Privacy Policy

Shortlists (“we”, “us”, “our”) operates the Shortlists platform at shortlists.io. This policy explains how we collect, use, and protect personal data when you use our service. We are committed to GDPR compliance and privacy by design.

1. Who we are

Shortlists is the data controller for personal data processed through our platform. Our servers are hosted in the EU (Stockholm, Sweden). We do not transfer personal data outside the EEA without appropriate safeguards in place.

2. What data we collect

Account data

When you create a Shortlists account, we collect your name, email address, company name, and payment information (processed securely via Stripe — we never store card details).

Candidate and client data you add to Shortlists

You are the data controller for any candidate, client, or contact data you enter into Shortlists. We process this data on your behalf as a data processor, under the terms of our Data Processing Agreement.

Usage data

We collect anonymised usage analytics to improve the product — pages visited, features used, error reports. We do not sell or share this data with third parties.

3. How we use your data

• To provide and improve the Shortlists service
• To send transactional emails (account setup, invoices, feature announcements)
• To respond to support requests
• To comply with legal obligations

We do not use your data to train AI models. We do not sell data to third parties.

4. Data retention

We retain your account data for as long as your account is active. When you cancel, your data is retained for 30 days (so you can export it) and then deleted. You can request immediate deletion at any time by contacting hi@shortlists.io.

5. Your rights under GDPR

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Object to processing of your data
• Export your data in a portable format
• Withdraw consent at any time

To exercise any of these rights, contact us at hi@shortlists.io.

6. Cookies

We use essential cookies required for the platform to function, and anonymised analytics cookies to understand usage. We do not use advertising or tracking cookies.

7. Third-party services

Shortlists integrates with third-party services including Zoom, Microsoft Teams, Google Meet, Stripe, Twilio, and Meta/Facebook. Each has their own privacy policy governing their data processing.

Facebook / Meta Lead Ads

If you connect a Facebook Page to Shortlists, we use Meta’s Graph API to receive the leads submitted through that Page’s lead ad forms. For each lead we collect the information the person provided — typically their name, email, phone number, and answers to the recruiter’s questions — and use it solely to create a candidate record in your workspace so the recruiter can follow up with the person who expressed interest. We do not sell or share this data or use it for any other purpose. You can disconnect a Page at any time in Settings → Integrations, which removes our access and stops further imports. To request deletion of data obtained via Meta, disconnect the Page or email privacy@shortlists.io; we also honour Meta’s data-deletion callback. Lead data is retained for as long as the candidate record exists in your workspace.

8. SMS messaging

Recruiters using Shortlists can send text messages to candidates and client contacts from a phone number belonging to their agency. Messages are sent through Twilio, our messaging provider, and are one-to-one messages between a recruiter and a person they already have a working relationship with.

Mobile information and messaging consent are not shared with third parties or affiliates for marketing or promotional purposes. Mobile numbers are shared only with our messaging provider, for the sole purpose of delivering the messages a recruiter sends, and with the mobile network carrying them. They are never sold.

Consent is recorded in Shortlists before any message can be sent — the person gave their mobile number to the recruiter during a recruitment process, or texted the recruiter’s number first — and the product will not send without it. A recipient can stop messages at any time by replying STOP (or UNSUBSCRIBE, CANCEL, END or QUIT), which blocks any further messages to that number immediately; replying START or YES resumes them. Replying HELP returns information about the messages and how to stop them. Message frequency varies, and message and data rates may apply.

The messages themselves, and their delivery receipts, are stored in the recruiter’s workspace as part of the conversation history, and are deleted when that history is deleted. To request deletion of your number or your messages, contact the recruiter who messaged you, or email privacy@shortlists.io.

9. Contact

For privacy questions or to exercise your data rights, contact us at hi@shortlists.io.