Privacy Notice

Vashly AB
Birger Jarlsgatan 57 C
113 56 Stockholm, Sweden
hello@vashly.com

For privacy questions or requests, email us with “Privacy request” in the subject line.

This Privacy Notice applies to:

• visitors to our websites and landing pages;
• customers and Users of our Service;
• individuals who view or interact with Profiles or Opportunity Content;
• newsletter subscribers and event participants;
• prospects, customers, partners, suppliers, and other business contacts; and
• individuals whose professional information may be processed through Candidate Intelligence features.

Third-Party Services process personal data under their own privacy notices in addition to this Privacy Notice.

3.1 When Vashly is a controller

Vashly acts as controller when it determines why and how personal data is processed for its own purposes, including operating our websites and accounts; security; billing; support; product analytics; sales and marketing; legal compliance; and the professional-data activities described in section 6.

3.2 When Vashly is a processor

Vashly acts as processor when it processes personal data in a customer workspace solely on the customer’s documented instructions. In those cases, the customer is normally the controller and its privacy notice governs its processing. Our Data Processing Addendum applies where required.

The applicable role depends on the specific processing activity. Vashly and a customer may each act as an independent controller for processing each determines independently.

We collect personal data that individuals or customers provide, data collected automatically, and data obtained from lawful third-party and public sources.

4.1 Data provided to us

• Account data: name, work email, role, company, authentication information, and account preferences.
• Customer and workspace content: text, images, logos, videos, candidate lists, role requirements, team information, Opportunity Content, prompts, instructions, suppression lists, and related materials.
• Communications: support requests, feedback, correspondence, survey responses, and meeting notes.
• Billing and transaction data: company details, billing contacts, VAT information, invoice information, subscription status, and payment status. Payment-card data may be handled directly by our payment provider.
• Marketing and event data: newsletter preferences, registrations, attendance, and interactions with our communications.

4.2 Data collected automatically

• Usage and device data: pages and features viewed, actions taken, timestamps, referring URL, approximate location derived from IP address, IP address, device identifiers, browser, operating system, and language.
• Security and diagnostic data: authentication events, logs, errors, performance information, and suspected abuse or fraud indicators.
• Cookie and similar-technology data: identifiers and interactions collected through cookies, local storage, pixels, or software development kits, as described in section 10.
• Engagement activity: where permitted by law, delivery, opens, clicks, visits, replies, and other interactions with outreach or Opportunity Content. These signals may be incomplete or technically imprecise.

4.3 Data from third parties and public sources

• Business contact data: name, work contact information, job title, role, employer, and related business information from public or licensed business-to-business sources.
• Customer-authorised integration data: information received from tools a customer connects, such as applicant tracking, customer relationship management, communications, or email services.
• Professional and Candidate Data: the information described in section 6.

4.4 Sensitive data

We do not intend to collect or infer special categories of personal data, criminal-conviction data, children’s data, or other highly sensitive information for Candidate Intelligence. Customers and Users should not submit such information unless Vashly has expressly agreed in writing and all legal requirements are met. If public professional content incidentally contains sensitive information, we seek to avoid using it for matching or employment-related inferences.

We process personal data only where we have a legal basis under applicable data-protection law.

5.1 Provide and administer the Service

We create and manage accounts, authenticate Users, provide features and integrations, host Customer Data, deliver support, manage subscriptions, and communicate about the Service.

Legal bases: performance of a contract; legitimate interests in operating and supporting our business and Service.

5.2 Security, integrity, and abuse prevention

We protect accounts and systems, monitor security, troubleshoot problems, enforce our Terms, detect fraud or abuse, maintain suppression records, and protect individuals, customers, and Vashly.

Legal bases: legitimate interests; compliance with legal obligations.

5.3 Product operation, analytics, and improvement

We diagnose performance, understand feature adoption, maintain data quality, improve workflows and features, and produce aggregated or de-identified statistics.

Legal bases: legitimate interests; consent for non-essential cookies or similar technologies where required.

We do not use private customer workspace content to train publicly available foundation models. Where our service providers process content to provide AI functionality, they do so under contractual restrictions and our instructions as applicable.

5.4 Business-to-business sales and marketing

We manage customer and prospect relationships, respond to enquiries, send relevant business communications, organise events, and deliver newsletters or product updates.

Legal bases: legitimate interests in relevant business communications and growing our business; consent where required by law.

5.5 Billing, bookkeeping, and legal compliance

We process invoices and payments, keep accounting records, comply with tax and other legal requirements, respond to lawful requests, and establish, exercise, or defend legal claims.

