Privacy Policy

Gisel supports recruitment professionals in managing CVs, searching for candidates and using artificial intelligence features.

This policy explains how personal data is collected, used, protected and retained as part of Gisel's services, as well as the rights of data subjects.

1What are our commitments regarding your data?

Gisel is committed to protecting the confidentiality of personal data, limiting its use to the intended purposes and implementing appropriate security measures.

The personal data processed as part of our services is not sold to third parties nor used by Gisel to train artificial intelligence models.

Content sent to our artificial intelligence providers is processed as part of the requested features, in accordance with the terms applicable to those services.

2Who is responsible for processing your data?

The customer company, in principle the controller of the data of candidates whose CVs it imports, determines the purposes of their use, their legal basis and their retention periods.

Gisel, as processor, processes candidates' data on behalf of the customer company, in accordance with its documented instructions and the applicable provisions of the General Data Protection Regulation (GDPR).

Gisel, as controller, determines the purposes and means of the processing necessary for the management of user accounts, billing, security and the administration of the platform.

Data processing agreement (DPA). An agreement setting out the respective obligations of the parties must be concluded where the GDPR so requires. It is available from Gisel.

Customer companies remain responsible for informing candidates, determining an appropriate legal basis and respecting their rights.

3Where is your data hosted?

Data hosted by Gisel is stored in France, with OVHcloud.

Exchanges between your browser and the platform are protected by the HTTPS/TLS protocol.

Some external providers, in particular artificial intelligence providers and audience measurement services, may process data outside the European Economic Area. Where such transfers take place, they must be covered by the safeguards provided for by the applicable regulations.

4What data is processed and how long is it kept?

4.1. How does automatic CV filling work?

You can import a CV in PDF format to automatically generate a Word document.

Documents kept. The original PDF and the generated Word document are temporarily kept in your history so that you can view and download them.

Retention period. These documents are automatically deleted after 30 days. You can also delete them at any time before that date.

Artificial intelligence processing. The professional content of the CV is sent to Anthropic via a secure connection so that it can be processed. Separate processing mechanisms are implemented in order to limit the transmission of candidates' direct contact details.

Extended retention. To keep a CV beyond 30 days, you can add it to your CV Library.

4.2. How does AI matching work?

Matching compares a job offer with the profiles available in your CV Library or with temporarily imported CVs.

Job offers. Imported files are deleted after the information needed for matching has been extracted.

Results. Comparison results are displayed during the session and are not saved in the history.

“My own CVs” mode. CVs imported in this mode are used temporarily and are not automatically added to your CV Library.

Confidentiality. Comparisons are limited to your company's profiles and the documents you import. Data from other customer companies is not used.

Content processed as part of matching is not intended for training artificial intelligence models.

4.3. How does the CV Library work?

The CV Library allows customer companies to centralise, organise and find their candidate profiles in a dedicated space.

Data kept. Gisel keeps CVs in PDF format, the extracted information (identity, contact details, skills, professional experience) and the additional information entered by users, in particular the daily rate (TJM), availability, mobility, status and source of the profile.

A search index makes it possible to quickly find candidates.

Artificial intelligence processing. When a CV is imported into the CV Library, its text content may be sent to Anthropic, via a secure connection, in order to extract and structure useful information. This content may include the candidate's personal data.

Separation of customer spaces. Each company has a dedicated space, with separate storage and search index. Searches and consultations are limited to the data that users are authorised to access.

Data management. Authorised users can view, edit, annotate or delete profiles. Their deletion removes them from the relevant active systems. Any backups may follow separate retention cycles.

Retention period. CVs are kept until they are deleted by the customer company or until the end of the contract. In the event of termination, the company's dedicated space is deleted within 30 days, subject to legally justified exceptions.

The customer company remains responsible for defining the retention periods of applications. As a guide, the CNIL generally recommends not keeping the data of an unsuccessful candidate for more than two years after the last contact, unless specifically justified.

4.4. What data is processed to manage your account?

Gisel processes the information necessary for the creation and management of professional accounts, in particular users' contact details, information about their company, their access permissions and the data necessary for managing the subscription.

Login information and certain technical data are also used to secure accounts and prevent abusive use.

