Privacy Policy

1. Information We Collect

(a) Information you provide

Account and profile details (name, work email, company, role), billing information, communications with us (support requests, feedback), and content you submit through the Service, such as job descriptions and hiring criteria.

(b) Slack workspace data

When your team installs the Pluk app, we process the Slack data needed to operate the Service: messages (including message edit history), reactions, and interactions in channels or conversations where the Pluk app is present, along with workspace, channel, and user identifiers. We also collect the name, email address, and Slack user ID of each workspace member so that when someone from your organization signs up for Pluk, we can automatically associate their account with your organization. The Pluk app can create channels in your workspace as part of its workflows. It does not join existing channels on its own: we process content in a channel only if the Pluk app created that channel or a workspace member explicitly added the app to it. Chatting with and using the Pluk app requires a Pluk account, as does connecting a professional network account or sending outreach from one.

(c) Connected professional network account data

Connecting a professional network account is voluntary and can only be done by the individual User who holds the account. When a User chooses to connect an account on a third-party professional networking platform to the Service (through a third-party account integration provider), that connection authorizes Pluk to access the account to: retrieve the User's first-degree connections; perform searches through the account, including automated searches run on the User's behalf to identify candidates and second-degree connections between the team's network and candidates; and access recruiting message threads with candidates surfaced by the Service. We store the profile and network information retrieved this way, meaning profile information as it appears on the platform (including name, photo, headline, current and past roles, education, skills, location, profile URL, and public posts and activity) along with first- and second-degree connection relationships, to build and maintain a map of the team's professional network. To track recruiting outreach and replies, we read recruiting message threads with candidates surfaced by the Service; we do not access or store message history in the connected account other than those recruiting threads. Messages and connection requests of any type are sent from a User's account only with that User's approval.

(d) Third-party and public data

We license professional profile data from third-party data providers to identify and enrich candidate profiles: names, employment history, education, skills, locations, contact information (including work and, where available, personal email addresses), estimated compensation ranges, and other profile information, which may include profile photos, links to public accounts, and public posts or activity. We also research candidates using publicly available sources — including web and AI-assisted searches — and store what we find with the candidate's profile. This can include professional accomplishments, publications, talks, projects, news mentions, and other public web content, and is used to evaluate candidate fit and inform outreach. To keep candidate profiles current, we also subscribe to ongoing updates from our data providers: when a provider reports a change to a candidate's professional information (such as a job change), we refresh the stored profile, and the change may be surfaced to hiring teams using the Service.

(e) Automatically collected data

Usage data (features used, actions taken), device and log data (IP address, browser type, timestamps), and cookies or similar technologies on our website. See Section 8 for cookie details.

(f) Optional contacts, inbox, and calendar connection

Pluk predicts which of a User's professional network connections they actually know, and shows those people as "likely known" until the User confirms. A User can choose to let Pluk check their contacts and calendar, or their Outlook mail and calendar, to improve these predictions. This is optional, happens only when the User starts it, and can be skipped: Pluk still makes predictions from public profile information without it. A User can connect a Google account (Google Contacts and Google Calendar) or run the check with the Microsoft account (Outlook mail and calendar) they use to sign in to Pluk. Pluk reads only the following:

• Google contacts. The names and email addresses of the User's saved Google contacts, and of their Google "Other contacts" (people Google saved because the User emailed them). Pluk does not access Gmail and never reads email messages from a Google account.
• Outlook email headers, never message bodies. Pluk reads the sender and recipient fields (the From, To, and Cc names and email addresses) of up to the 2,000 most recent messages in the Outlook inbox and up to the 2,000 most recent in sent items. It never reads or stores message bodies, subject lines, or attachments.
• Calendar events. For events from up to two years ago through up to 30 days ahead, in Google Calendar or the Outlook calendar: the event title, start time, the organizer and attendees (names and email addresses), and whether the User declined. Pluk does not read event descriptions, locations, notes, or attachments.

The User can untick any of the Google permissions on Google's consent screen, and the check uses only what they allow.

