Privacy policy.

Last updated: July 2026

This policy explains what data Groucho collects, why, and what rights you have — in plain English, because privacy policies you can't read protect no one. Groucho is operated by Bastian Gerhard. Questions or requests: bastian@groucho.ai.

Two kinds of people, two roles

If you're a hiring team using Groucho: we are the data controller for your account data (name, email, company, usage).

If you're a candidate who applied to a company that uses Groucho: that company is the data controller for your application, and Groucho processes it on their behalf as a data processor. Your data belongs to your application with that company — it is never shared with other companies on Groucho or used to build cross-company profiles.

What we collect

• Hiring team accounts: name, email, company name, and the roles and settings you create.
• Candidate applications: the CV, answers, and messages a candidate submits, plus the assessments Groucho generates from them for the hiring team.
• Waitlist signups: the email and company details you submit through the waitlist form.

How AI is used

Groucho uses AI (large language models) to read applications, extract evidence, and draft assessments and messages. Candidates are informed that AI assists the screening. AI never makes final decisions: rejecting, shortlisting, or hiring a candidate always requires explicit confirmation by a human at the hiring company, and every decision is recorded in an audit log.

Candidate data sent to our AI provider is used only to process the application — it is not used to train AI models.

Where your data lives

Data is stored with a small set of service providers under data-processing agreements: application hosting and database (Railway), file storage for CVs (Cloudflare R2), AI processing (Anthropic), transactional email (Resend), and authentication for hiring teams (Clerk). We don't sell data, run ads, or share data with anyone beyond these processors.

How long we keep it

Hiring teams control the retention period for candidate data in their account settings. When a retention period expires, or a hiring process is closed, candidate data is deleted automatically. Account data is kept while your account is active and deleted on request.

Your rights (GDPR)

You can, at any time:

• request a copy of the data we hold about you (access & portability),
• ask us to correct inaccurate data (rectification),
• ask us to delete your data (erasure),
• object to or ask us to restrict processing.

Candidates can also raise these requests directly with the company they applied to — either way, they are honored. To exercise any right, email bastian@groucho.ai and we'll respond within 30 days. You also have the right to lodge a complaint with your local data-protection authority.

Cookies & analytics

The marketing site uses no advertising trackers. If we measure traffic, we use privacy-friendly, cookieless analytics. The app uses only the cookies required to keep you signed in.

Changes

If this policy changes in a way that matters, we'll update this page and note the date at the top. Substantive changes affecting candidates or hiring teams are announced by email.