Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between you (the “Customer”) and RecruitAICopilot, operated by Philip Chua, Singapore (the “Operator”). It governs the Operator’s processing of candidate personal data on the Customer’s behalf, consistent with Singapore’s PDPA.

1. Roles

For candidate personal data, the Customer is the data controller and the Operator is the data intermediary (processor), processing only on the Customer’s documented instructions, which include the Customer’s configuration and use of the Service.

2. Subject matter, nature & purpose

• Subject matter: processing of candidate personal data captured by the Customer from public LinkedIn profiles.
• Purpose:to detect career signals, score candidates against the Customer’s criteria, and draft outreach for the Customer’s review.
• Duration:for the term of the Customer’s subscription, until deletion as described below.

3. Categories of data & data subjects

• Data subjects: prospective candidates whose public LinkedIn profiles the Customer chooses to capture.
• Personal data: public profile information (name, headline, employer, education, location, public posts) and AI-derived outputs (signals, SG/PR likelihood score, recruit-readiness score, drafted messages).

4. Operator obligations

• Process candidate data only on the Customer’s instructions.
• Keep the data confidential and not sell or pool it across customers.
• Apply reasonable technical and organisational security measures.
• Assist the Customer in responding to data-subject access or correction requests it receives.
• Notify the Customer without undue delay on becoming aware of a data breach affecting the Customer’s data.
• Delete or return the data on termination, subject to limited retention required by law.

5. Sub-processors

The Customer authorises the Operator to engage the following sub-processors. The Operator remains responsible for their performance and will give notice of material changes.

• Anthropic — AI inference (United States). Data is processed to return results and is not used for model training.
• Hosting provider — Singapore-region virtual server hosting the application and database.
• Telegram — only where the Customer enables the optional digest feature.

6. International transfers

AI inference occurs in the United States, so some candidate data is transferred outside Singapore. The Operator takes reasonable steps so that the recipient provides a standard of protection comparable to that required under the PDPA.

7. Customer responsibilities

• The Customer warrants it has a lawful basis to capture and process the candidate data it directs the Operator to process.
• The Customer is responsible for responding to data-subject requests as controller, with the Operator’s assistance.

8. Deletion

During the term

The Customer can permanently delete any candidate record at any time from within the Service.

On termination

On request the Operator will export the Customer’s data (CSV) and then delete it, save for limited audit records retained for security or legal reasons.

9. Liability & governing law

Liability under this DPA is subject to the limitations in the Terms of Service. This DPA is governed by the laws of Singapore.

10. Contact

Data protection contact: philipchuaonline@gmail.com.