its use does not apply.
Your rights
- to know what personal information we collect, use and disclose, and to get a copy;
- to delete personal information, subject to legal exceptions;
- to correct inaccurate personal information;
- to opt out of sale or sharing (we do neither);
- not to be discriminated against for using these rights.
To make a request, email [Contact email]. We will verify your request by matching the email address or phone number you give with our records, and we respond within 45 days. You may use an authorized agent, who must show your signed permission. For applicant information we are a service provider: we will forward the request to the carrier and help it respond.
Children#
RecruitFlow AI is for adults. It is not directed to anyone under 18, and the jobs advertised through it generally require a commercial driver’s license (interstate driving requires drivers to be at least 21). We do not knowingly collect information from anyone under 18; if we learn we have, we delete it.
Where information is stored#
RecruitFlow AI is intended for use in the United States. Information is stored on servers operated by [Hosting provider]. Some sub-processors may process information in other countries under their own safeguards.
Changes to this policy#
We will post any change on this page and update the date at the top. If a change is material, we will also tell business customers by email or in the app before it takes effect.
Contact us#
[Company legal name]
[Company postal address]
[Contact email]