Data necessary for billing and contract management may be kept for the periods required by applicable legal obligations.

5How do we protect your data?

Gisel implements technical and organisational measures designed to protect personal data against unauthorised access, misuse and the risk of disclosure.

Account protection. Passwords stored in hashed form, email address verification and anti-bot protection.

Connection security. Encrypted communications, secure session cookies and protections against certain cyberattacks.

Abuse prevention. Limits on attempts for sensitive features, in particular login and password reset.

Access control. Permissions defined according to user roles and protected team invitations.

Security monitoring. Retention of the last login date and the last two IP addresses associated with the account in order to detect suspicious access.

Payment security. Payments are processed by Stripe. Gisel does not keep full card numbers.

These measures aim to reduce the risks linked to the processing of personal data, without being able to guarantee the complete absence of incidents.

6Who can access your data at Gisel?

Access to customer companies' data is limited to authorised persons within Gisel, only where necessary to provide technical support, platform maintenance or incident resolution.

These accesses are controlled in order to preserve the confidentiality and security of the information processed.

7Which providers do we share data with?

Gisel uses specialised providers to operate and secure its services.

• OVHcloud: hosting of the platform and data.
• Anthropic: processing of certain CV and job offer content using artificial intelligence.
• Stripe: payment processing.
• Cloudflare: protection against bots and certain abusive uses.
• Google Analytics: audience measurement of the site, depending on the applicable consent preferences.
• LinkedIn: measurement of marketing campaign performance, depending on the applicable consent preferences.

The data shared with these providers is limited to what is necessary for their services, depending on the features used.

Where personal data is transferred outside the European Economic Area, such transfers must rely on mechanisms recognised by the applicable regulations.

7.1. How do we use cookies?

Gisel uses cookies and similar technologies to ensure the operation of the platform, secure connections and measure the use of its services.

Necessary cookies. They notably make it possible to maintain user sessions, secure connections and ensure the operation of essential services. When they are strictly necessary, they do not require prior consent.

Audience measurement and marketing cookies. With your consent, Gisel uses Google Analytics and LinkedIn to analyse site traffic and measure the effectiveness of its campaigns.

Data confidentiality. Gisel does not knowingly send CV content or account data to Google Analytics or LinkedIn as part of these measurement tools.

Consent management. On your first visit, you can accept or refuse optional cookies from the consent banner. Each choice, whether an acceptance or a refusal, is kept for six (6) months. When this period expires, Gisel invites you to express your choice again.

You can change your decision at any time using the “Manage cookies” link available on the site.

8How does tracking of emails sent from Gisel work?

Where this feature is enabled and the applicable legal conditions are met, an open indicator may be included in the message.

Information collected. This indicator records the date the message was first opened and the number of openings detected.

Confidentiality. Gisel does not record the IP address or the browser information of the recipient as part of this tracking.

Access to information. The indicators are accessible only to the sender of the message and to the manager of their company.

Reliability of results. These indicators do not constitute proof of reading. Some email services may block or preload images, which may affect the results.

Information for recipients. The emails concerned include a notice informing the recipient of this mechanism. Its use must comply with applicable legal requirements, in particular those relating to consent where it is required.

9What are your rights regarding your personal data?

In accordance with the applicable regulations, you have, depending on your situation, rights of access, rectification, erasure, restriction of processing, objection and portability of your personal data.

Managing your data. You can view, edit or delete certain information directly from your Gisel space, depending on the available features and your permissions.

Candidates' data. If you are a candidate and wish to exercise your rights regarding a CV kept on Gisel, you can contact the company that holds your profile. Gisel assists it, under the applicable conditions, in responding to your request.

Exercising your rights. For any request concerning processing for which Gisel is responsible, you can contact us at the address below. We will respond within the time limits provided for by the applicable regulations.

Data breaches. In the event of an incident affecting personal data, Gisel makes the notifications required by the applicable regulations, depending on its role and the nature of the incident.

You also have the right to lodge a complaint with the competent data protection authority.

10How can you contact us?

For any question about this privacy policy, the security of the platform or the exercise of your rights regarding your personal data, you can contact us:

Email: contact@gisel.io