Legal bases: performance of a contract; legal obligation; legitimate interests.

5.6 Candidate Intelligence and professional data

We process professional information for the purposes and on the legal bases described in section 6.

This section applies when professional information is processed to help customers identify, match, review, understand, and engage people who may be relevant to their teams or opportunities.

6.1 How we obtain professional data

We may obtain professional information from:

1. licensed third-party data providers;
2. publicly available professional sources on the open web, including professional and developer platforms, employer and company websites, personal websites, portfolios, blogs, articles, publications, research papers, conference or talk pages, public code repositories, technical contributions, and other professional content made publicly available by or about an individual;
3. customers and Users, including candidate lists and role information they upload; and
4. customer-authorised integrations and other lawful sources.

We may combine information from different sources where we reasonably believe it relates to the same individual, to create, enrich, update, or deduplicate a professional profile and connect relevant Professional Evidence to that profile.

6.2 Professional data we may process

Depending on availability and relevance, this may include:

• name, current and previous employers, job titles, roles, work history, location, and education;
• professional and technical skills, experience, languages, industries, and areas of expertise;
• public professional profile links and identifiers;
• contact information obtained lawfully, including work email addresses and business telephone numbers; contact enrichment may also request personal-email information;
• personal websites, portfolios, blogs, professional articles, publications, research papers, conference appearances, talks, and links to other professional work;
• public code repositories, programming languages, projects, technical contributions, and developer activity;
• information supplied by customers, including notes, status, role criteria, and interaction history; and
• source, recency, quality, and matching information used to maintain, rank, or explain a profile.

We seek to process information that is relevant to professional experience, work, or potential role fit. We do not intend to use sensitive personal data to rank or recommend candidates.

6.3 Why we process professional data

We may use professional data to:

• create, enrich, update, and deduplicate professional profiles;
• support search, discovery, and candidate-role matching;
• surface relevant Professional Evidence;
• help customers understand an individual’s experience, work, and potential relevance to a role;
• provide contextual explanations about potential strengths, relevance, or information gaps;
• support appropriate Opportunity Content and outreach;
• organise engagement activity and recruiting workflows;
• respond to corrections, objections, and suppression requests; and
• maintain accuracy, security, service quality, and fraud or abuse prevention.

Public professional activity can be evidence of work, experience, skills, or expertise. It must not be interpreted as evidence that a person is looking for a job, willing to engage, or interested in a specific opportunity.

6.4 Legal basis

When Vashly acts as controller for this processing, we generally rely on our legitimate interests and those of our customers in professional discovery, candidate matching, relevant business recruitment, and operating and improving the Service under Article 6(1)(f) GDPR. We consider the professional nature of the data, its source, reasonable expectations, relevance, safeguards, potential impact, and individuals’ rights.

Where consent or another legal basis is required for a particular activity, we or the relevant customer must obtain or establish it before that activity. Customers are independently responsible for the lawful basis for their own evaluation, outreach, and recruiting use.

You have the right to object to processing based on legitimate interests. See section 12.

6.5 Accuracy and context

Professional data and generated enrichment may be incomplete, outdated, inaccurate, or incorrectly linked to an individual. Automated matching and explanations are probabilistic and depend on available information. Customers are required to review material information and use professional judgment.

6.6 Sharing with customers

When a customer performs a search, opens a profile, or uses a relevant feature, professional information may be displayed to that customer for legitimate recruiting and talent purposes. The customer becomes responsible as controller for its further use, including evaluation, storage, outreach, and employment decisions.

6.7 Objection, correction, deletion, and suppression

You may ask us to provide access to, correct, delete, or suppress professional information, or object to its processing, by emailing hello@vashly.com with “Privacy request” in the subject line. We may verify your identity and ask for information needed to locate the relevant profile.

When we grant a suppression request, we may retain the minimum information necessary to recognise the request and prevent the data from being reintroduced or used for further outreach. We will also take reasonable steps regarding data we control that has been provided to customers, subject to applicable law and technical feasibility.

The Service may use artificial intelligence and other automated processing to structure and summarise professional information; identify Professional Evidence; support search and candidate-role matching; generate contextual explanations, Opportunity Content, and outreach drafts; and organise engagement activity.

These outputs are assistive. They may be incomplete, inaccurate, or affected by limitations in source data or models. Vashly does not make hiring decisions for customers and does not make decisions producing legal or similarly significant effects for individuals solely through automated processing. Employers and other customers remain responsible for meaningful human review and all employment decisions.