Pluk compares these names and addresses with the people on the User's list. Everything read from the contacts, mailbox, and calendar is discarded when the check ends, except for the following: for each person on the list that the check matched, Pluk keeps the reason for its prediction, which can include up to two of that person's email addresses and the title of one meeting the User and that person were both invited to (for example, "In meetings together: Weekly sync (name@example.com)"). Pluk also keeps which mailbox was checked, when, and how many people were found. These reasons are shown only to the User in their own Pluk list. They are not shared with other Users, our data providers, or our AI model providers, are not used for advertising, and are not returned to AI assistants through the Pluk connector (Section 11).

Access and tokens. Google access is granted read-only through Google's own consent screen. Pluk revokes the Google access tokens at Google, and deletes them, at the end of each check, so each check is a one-time grant; a later check asks the User again. The Outlook check uses the access the User granted when signing in to Pluk with Microsoft; Pluk does not revoke that sign-in access when the check ends, and the User can remove it at any time in their Microsoft account settings. A User can also remove Pluk's access at any time in their Google account settings.

How long we keep it and how to delete it. The reasons described above are kept for as long as the person stays on the User's Pluk list, and are deleted with the account as described in Section 7. A User can ask us to delete the reasons that came from their contacts, email, and calendar at any time, without closing their account, by emailing privacy@pluk.ai from the address on their Pluk account.

2. How We Use Information

We use personal information to:

• Provide the Service: surface candidates, evaluate candidate fit against a Customer's job criteria, build and maintain a map of a Customer's team network (including by running searches through connected professional network accounts), display how candidates are connected to a Customer's team (such as second-degree connections), generate and send approved outreach (including messages sent from a connected account on a User's behalf with their approval), track and summarize replies, and operate the web dashboard and Slack-based workflows and notifications;
• Set up and manage accounts, process payments (including billing subscription and seat fees), and provide support;
• Improve, secure, and troubleshoot the Service, including monitoring for abuse;
• Communicate with Customers and Users about the Service, including product updates and marketing (with opt-out);
• Comply with law and enforce our agreements.

AI processing. The Service uses large language models to evaluate candidate–role fit, to draft outreach content, and to power the Pluk assistant's conversational features. To give the assistant memory of earlier context, content processed by the Service (such as messages in conversations that include the Pluk app) may be converted into vector embeddings and stored for retrieval. Personal information processed for these purposes is sent to our AI model providers under contracts that prohibit them from using it to train their models. AI outputs are suggestions for our Customers, who make all hiring decisions; Pluk does not make automated decisions that produce legal or similarly significant effects about Candidates.

We do not sell personal information for money, and we do not use candidate personal information for advertising.

3. How We Share Information

We share personal information only with:

• Service providers that help us operate the Service — cloud hosting, account integration, identity and authentication, AI model providers, email delivery, payment processing and invoicing, analytics and product monitoring (including session replay of use of our web application), and customer support tools — under contracts limiting their use of the data to providing services to us. A current list of our sub-processors is maintained at pluk.ai/subprocessors.
• Customers and their Users — Candidate profiles, fit evaluations, and network connection information are shared with the Customer whose Users are searching, and the Service may show a User which members of their team are connected to a Candidate.
• Data providers and search services — as needed to operate licensing arrangements and to look up, match, and refresh candidate and network profiles. Queries we send them can include candidate names and employers, and profile identifiers (such as profile URLs) from connected accounts, so that profiles can be matched and kept current. Our profile data provider, CoreSignal, receives the search filters used in network searches (such as employers, job titles, schools, and locations) together with profile identifiers of people on the searching User's list. We do not share Slack message content, or email and calendar information, with data providers.
• Legal and safety — when required by law, legal process, or to protect the rights, safety, or property of Pluk, our users, or others.
• Corporate transactions — in connection with a merger, acquisition, financing, or sale of assets, subject to this policy.

