GDPR & CCPA

Neuroscale Inc. ("Neuroscale," "we," "us," or "our") builds Arbi, an AI-powered recruiting platform used to source candidates, run AI-assisted screening and ranking, automate outreach, and streamline hiring workflows for organizations. Protecting personal data processed through Arbi—whether from candidates, employees of our customers, or recruiters—is central to how we design and operate our services.

This page summarizes how we approach compliance with the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). It is a high-level overview and does not replace our Privacy Policy, data processing agreements, or product-specific terms agreed with your organization.

Where the GDPR applies, we process personal data in line with its principles: lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability.

Depending on the relationship, Neuroscale may act as a controller for certain account, billing, and platform analytics data, and as a processor (or subprocessor) for candidate and recruitment data that our customers instruct us to process on their behalf through Arbi. When we act as a processor, our customers typically determine the purposes and means of processing; we process such data only under their instructions and applicable agreements.

We document processing activities, apply technical and organizational measures appropriate to AI recruiting workloads (including access controls, encryption in transit where supported, and subprocessors vetted for security), and support our customers in meeting their own GDPR obligations for candidate data.

Our Data Protection Officer can be reached at [email protected] for GDPR-related inquiries as described below.

If the GDPR applies to our processing of your personal data, you may have the right to:

• Access — obtain confirmation of whether we process your data and receive a copy of certain information.
• Rectification — request correction of inaccurate personal data.
• Erasure ("right to be forgotten") — request deletion where grounds under Article 17 GDPR apply (for example, when data is no longer needed or you withdraw consent where consent was the sole legal basis).
• Data portability — receive personal data you provided in a structured, commonly used format, where processing is based on consent or contract and is carried out by automated means.
• Restriction of processing — request that we limit processing in specific circumstances.
• Object — object to processing based on legitimate interests or for direct marketing, where applicable.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of processing before withdrawal.

For candidate data processed on behalf of a hiring organization, we may need to refer your request to that organization when they are the controller. You can contact us at [email protected] or [email protected] and we will guide the request as appropriate.

For California residents, the CCPA/CPRA provides a framework for transparency and control over personal information. We describe our collection, use, and disclosure practices in our Privacy Policy and honor applicable consumer rights requests.

Arbi processes categories of information common in recruiting—such as identifiers, professional and employment information, internet or network activity, and inferences from AI screening features—when provided by candidates, imported from integrations, or entered by recruiters. We use this information to deliver recruitment automation, analytics, and product functionality contracted by our business customers.

California residents may have the right to:

• Know — request information about the categories and specific pieces of personal information we collect, the sources, business or commercial purposes, and categories of third parties with whom we share personal information.
• Delete — request deletion of personal information we collected, subject to legal exceptions.
• Opt-out of sale/sharing — opt out of the sale or sharing of personal information, and limit certain uses of sensitive personal information, where applicable.
• Non-discrimination — not receive discriminatory treatment for exercising these rights.
• Correction — request correction of inaccurate personal information, where applicable under the CPRA.

See our Do Not Sell My Personal Information page for opt-out details. Submit other requests via [email protected] or the privacy request options we provide.

The following illustrates typical processing in Arbi and common legal bases under the GDPR (exact roles and bases depend on your situation and contractual terms):

• Recruiter and customer accounts — account setup, authentication, billing, and support. Legal bases may include: contract (Article 6(1)(b)) and legitimate interests in operating the service (Article 6(1)(f)).
• Candidate sourcing and outreach — indexing profiles, sending messages, and tracking engagement for recruitment campaigns. Legal bases may include: contract with the customer, legitimate interests of the customer in hiring, or consent where required and obtained by the customer or us as appropriate.
• AI screening and ranking — analyzing résumés, answers, or structured data to surface matches or scores for recruiters. Legal bases may include: contract, legitimate interests (with safeguards and human oversight as configured), or consent where that is the appropriate basis.
• Product improvement and security — aggregated or de-identified analytics, fraud prevention, and service reliability. Legal bases may include: legitimate interests and, where required, consent for non-essential cookies or similar technologies.

Automated decision-making that produces legal or similarly significant effects is addressed in our Privacy Policy and customer agreements; individuals may have rights to human review where the GDPR applies.

Neuroscale may process and store personal data in the United States and other countries where we or our subprocessors operate. When we transfer personal data from the European Economic Area, United Kingdom, or Switzerland to countries not subject to an adequacy decision, we rely on appropriate safeguards such as the EU Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, or other mechanisms approved under applicable law.

We assess transfer impact and supplementary measures as appropriate for the nature of Arbi's processing, including recruitment and AI-related workloads.

For questions about GDPR compliance, international transfers, or data protection matters related to Arbi, you may contact our Data Protection Officer:

Email: [email protected]

If you believe our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority in the EU or UK member state where you live, work, or where an alleged infringement occurred.

We encourage you to contact us first at [email protected] or [email protected] so we can try to resolve your concern.

For general privacy questions or to exercise rights where Neuroscale is the appropriate contact:

• Privacy: [email protected]
• Data Protection Officer: [email protected]

Arbi by Neuroscale — AI recruiting, candidate sourcing, automated screening, and recruitment workflow automation.