Privacy policy
Effective date: 16 October 2026 · Version 2.0
This policy explains how Forti8 handles personal data on jennyhires.com and in its public demos. It is our privacy notice under the EU General Data Protection Regulation (GDPR) and our data processing policy (política de tratamiento de la información) under Colombian Law 1581 of 2012 and Decree 1377 of 2013.
The Jenny app itself (jennyos.com) is covered by our agreement with each customer: there, the recruitment agency decides which candidate and client data is processed, and Forti8 processes it on the agency’s behalf. See section 10.
1. Who is responsible for your data
The controller (responsable del tratamiento) is Forti8, a company registered in Colombia.
- Registered name
- available on request
- NIT (tax ID)
- available on request
- Registered address
- Bucaramanga, Colombia
- hello@forti8.io
- Phone
- available on request
Privacy questions and requests are handled by the founder, Kevin Clement, at hello@forti8.io.
2. What we collect, why, and for how long
| When | Personal data | Why | Legal basis (GDPR) | Kept for |
|---|---|---|---|---|
| You visit the site | IP address, browser and device details, pages requested, date and time | To deliver the site, keep it secure and investigate abuse | Legitimate interests (art. 6(1)(f)) | A limited period set by our hosting provider, Vercel |
| We count visits | Page viewed, referring site, approximate location (country, region, city), device type, operating system and browser, which buttons and steps you use (for example “opened the booking calendar” or “booked a demo”), and a temporary hash of the request instead of a cookie — never what you type, no name or e-mail | To understand which pages and steps are used, in aggregate | Legitimate interests (art. 6(1)(f)) | Aggregated statistics in Vercel Web Analytics; the visit hash is discarded after 24 hours |
| You try the CV demo | The CV you upload (which can include a name, contact details, work history, education and skills) and the preferences you type | To show you a candidate profile and matching vacancies | Legitimate interests (art. 6(1)(f)): yours in testing the service and ours in demonstrating it. You confirm you are allowed to share the CV | Not stored by us. Anthropic deletes API inputs and outputs within 30 days, longer only for abuse checks or legal obligations |
| The demo searches vacancies | Job titles and a location taken from the profile — not the CV, not a name | To find current public job postings | Legitimate interests (art. 6(1)(f)) | Not stored by us |
| You try the job description demo | The job description you paste or upload | To extract requirements and rank fictional demo profiles | Legitimate interests (art. 6(1)(f)) | Not stored by us; Anthropic as above |
| You send a form (free-trial application, founding access, integration request, interest in a feature) | Name, work e-mail, company, country, team size, current ATS, your message, language, the page you were on | To reply to you and follow up about Jenny | Your consent (art. 6(1)(a)); under Colombian law, your authorization (autorización) | Until you ask us to delete it, and no longer than 24 months after our last contact |
| You use the demos or forms | A salted one-way hash of your IP address and how many times you used them that day | To prevent abuse and keep demo costs under control | Legitimate interests (art. 6(1)(f)) | 7 days |
| You book a demo | The details you enter in Calendly | To schedule and hold the call | Steps before a contract at your request (art. 6(1)(b)) | As long as needed for the meeting and follow-up |
| You e-mail us | Your e-mail address and message | To answer you | Legitimate interests (art. 6(1)(f)) or steps before a contract (art. 6(1)(b)) | As long as needed to handle your message |
You don’t have to give us personal data to read the site. Without the details marked as required we cannot answer a form or run a demo.
We don’t sell personal data, we don’t use it for advertising, and we don’t ask for sensitive data (such as health, beliefs or origin). Please leave sensitive information out of CVs and messages you upload.
3. How AI is used
The public demos use Anthropic’s Claude AI to read CVs and job descriptions and to write the explanations you see. These results are generated automatically, are labelled as such, and can contain mistakes: check the original vacancy or profile before acting on them.
We don’t take decisions about you based solely on automated processing that have legal or similarly significant effects on you (GDPR art. 22). Under Anthropic’s commercial terms, data sent through its API is not used to train its models.