4. If You Are a Candidate

Your professional information may appear in Pluk because someone on a hiring team is connected to you professionally, or because your public professional profile is included in datasets we license from third-party providers. Here is what that means:

• What we have: your professional profile information as it appears publicly or to your connections — such as your name, photo, headline, current and past roles, education, skills, location, profile links, and public posts or activity — along with contact information obtained from our data providers (including work and, where available, personal email addresses), estimated compensation ranges, and whether you are a first- or second-degree connection of someone on a hiring team using Pluk. We receive ongoing updates from our data providers so this information stays current, and a hiring team using Pluk may be notified when your professional information changes (such as a job change). If you exchange messages on a professional networking platform with a hiring team member who uses Pluk, those messages may be processed to track the recruiting conversation. We use message data only to support that recruiting outreach, and we do not seek out sensitive categories of information about you or use profile content to infer them.
• Where it came from: professional network data connected by a Pluk user who is connected to you, licensed third-party data providers that aggregate public professional profiles, and public web sources we research, such as news, publications, and personal or company websites.
• How it's used: to assess whether you may be a fit for a specific role a company is hiring for, to show that hiring team how you are connected to their network, and to help that company reach out to you (for example, by message on a professional networking platform or by email). Outreach decisions and hiring decisions are made by the hiring company, not by Pluk.
• Your choices: you can ask what information we hold about you or correct it by emailing privacy@pluk.ai. You can also ask us to delete your information: because we regularly receive data from third-party providers, we handle deletion by removing your stored information and adding you to a suppression list, which is designed to prevent your profile from being re-added when we receive provider data in the future. If you tell a company using Pluk that you don't want to be contacted, you can also ask us directly to exclude you across the Service.

5. Your Rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, and to not be discriminated against for exercising these rights.

• California: under the CCPA/CPRA, you have rights to know, delete, correct, and opt out of "sales" and "sharing" for cross-context behavioral advertising (we do not sell personal information or share it for cross-context behavioral advertising). We do not use or disclose sensitive personal information for purposes requiring a right to limit.
• Other U.S. states: we honor applicable rights under other state privacy laws, such as those in Colorado, Connecticut, Virginia, and Texas.
• EEA, United Kingdom, and Switzerland: see Section 6, which describes your rights and how we process your personal data.

To exercise any right, email privacy@pluk.ai. We will verify your request and respond within the time required by applicable law. You may use an authorized agent where the law permits. If we process your data on behalf of a Customer (as a service provider), we may direct your request to that Customer or forward it to them.

6. Information for Individuals in the EEA, United Kingdom, and Switzerland

This section applies to individuals located in the European Economic Area, the United Kingdom, and Switzerland, and supplements the rest of this policy. Where this section conflicts with other parts of this policy, this section controls for those individuals.

Who is responsible for your data

Pluk is operated by Jobreel, Inc., a Delaware (USA) corporation. Whether we are the controller of your personal data depends on your relationship with us:

• If you are a candidate whose professional information appears in our talent database, or a person who has not interacted with a Pluk customer, Jobreel, Inc. is the controller of that data.
• If you are a user of Pluk through your company, or your data is processed within a customer’s Pluk workspace (for example, you are a member of a Slack workspace where Pluk is installed, or you exchanged recruiting messages with a customer’s team), that company is the controller and we process the data as its processor under a data processing agreement. Requests about that data are best directed to the company; if you contact us, we will forward your request to them.

Our representatives

We have appointed representatives in the EU and the UK, whom you may contact about our processing of your personal data:

• EU representative: Euverify Ltd, Unit 3D, North Point House, North Point Business Park, New Mallow Road, Cork, T23 AT2P, Ireland — gdpr@euverify.com
• UK representative: Euverify Ltd, 3rd Floor, 86–90 Paul Street, London EC2A 4NE, United Kingdom — gdpr@euverify.com

Where we get your data

In addition to data you or your company provide directly, we obtain professional profile information about candidates from third-party data providers that license professional data, and from publicly available professional sources. This information consists of professional details such as name, current and past roles, employer, location, education, skills, and links to public professional profiles. We do not collect or infer special categories of data (such as health, religion, or political opinions) and do not use profile content to infer them.

