Privacy Policy

The controller responsible for your data is:

iRONic Ventures UG (haftungsbeschränkt)
Essener Str. 13, 10555 Berlin, Germany
Commercial register: HRB 254455 B (Amtsgericht Charlottenburg, Berlin)
Managing Director: Robin Jose
Privacy contact: hello@short-lyst.com

This policy covers personal data processed through short-lyst.com, app.short-lyst.com, and candidate-facing pages linked from Shortlyst emails (for example /c/info, /c/interview, and /c/opt-out). Processing carried out solely on behalf of a recruiting organization may also be governed by that organization's own privacy information; where that applies, we act as a processor and the organization remains responsible for deciding how your application is handled.

Depending on how you interact with Shortlyst, we may process the following categories of personal data:

Recruiters and hiring managers

• Account details such as your name, work email address, and organization affiliation
• Authentication and session information needed to sign in and use the platform
• Content you upload or create, such as job descriptions, screening criteria, and calendar availability

Candidates

• Contact details such as your name, email address, and phone number
• Application materials such as your résumé/CV and answers you provide during screening
• Audio recordings, transcripts, and metadata from AI-assisted screening phone calls or browser interviews
• Scores, summaries, and notes generated to help the hiring team review your application
• Scheduling information when you book or confirm an interview time

Website visitors

• Technical log data such as IP address, browser type, pages visited, and timestamps
• Information you submit through contact or brief forms on short-lyst.com

We use personal data for the following purposes:

• Providing the Shortlyst service, including screening applications, running AI-assisted calls, scoring candidates against agreed criteria, and booking interviews. Legal basis: performance of a contract or steps taken at your request before entering into it (Art. 6(1)(b) GDPR), and, for candidates, our legitimate interest in operating an efficient, fair screening process where permitted (Art. 6(1)(f) GDPR).
• Operating accounts and communications, including authentication, service emails, and responding to support or privacy requests. Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR.
• Security, fraud prevention, and service integrity, including protecting accounts, preventing misuse, and maintaining reliable infrastructure. Legal basis: Art. 6(1)(f) GDPR.
• Legal compliance, including record-keeping and responding to lawful requests. Legal basis: Art. 6(1)(c) GDPR.

When you take part in a Shortlyst screening call by phone or in your browser, the conversation may be recorded and transcribed so the hiring team can review what was said. Shortlyst's AI assistant introduces itself as automated on every call. Recordings and transcripts are used only to evaluate your application for the relevant role and to improve the quality and auditability of the screening process.

You can ask us to delete recordings and transcripts as part of a deletion request under Art. 17 GDPR, subject to any retention we are legally required to maintain.

Résumés, job descriptions, call recordings, transcripts, and related files are stored in Microsoft Azure Blob Storage in EU data centre regions. Access is restricted to authorized personnel and systems that need the data to operate the service.

We use carefully selected service providers who process personal data on our instructions, including:

• Microsoft Azure (Azure OpenAI Service and Azure Blob Storage, in EU regions) for AI analysis features such as résumé scoring and call summaries, and for storing résumés, recordings, transcripts, and related files
• ElevenLabs for real-time voice synthesis, speech recognition, and call infrastructure in AI-assisted screening conversations, with EU data residency
• Hetzner for hosting the Shortlyst application servers and databases in data centres in Germany
• Google (Google Workspace and Google Sign-In) for our business email and for signing in to app.short-lyst.com with a Google account, and Google Calendar where a hiring manager connects it to book interviews
• Resend for delivering transactional emails, such as interview invitations, reminders, and confirmations

If you apply for a role through Shortlyst, your application data, screening results, and related materials are shared with the recruiter and hiring team at the organization running that role. We do not sell candidate data and do not share it with advertisers. We disclose data to processors listed above, or where required by law.

We keep candidate application data for as long as the open role is active and for a defined retention period afterward so the hiring team can complete its process. Unless a shorter period is configured for the recruiting organization, the default retention period is 180 days after the role is marked complete, after which eligible candidate personal data is deleted or irreversibly redacted.

You may request earlier deletion at any time under Art. 17 GDPR by emailing hello@short-lyst.com. We also honour opt-out requests submitted through the link in Shortlyst emails.

Under the GDPR you have the right to:

• Access the personal data we hold about you (Art. 15)
• Correct inaccurate data (Art. 16)
• Request deletion of your data (Art. 17)
• Restrict or object to processing (Art. 18 and Art. 21)
• Receive your data in a portable format (Art. 20)
• Withdraw any consent you have given, at any time

To exercise any of these rights, email hello@short-lyst.com. We will respond within the timeframes required by law.

You also have the right to lodge a complaint with a data protection supervisory authority. Our competent authority is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit). You may also contact the authority in your country of residence.

We use strictly necessary cookies and similar technologies to keep you signed in, remember your language preference, and operate secure sessions. These are required for the service to function and are not used for advertising.

If we introduce analytics or other non-essential cookies in the future, we will update this policy and request your consent where the law requires it.

We primarily process personal data within the European Union. Where a transfer outside the EU or the European Economic Area is unavoidable, we ensure an adequate level of protection through the safeguards required by the GDPR, such as the European Commission's Standard Contractual Clauses and supplementary measures where appropriate.

We may update this policy from time to time. When we make material changes, we will revise the "Last updated" date above and, where appropriate, notify affected users.

For any privacy question or request, contact us at:

iRONic Ventures UG (haftungsbeschränkt)
Essener Str. 13, 10555 Berlin, Germany
hello@short-lyst.com