Privacy Policy
This policy explains what data Qcandidate collects, why, how long we keep it, and the rights you have over it.
Last updated September 2026
Who we are
Qcandidate is an AI CV screening and hiring platform operated by Loomee Group (Pty) Ltd, a company registered in South Africa. For our own customer and website data we are the data controller. For candidate data uploaded by an employer, that employer is the controller and we act as their processor.
Data we collect
Account data (name, work email, company, role); billing data processed by Lemon Squeezy (we never see full card numbers); candidate data submitted by employers or applicants (CV contents, contact details, application answers); product usage and audit logs; and support correspondence.
Why we process it
To provide screening, ranking, explainability reports and Growth Kit recommendations; to run billing and support; to keep the service secure; and to meet legal and audit obligations. Our lawful bases are contract performance, legitimate interests and, where required, consent.
AI processing
CV text is sent to our AI model provider to extract skills and score against the employer's rubric. We do not use candidate data to train third-party foundation models. Every score is accompanied by an evidence trail so decisions can be explained and contested.
Sub-processors
Cloud hosting and database infrastructure, our AI model gateway, Lemon Squeezy (payments and tax) and our email delivery provider. Each is bound by data-protection terms.
Retention
Candidate data is retained for as long as the employer's account requires it, and deleted within 30 days of an employer's deletion request or account closure. Audit logs required for bias-audit compliance may be kept in anonymised form.
International transfers
We operate globally. Where data leaves your region we rely on Standard Contractual Clauses or an equivalent transfer mechanism.
Your rights
You may request access, correction, deletion, restriction, portability, or object to processing. Candidates should contact the employer who received their application first; we will assist that employer promptly. You may also complain to your local supervisory authority.
Security
Encryption in transit, row-level access controls, role-based permissions, scoped candidate portal tokens with expiry, and automated security scanning in our release pipeline.
Cookies
We use only essential cookies for sign-in sessions and product preferences. No advertising trackers.
Contact
Privacy requests: p.sweleni@loomeeremote.com.