Why we process your data and our legal bases

• Providing the service to our customers and users: performance of a contract (Article 6(1)(b) GDPR) where you are our user, and our legitimate interests (Article 6(1)(f)) in operating the service where your company is the customer.
• Maintaining our candidate talent database and matching candidates to open roles: our legitimate interests (Article 6(1)(f)) in enabling recruitment based on professional information that individuals have made available in a professional context. We have assessed this interest against candidates’ rights and limit the data to professional information, exclude special categories, and honor objections and deletion requests through the process described below.
• Connecting a user’s professional network account: this happens only if you, as a user, choose to connect your own account. We rely on performance of a contract and your action in initiating the connection; you can disconnect at any time.
• Sending emails about the service: performance of a contract for service emails; consent or legitimate interests (as applicable law requires) for other communications, which you can opt out of at any time.
• Security, fraud prevention, and legal compliance: our legitimate interests in protecting the service, and compliance with legal obligations (Article 6(1)(c)).

Automated processing

Pluk uses AI to help match candidates to roles and to draft outreach suggestions. These outputs are suggestions to our customers’ human users, who make all decisions about whom to contact and any hiring outcomes. We do not make decisions based solely on automated processing that produce legal or similarly significant effects about you.

Your rights

You have the right to request access to, correction of, or deletion of your personal data; to restrict or object to our processing (including, at any time, processing based on our legitimate interests or for direct marketing); to receive a copy of data you provided in a portable format; and to withdraw consent where processing is based on consent. To exercise these rights, email privacy@pluk.ai. Candidates may also request removal from our talent database at any time; when we honor a deletion request, we keep a minimal suppression record so your information is not re-added from our data sources. We respond within one month, and we will not discriminate against you for exercising your rights. We may need to verify your identity before acting on a request.

International transfers

We are based in the United States and store data primarily on Google Cloud Platform in the US, so your personal data is transferred to and processed in the United States and other countries where our sub-processors operate. Where we transfer personal data protected by EU, UK, or Swiss law to countries without an adequacy decision, we rely on appropriate safeguards: European Commission Standard Contractual Clauses (with the UK Addendum for UK data), and, for certain providers, certification under the EU-US Data Privacy Framework and its UK and Swiss extensions. You may request a copy of the relevant safeguards by emailing privacy@pluk.ai.

Retention

We keep personal data only as long as needed for the purposes above. Customer workspace data is deleted within 90 days of the customer relationship ending, as described in our customer agreements. Candidate database records are retained while they remain relevant for recruitment purposes and are refreshed or removed based on our data sources and any objections or deletion requests we receive. Suppression records are kept to honor deletion requests.

Complaints

You have the right to lodge a complaint with your local supervisory authority. In the UK, this is the Information Commissioner’s Office (ico.org.uk); in Switzerland, the Federal Data Protection and Information Commissioner. We would appreciate the chance to address your concern first at privacy@pluk.ai.

7. Data Retention

We keep personal information for as long as needed for the purposes described in this policy: account data for the life of the Customer relationship, and deleted within ninety (90) days after the account is closed; Slack-derived Customer Data for the duration of the Customer relationship or until the Customer deletes it or uninstalls the app, after which it is deleted within 90 days; billing records as required by tax and accounting law; reasons for "likely known" predictions that came from a User's email or calendar (Section 1(f)) for as long as the person stays on the User's list, and deleted with the account or sooner on request to privacy@pluk.ai; and candidate suppression requests indefinitely, so exclusions remain effective. We may retain aggregated or de-identified data that does not identify anyone.

8. Cookies and Analytics

Our website and web application use cookies and similar technologies for sign-in, preferences, analytics, and product monitoring. We use Datadog browser monitoring and session replay across our website (including pluk.ai marketing pages) and our web application, and Vercel Analytics on our website, to measure performance, diagnose issues, and understand how visitors and signed-in users interact with our pages so we can improve the product. Session replay is configured to mask all text and form inputs, including candidate information and anything a user types; recordings capture interface structure and interaction events (such as clicks and navigation), not the content displayed on screen. For visitors in the EEA, United Kingdom, and Switzerland, we ask for consent before enabling these analytics and session replay tools, and you can change your choice at any time via the "Cookie preferences" link in the site footer. Most browsers also let you control cookies through settings. We honor the Global Privacy Control signal where legally required.

9. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and least-privilege practices. No system is completely secure, and we cannot guarantee absolute security. If a breach affecting your personal information occurs, we will notify you and regulators as required by law.

10. Children

The Service is for business use and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact privacy@pluk.ai and we will delete it.

11. Pluk Connector for AI Assistants

Pluk offers a connector, built on the Model Context Protocol (MCP), that lets a User connect their own Pluk list to AI assistants, including Claude (made by Anthropic), ChatGPT (made by OpenAI, where Pluk is offered as a plugin), and other assistants that support connectors. Setup instructions for Claude are at pluk.ai/claude-connector. In every assistant, the connector is available to Users who already have an active Pluk account; nothing is sold through it. This section explains how the connector handles personal information, whichever assistant is connected; the rest of this policy also applies.

(a) What the connector reads

The connector gives the assistant access only to the connecting User's own list: their imported professional network connections and anyone they added. For each person on the list it can read a profile preview (name, profile URL, headline, one current job title and employer, and location), the User's own known and not known answers, Pluk's prediction of whether the User knows the person, and whether the connection is mutual. It can also read summary counts for the list. It does not include the reasons behind Pluk's predictions, so it never returns email or calendar information. The connector does not give the assistant access to other Users' lists, including teammates' lists, or to the User's professional network account, messages, or sign-in credentials.

(b) What the connector can change

At the User's request, the assistant can record whether the User knows a person on their list (known, not known, or clearing the answer), and can add a person the User has met, with a name and, optionally, a profile URL and headline. It cannot delete people from the list, send messages or connection requests, or act on any professional network on the User's behalf. As elsewhere in the Service, marking a person as known does not notify that person or tell them who marked them. If that person is also a Pluk user who has the User on their own list, Pluk may place the User among the people that person is asked to review, without saying why. Only if that person also marks the User as known does the connection become mutual, and Pluk may then let both of them know, including by email, that the connection is mutual.

(c) What Pluk receives from the assistant

Pluk receives only the requests the assistant makes to the connector's tools: which tool was called, the inputs for that call (such as search terms, a person's name, or a profile URL), the access token, and standard request information such as IP address, user agent, and time. Pluk does not receive the User's conversations with the assistant, other messages or files in those conversations, or data from other connectors. Tool inputs are used to answer the request and are not stored, except where the request itself changes the list (for example, a person the User asked to add, or a known status the User asked to record). Our servers keep standard request logs, which do not include tool inputs or search filters, for security and troubleshooting.

(d) Who else receives information

• The User's AI assistant provider. Tool results, including the names and profile previews of people on the User's list, are returned to the assistant the User connected (Anthropic for Claude, OpenAI for ChatGPT) and become part of the User's conversation. That provider handles them under its own terms and privacy policy and the User's agreement with it. Pluk does not control that processing, and the AI model provider contracts described in Section 2 do not cover it.
• Our profile data provider, CoreSignal. When a search filters by work history, education, or location, Pluk sends the search filters (such as employers, job titles, schools, and locations) and the profile URLs or identifiers of people on the User's list to CoreSignal to find which of them match. Pluk may also look up current profile previews for people shown in results. Previews returned this way are stored and reused, as described in Section 1(d).

(e) CSV exports

When the User asks for a CSV export, Pluk creates a download link that expires 7 days after it is created. The link opens a page on pluk.ai and downloads the file only for the signed-in Pluk account that asked for it; anyone else who opens it is asked to sign in and is refused. Until it expires, that account can use the link as many times as it likes. The file is generated each time the link is used and is not stored. Pluk stores only a one-way hash of the link, the account it belongs to, its expiry time, and which rows it covers. Expired link records are deleted when the User creates a new export link, and otherwise with the account as described in Section 7.