Matching, ranking, or explanations may constitute profiling under data-protection law. Individuals may object to profiling based on legitimate interests and may exercise the rights described in section 12.

Engagement activity does not reliably establish an individual’s intent, interest, or willingness to change jobs and should not be treated as doing so.

We may share personal data with:

• service providers and subprocessors that support hosting, infrastructure, security, analytics, artificial intelligence, data processing, communications, email delivery, payments, customer support, and customer relationship management, under appropriate contracts;
• customers where needed to provide the Service and Candidate Intelligence features;
• Third-Party Services enabled or directed by a customer;
• professional advisers, auditors, insurers, and financing parties where reasonably necessary;
• authorities, courts, or other parties where required by law or necessary to protect rights, safety, or the integrity of the Service; and
• actual or prospective parties to a merger, financing, reorganisation, acquisition, or sale, subject to appropriate confidentiality and safeguards.

Our current subprocessor information is available at https://vashly.com/subprocessors.

We do not sell personal data for monetary consideration. We do not permit customers to use professional data for unrelated advertising, surveillance, or consumer profiling.

Some recipients may process personal data outside Sweden, the EU, or the EEA. Where required, we use a valid transfer mechanism and appropriate safeguards, such as an adequacy decision, the European Commission’s Standard Contractual Clauses, and supplementary measures. For participating US organisations, we may rely on the EU–US Data Privacy Framework where applicable.

You may contact us for more information about applicable transfer safeguards.

We use cookies, local storage, pixels and similar technologies for necessary sessions and security, preferences, product analytics, and advertising or conversion measurement. The relevant service providers and purposes are described on our Subprocessors and service providers page.

Non-essential storage or access on your device requires prior consent where applicable law requires it. Browser settings can restrict cookies and some tracking, although blocking necessary technologies may affect the Service. Browser settings do not replace any consent that Vashly is required to obtain.

For questions about these technologies or to exercise your data-protection rights, contact hello@vashly.com. We do not currently provide an in-site Cookie preference tool.

We retain personal data only for as long as reasonably necessary for the purposes described above, including contractual, legal, accounting, security, dispute, and suppression requirements. Typical retention periods are:

Deletion removes relevant data from active systems and caches. Database backups expire through their normal one-month lifecycle; the confirmed Storage bucket retains soft-deleted objects for seven days. Minimal suppression records may be retained to honour objections and prevent reintroduction or further contact. Applicable deletion and suppression requests are reapplied if recovery copies are restored. Customers may retain copies under their own policies and legal responsibilities.

Workspace customers can request manual export or deletion by emailing hello@vashly.com. See the DPA for the contractual scope and timing.

Subject to applicable law, you may have the right to:

• obtain confirmation and access to your personal data;
• correct inaccurate or incomplete data;
• request deletion;
• restrict processing;
• receive certain data in a portable format;
• object to processing based on legitimate interests, including related profiling;
• withdraw consent at any time, without affecting earlier lawful processing; and
• lodge a complaint with a supervisory authority.

To exercise a right, email hello@vashly.com with “Privacy request” in the subject line. We may verify your identity. We normally respond within one month, subject to lawful extensions for complex or numerous requests.

Where Vashly acts only as a processor, we may direct your request to the relevant customer or assist that customer in responding.

If you object to direct marketing, we will stop using your personal data for that purpose. If you object to other processing based on legitimate interests, we will stop unless we demonstrate compelling legitimate grounds or need the data for legal claims.

Our lead supervisory authority in Sweden is:

Integritetsskyddsmyndigheten (IMY)
Box 8114
104 20 Stockholm, Sweden
imy@imy.se
Telephone: +46 (0)8-657 61 00

The Service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe we have collected a child’s personal data, contact us so that we can investigate and take appropriate action.

We use appropriate technical and organisational measures designed to protect personal data, including access controls, least-privilege practices, encryption in transit, logging, monitoring, and backup controls. No system is completely secure, and we cannot guarantee absolute security.

If a personal data breach is likely to create a risk to individuals, we will notify affected customers, individuals, and authorities as required by applicable law.

We may update this Privacy Notice to reflect changes in our Service, processing, or legal requirements. We will publish the updated version with a new “Last updated” date and, where appropriate, provide additional notice through the Service or by email.

Privacy questions and requests may be sent to:

Vashly AB
Birger Jarlsgatan 57 C
113 56 Stockholm, Sweden
hello@vashly.com

Please use “Privacy request” in the subject line.