4. Who receives data
We use these service providers. They process data on our behalf and under our instructions (as processors or encargados del tratamiento):
| Provider | What for | Where |
|---|---|---|
| Vercel Inc. | Hosting, server logs, cookieless visit statistics | United States and its global network |
| Anthropic PBC | AI processing for the public demos | United States |
| Supabase Inc. | Database for forms and abuse counters | United States (AWS us-east-2) |
| Calendly LLC | Demo booking, only after you open the calendar | United States |
| Resend (Plus Five Five, Inc.) | Once switched on: an internal e-mail that tells our team about your form submission, with the details you entered | United States |
To search vacancies, the demo sends job titles and a location to LinkedIn’s public job search. LinkedIn receives no CV and no name. When you follow a link to LinkedIn, Calendly or another site, that site’s own privacy policy applies.
We may disclose data where the law requires it or to protect our rights.
5. Transfers outside the EU and Colombia
Our providers are in the United States. Under the GDPR, transfers to Vercel, Calendly and Resend rely on the EU–U.S. Data Privacy Framework, to which they are certified (Resend’s data processing terms also include the Standard Contractual Clauses); transfers to Anthropic and Supabase rely on the European Commission’s Standard Contractual Clauses in their data processing terms.
Under Colombian law, our providers act as processors (encargados), so sending them data is a transmission governed by a contract, as allowed by Decree 1377 of 2013.
6. Your rights and how to use them
If the GDPR applies to you, you can ask for access to your data, correction, deletion, restriction of processing, data portability, and object to processing based on legitimate interests. Where we rely on your consent, you can withdraw it at any time; this doesn’t affect processing before the withdrawal.
Under Colombian Law 1581 of 2012 (art. 8) you can know, update and rectify your data; ask for proof of your authorization; be told how your data has been used; revoke your authorization or ask for deletion; access your data free of charge; and file complaints with the Superintendencia de Industria y Comercio (SIC).
To use any of these rights, e-mail hello@forti8.io. Tell us what you want and how to reach you; we may ask you to confirm your identity.
- GDPR requests: we answer within one month. For complex requests this can be extended by two more months; we will tell you why.
- Colombia — queries (consultas): answered within 10 business days, extendable by 5 business days with an explanation (Law 1581, art. 14).
- Colombia — complaints (reclamos) to correct, update or delete data: answered within 15 business days from the day after we receive the complete complaint, extendable by 8 business days with an explanation (Law 1581, art. 15).
You can also complain to a data protection authority: in the EU, the authority where you live or work — in Belgium the Data Protection Authority (opens in a new tab) — and in Colombia the Superintendencia de Industria y Comercio (opens in a new tab).
7. Security
The site is served over HTTPS. Access keys stay on our servers and never reach the browser. CVs and job descriptions from the demos are not written to a database. Form data is stored in a database that the public cannot read, and abuse counters use a salted one-way hash instead of your IP address.
8. If a recruiter uploaded your CV
Recruiters can try the CV demo with a candidate’s CV only if they are allowed to share it. We don’t keep that CV. If you think your CV was used without permission, contact the recruiter and tell us at hello@forti8.io.
9. Children
jennyhires.com is meant for professionals. It is not intended for children, and we don’t knowingly collect their data.
10. The Jenny app (jennyos.com)
In the Jenny app, recruitment agencies manage their own candidates, clients and vacancies. The agency is the controller of that data; Forti8 processes it on the agency’s behalf and under its instructions, as set out in our agreement with the agency. Candidates who want to use their rights should contact the agency first; we will help the agency respond.
11. Changes and validity
This policy takes effect on 16 October 2026 (version 2.0). Before we make a substantial change, we will publish the new version here with its date and, where we have your e-mail address from a form, tell you about it.
Our form database is kept for as long as we offer Jenny; individual records are deleted as described in section 2.
Earlier version: the privacy notice published on 14 October 2026.