Privacy-first recruiting workflows for real candidate data.

How Scoutlane uses information

• Operate recruiter workspaces, job setup, public application forms, candidate review, reports, and interview scheduling.
• Parse resumes and job requirements so recruiters can see structured evidence instead of manually copying information between tools.
• Generate AI-assisted summaries, match explanations, score context, and comparison views that recruiters can review before taking action.
• Send application, interview, scheduling, support, and service emails when configured by the hiring workspace.
• Protect the platform through company-scoped access controls, audit records, abuse prevention, logging, troubleshooting, and provider diagnostics.

Roles in the hiring workflow

For candidate applications submitted to an employer workspace, the hiring company generally decides why and how candidate data is used for its recruiting process. Scoutlane provides the platform that processes that data for the hiring workflow. Scoutlane may also act as an independent controller, data fiduciary, or similar role for account, billing, security, support, legal, and product operations data.

Legal bases and purposes

The applicable legal basis depends on the user, jurisdiction, and workflow. Scoutlane processes personal data only for recruiting workspace operation, candidate review, scheduling, security, support, compliance, and service administration purposes.

• Consent, when candidates submit applications, upload resumes, accept screening flows, or connect optional integrations.
• Contract or pre-contract steps, when recruiter customers use Scoutlane to operate a workspace, invite users, manage plans, or receive support.
• Legitimate interests, such as securing the service, preventing abuse, maintaining audit records, and improving reliable recruiting workflows in a privacy-conscious way.
• Legal obligations, where records must be preserved, disclosed, or restricted to comply with applicable law or lawful requests.
• Employer-provided lawful basis, when the hiring company controls why candidate data is processed for its recruiting process.

AI assistance and human control

Scoutlane uses AI to help parse resumes, compare candidate evidence against job requirements, produce summaries, surface gaps, and prepare recruiter review context. AI outputs are decision-support information only. Recruiters and hiring teams remain responsible for reviewing evidence, applying lawful hiring practices, and making final shortlist, rejection, interview, offer, and hiring decisions.

Scoutlane is not designed to make solely automated hiring decisions. Candidates who need an alternative process or accommodation should contact the hiring company listed in the application flow, or Scoutlane support if the employer contact is unavailable.

Google user data we access and use

Connecting Google Calendar is optional. When you authorize it, Scoutlane AI accesses and processes the following Google user data to coordinate interviews:

• Calendar availability: busy intervals (start and end times) from your primary calendar for the requested scheduling period. Free/busy checks do not read the titles, descriptions, or attendee lists of unrelated events.
• Interview events: Google event identifiers and Google Meet links for interviews managed through Scoutlane. To create or reschedule an event, we send Google the interview title (job and round name), an application-reference description, start and end times with time-zone information, and candidate/interviewer email addresses. We may retrieve the matching interview event after a retry and delete it when the interview is cancelled.
• Connection credentials: OAuth access and refresh tokens, granted scopes, token type and expiry, provider identifiers when supplied, and connection timestamps associated with your Scoutlane user and company. These let the server perform authorized scheduling without receiving your Google password.

Google Calendar access currently uses the scopes https://www.googleapis.com/auth/calendar.freebusy and https://www.googleapis.com/auth/calendar.events.owned so the workspace can check availability and manage interview events on the connected user's primary calendar. The owned-events permission technically allows reading, creating, changing, and deleting events on calendars you own; Scoutlane uses it for interviews managed through the workspace. Calendar connection does not grant access to Gmail messages, Drive files, or Google Contacts.

Google Calendar data is used for availability, scheduling, rescheduling, cancellation, and meeting information for authorized workspace users and interview participants. It is not sold or used for advertising, candidate scoring, or developing, improving, or training generalized or non-personalized AI/ML models. The AI-provider descriptions elsewhere in this policy concern recruiting and resume workflows, not Google Calendar data.

Scoutlane AI's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we protect sensitive Google user data

Scoutlane uses HTTPS/TLS for its public service and requests to Google's OAuth and Calendar APIs. Calendar access and refresh tokens are encrypted with authenticated encryption before storage in the active application database, using a dedicated server-side encryption key. Tokens are decrypted only on the server for authorized provider operations and are excluded from Calendar connection responses sent to the browser.

Calendar endpoints require authenticated users with authorized workspace roles and company-scoped access checks. OAuth callback state is signed, time-limited, and checked against the connecting user, company, and provider. Connection creation and removal produce audit records. Provider-failure diagnostics exclude raw provider-response bodies and redact sensitive metadata fields. No security measure can guarantee complete protection against every incident; these safeguards are not a claim that every database field is encrypted at the application layer.

