Skip to content

Last updated 4 September 2026

Privacy

FunnelIt handles CVs, and a CV is one of the most personal documents a person will ever hand over. This page says plainly what happens to it — who holds it, who else can see it, how long it lives, and how to get it back or have it deleted.

Two different relationships

This matters more than anything else on the page, so it comes first.

  • This website collects nothing. No analytics, no advertising pixels, no cookies. Nothing you do here is recorded. The only way to make contact is a WhatsApp or email link, which you choose to press.
  • The product at app.funnelitai.online holds real candidate data — but it is the recruitment agency using it that decides what to collect and why. In data-protection language the agency is the controller and FunnelIt is the processor. We act on the agency’s instructions. We do not use anybody’s CV for our own purposes.

If you applied for a job and want your data removed, the fastest route is to ask the agency you applied to. You can also write to us at the address below and we will pass it on and act on it.

What the product stores

  • What a candidate submits: name, email address, phone number, years of experience, an optional LinkedIn URL, the CV file itself, and answers to any questions the agency asks.
  • What the AI derives from a CV: a written summary, a match score against the role, skills present and absent, notice period, current and expected salary, and location. This is generated from the CV — nothing is looked up elsewhere.
  • Messages: every email and WhatsApp message sent about an application, whether it was delivered, opened or clicked, and any replies.
  • Interviews: booked times, and a calendar link if the agency has connected a calendar.
  • Agency staff accounts: name, email address, and sign-in records.

We do not ask for, and have no use for, dates of birth, government ID numbers, photographs, health information, or anything about race, religion or politics. If a candidate happens to put such a thing in their own CV it sits in that file untouched and is not extracted into any field.

Who else touches it

These are the only third parties involved, and each does one specific job:

  • Anthropic— reads CV text to produce the summary and score. Under Anthropic’s commercial terms this content is not used to train their models.
  • Resend — delivers the emails to candidates.
  • Meta (WhatsApp Business) — delivers WhatsApp messages, and only to candidates who ticked the opt-in box.
  • Railway — runs the application and stores the database and uploaded CV files.
  • Cloudflare Turnstile — checks the sign-in page is not being hit by a bot.
  • Google Calendar — only if an agency chooses to connect it, to create interview events.

Nothing is sold, rented, or shared with advertisers. There is no data broker in this list and there will not be one.

How long it is kept

Each agency sets its own retention period. When one is set, the system automatically and permanently erases candidate records that have had no activity for that long, and shows the agency exactly how many records are due to go before it happens. Agencies subject to GDPR or India’s DPDP Act typically choose twelve to twenty-four months.

Getting your data out, or deleted

  • Export. An agency can export its entire workspace — candidates, CVs, messages, notes — as JSON or CSV, in one click, at any time. There is no fee and no notice period.
  • Erasure. Any individual candidate record can be permanently erased on request, and every erasure is logged so the agency can prove it honoured the request.
  • Access. A candidate can ask for a copy of everything held about them.

Depending on where you live you may also have the right to correct your data, object to processing, or complain to a data-protection regulator. Nothing here limits those rights.

Security, honestly stated

Traffic is encrypted in transit. Sign-in is by one-time link rather than a password, so there is no password to leak. Each agency’s data is isolated from every other agency’s. Backups run nightly.

What we do not claim: FunnelIt has no SOC 2 report and no ISO certification. It is an early-stage product run by one person. If a compliance certificate is a requirement for you, it is honest to say we do not have one yet.

Where the data lives

The application and its database run on Railway infrastructure. Some of the services above process data in the United States and the European Union, which means personal data may be transferred outside the country a candidate applied from.

Contact

FunnelIt AI Solutions is run by Tushar, who answers these messages personally.

Changes to this page will be reflected in the date at the top. If a change is significant, agencies using the product will be told directly rather than left to notice.

This page is written to be understood rather than to be exhaustive, and it is not legal advice. If you need a signed data-processing agreement for your own compliance, ask and you will get one.