(f) Sign-in, access tokens, and revocation

Connecting uses OAuth: the User signs in to Pluk and approves access on a Pluk consent screen, and the assistant receives an access token. The assistant never receives the User's Pluk password or professional network credentials. Pluk stores only a one-way hash of each access token and authorization code, along with a short token prefix, a label naming the assistant, and when the token was created and last used. Pluk also stores the assistant's registration details (its name and sign-in return addresses). When the assistant asks for it with the access token, as ChatGPT does, Pluk tells the assistant the email address on the User's Pluk account, that the address is verified, the User's name if they gave one, and a stable account identifier, so the assistant can show which Pluk account is connected. Authorization codes expire after 10 minutes and can be used only once. Access tokens do not expire on a timer: they remain valid until they are revoked.

A User can disconnect Pluk at any time in their assistant's connector settings. Assistants that support standard OAuth token revocation tell Pluk to revoke the token when the User disconnects. A User can also ask us to revoke access by emailing support@pluk.ai from the address on their Pluk account. A revoked token stops working immediately. Revoking access does not delete the User's Pluk list.

(g) Retention

Changes made through the connector become part of the User's list and are kept as described in Section 7. Hashed access token, authorization code, and assistant registration records, including those for revoked tokens, are kept as security records while the account is open and are deleted with the account as described in Section 7.

12. Google User Data

Your Pluk list can be sorted with a one-time check of your Google contacts and calendar. The check is optional and starts only when you choose to connect a Google account and approve access on Google's consent screen. This section explains how Pluk handles the Google user data it receives; the rest of this policy also applies.

(a) What we access

With your permission, Pluk accesses only:

• The email address of the Google account you connect, so we know which account was checked;
• The names and email addresses of your saved Google contacts;
• The names and email addresses in your Google "Other contacts" (people Google saved because you emailed them);
• From your Google Calendar, the title and date of your events, the names and email addresses of their guests and organizers, and whether you declined the invitation.

You can untick any of these on Google's consent screen, and the check uses only what you allow. Pluk never accesses your email messages, and never reads calendar event descriptions, notes, or attachments.

(b) Why we use it

We use this data only to identify which of the people on your Pluk list (your professional network connections) you already know, for example because you saved them as a contact, emailed them, or met with them, and to show you why we think so. We do not use it for any other purpose.

(c) What we keep

Contacts and calendar data are compared with your list while the check runs and are not stored, apart from the following, which is all we keep:

• For each person on your list that the check matches, the email address that matched them and, when a meeting is the reason, that meeting's title, shown next to their name on your list so you can check our work;
• The email address of the Google account that was checked;
• Counts of how many contacts and meetings the check found, so we can tell you why it found no one.

(d) One-time access

Access is used for a single check. When the check finishes, or if you stop it, Pluk revokes its access with Google and deletes the access tokens. To check again, you approve access again.

(e) Revoking access and deleting data

You can also remove Pluk's access at any time from your Google Account at myaccount.google.com/permissions. To delete the information we kept from a check, email privacy@pluk.ai and we will delete it. If you close your Pluk account, it is deleted with your account data, as described in Section 7.

(f) Limits on use and sharing

• We do not sell Google user data.
• We do not use Google user data for advertising, including personalized, retargeted, or interest-based advertising.
• We do not use Google user data to develop, improve, or train artificial intelligence or machine learning models, including generalized models.
• We do not transfer Google user data to others, except to the hosting and infrastructure providers that run the Service on our behalf, as needed to comply with the law, or as part of a merger, acquisition, or sale of assets with notice to you.
• No person at Pluk reads your Google user data unless you give us permission for specific data, it is needed for security purposes (such as investigating abuse), or it is required to comply with the law.

Pluk's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

13. Changes to This Policy

We may update this policy from time to time. We will post the revised version with an updated date and, for material changes, provide notice through the Service or by email. Continued use of the Service after the effective date constitutes acceptance.

14. Contact Us