Google data sharing, retention, and deletion

We exchange scheduling information with Google and make relevant interview details available to authorized hiring-workspace users and interview participants. Infrastructure providers process stored information to operate Scoutlane. Google Calendar data is not shared with AI providers for candidate evaluation or generalized model training, or with advertising/data-broker services. Any support, security, or legally required disclosure remains subject to the Google API Services User Data Policy and Limited Use requirements.

Connection credentials are retained while the integration is connected. Disconnecting in Scoutlane deletes the stored connection and its access/refresh tokens from the active application database and stops new API calls using that connection. To revoke the grant at Google itself, remove Scoutlane in your Google Account third-party connections.

Disconnecting does not automatically delete events already in Google Calendar, previously synchronized busy-time records, or workspace interview/audit records. These may remain for scheduling history and employer retention obligations. To request deletion of retained Scoutlane records, contact support@scoutlaneai.com or the hiring company. We verify identity and authority; legal retention restrictions may apply. Disconnecting is not a promise of immediate deletion from backups.

Optional Google sign-in and Microsoft Calendar

Where Google sign-in is enabled, it is a separate consent flow using openid, email, and profile permissions. Google may supply basic profile claims such as name and profile picture in its identity response. Scoutlane verifies that response and uses your Google account identifier, email address, and email-verification status to link and authenticate your existing Scoutlane account. Signing in does not itself connect your Calendar.

If you connect Microsoft Calendar, Scoutlane uses that separate authorization to check availability and manage interview events. You can disconnect it in integration settings or revoke access in your Microsoft account. Calendar data is not sold or used for advertising or generalized AI training.

Sharing and service providers

Scoutlane does not sell candidate data. We share information only as needed to provide, secure, support, and improve the service, or as required by law.

• Hosting, database, storage, logging, and infrastructure providers that keep the service running.
• Email providers such as Resend when a workspace sends transactional recruiting email.
• AI providers used to generate resume parsing, summaries, scores, and screening support.
• Calendar providers such as Google Calendar or Microsoft Calendar when a recruiter connects an account for interview scheduling.
• Support, security, legal, or compliance parties when needed to operate the service, enforce terms, or respond to lawful requests.

Retention, deletion, and candidate requests

Company admins can configure candidate data retention in Scoutlane privacy settings. Retention and deletion workflows are designed to anonymize or remove candidate profile data, resume references, parsed resume content, AI response storage, voice screening records, email content, embeddings, and related personal data where supported.

• Recruiters and company admins can update company privacy settings, consent text, retention configuration, and team access from the workspace.
• Candidates can ask the hiring company or Scoutlane AI support for help with access, correction, export, or deletion requests.
• Candidate deletion and retention workflows anonymize or remove personal data where the product supports it, while preserving non-identifying operational records where appropriate.
• Calendar users can disconnect Google or Microsoft Calendar access from the integration settings or revoke access from the calendar provider account.

To make a privacy request, contact the hiring company listed in the job flow or email support@scoutlaneai.com. We may need to verify your identity and may direct employer-controlled hiring requests to the relevant employer.

Regional rights and notices

Scoutlane is being prepared for India, US, and EU customer workflows, but legal obligations vary by employer, candidate location, role, and use case. The hiring company may need to provide its own candidate-facing notice, lawful basis, accommodation process, and retention policy.

• India DPDP-style requests may include access to processing information, correction, erasure where applicable, consent withdrawal, and grievance support.
• EU/UK-style requests may include access, rectification, erasure, restriction, portability, objection, consent withdrawal, and complaint to a supervisory authority.
• US state privacy requests may include access, deletion, correction, opt-out, or appeal rights where the relevant law applies to the customer or Scoutlane.
• Requests can be limited by security, identity verification, legal retention, audit, fraud-prevention, or employer-controlled hiring record obligations.

International transfers and subprocessors

Scoutlane may use infrastructure, storage, email, AI, calendar, logging, support, and security providers in India, the United States, the European Economic Area, or other regions where service providers operate. When required, customers should use a signed agreement or data processing addendum to define transfer safeguards, subprocessors, audit rights, and customer-specific retention terms.

Security and document handling

Scoutlane is designed around company-scoped access, authenticated recruiter workspaces, private resume storage, short-lived resume access links, audit-friendly records, and production configuration checks. Resume and job-document scanning support exists through configurable providers, but Scoutlane does not claim every production file is scanned unless a scanner has been configured and verified for the workspace.

Contact

Questions about this Privacy Policy or Scoutlane AI data handling can be sent to support@scoutlaneai.com.

Candidates should also contact the hiring company listed in the job application flow when the request relates to a specific employer's recruiting process. Scoutlane can help route requests, but employer-controlled hiring records may require employer action.