shrtlst privacy policy
Draft for review. This text is not yet in effect.
Version 0.2 · Draft updated: 13 October 2026
This is our beta privacy policy. Review by legal counsel is pending.
This policy explains how Scicolone Consulting FZ-LLC handles personal data when you use shrtlst. Scicolone Consulting FZ-LLC is a free zone limited liability company registered with the Ras Al Khaimah Economic Zone under number 0000004092258, services licence 47034656, at FDBC1714, Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates (“shrtlst”, “we”, “us”).
shrtlst is a business tool for recruiters and headhunters. You add a candidate, by CV or by speaking a brief, and shrtlst returns companies in the GCC that may fit them. Each company is checked on its official website. You decide what to do next. shrtlst never contacts companies or people.
Questions and requests: privacy@shrtlst.app.
1. Who we are and our two roles
We have two roles, depending on whose data it is.
- For candidate information, we act for you. The agency or recruiter who adds a candidate decides why and how that candidate’s information is used. They are the controller. We are their processor and handle it only to provide shrtlst, under our Data Processing Addendum and your instructions. If your agency itself acts for a client, we act as its sub-processor.
- For your account, we decide. We are the controller for the information we need to run shrtlst for you: your account, workspace membership, invitations, security records and usage events.
The legal role depends on what actually happens with the data, not on the label in this policy.
2. Information we handle
| What | Examples | Where it comes from |
|---|---|---|
| Account | Email address, password (stored only as a hash), display name, session | You |
| Workspace | Workspace name, members, roles, who can read each candidate | You and your workspace owner |
| Invitations | The email address invited, when the invitation expires or is accepted | The workspace owner |
| Candidate information | The original CV and attachments, their extracted text, a public LinkedIn page if you give us the link, your context and notes, the brief, the candidate’s name as you enter it | You |
| Talk | Your spoken and typed answers, sent to our AI provider to transcribe the recordings and understand the brief; the transcript while the brief is created; the brief and the short quotes that support it | You |
| Your consent record | That you confirmed you’re authorised to process the candidate’s information, when, and for what purpose | You |
| Search results and decisions | Companies found, fit reasons, your decisions, pipeline statuses and notes | shrtlst and you |
| Usage events | Pseudonymous events, such as when a search finishes, with the date but not the time. Only the shrtlst founders can link them back to your account, to see usage per person (section 3) | Your use of shrtlst |
| Feedback | What you write when you leave feedback for a free run, its topic, and who wrote it. Only the shrtlst founders read it | You |
| Referrals | When you request access through another headhunter’s link: who put you forward (“referred by”) and, once you confirm at sign-up that they did, how far you got (joined, searching, first search finished). Until you confirm, the headhunter who put you forward sees nothing about you; if you answer no, the link to them is cancelled. After you confirm they see only your first name and initial and that status, never your email or your searches. If you share your own link: your first name and initial are shown to anyone who opens it; your list shows the people you put forward who confirmed, with that status; and the founders see how many people you put forward, with your name and email | You and the headhunter who shared the link |
| Help questions | What you ask Ask shrtlst, the in-app help assistant, with the last few turns of the conversation, the page you are on, the share of credits left and your browser language. Sent to our AI provider to answer and not stored by shrtlst; the conversation stays in your browser tab | You |
| Reported problems | What you send to the team with “Flag an issue” or “Report a problem” in Ask shrtlst (you can edit it first), the page it was sent from, and your name and email. Only the shrtlst founders read it | You |
| Security and cost records | Short-lived tokens for Talk; the AI calls each workspace makes, what they cost and which member made them | Your use of shrtlst |
| Founder notes | Notes the shrtlst founders write about a workspace or a member, for support and pricing. Only the founders read them | shrtlst |
Company information comes from public company websites and public reference sources. It is about companies, not people.
Don’t add information you don’t need. CVs often contain more than a search needs. Don’t add sensitive information, such as health, religion, ethnicity, political views, or identity or passport numbers. Don’t add information about children.
3. Why we use it and on what basis
Where we are controller, we use personal data to:
- create and run your account and workspace, and sign you in (performance of our contract with you or your agency);
- keep shrtlst secure, limit costs and prevent abuse (our legitimate interests and legal obligations);
- record pseudonymous usage events to improve shrtlst (our legitimate interests);
- read the feedback you choose to leave, to improve shrtlst and to follow up with you about it (our legitimate interests);
- answer your questions in Ask shrtlst, and read and fix the problems you report from it (performance of our contract with you or your agency);
- let the shrtlst founders see usage and cost per workspace and per person, with your name and email, to give support, spot problems and set prices (our legitimate interests). This view is limited to the founders and never shows candidate information. The founders may export it to a spreadsheet, which they keep only as long as they need it for that purpose. Your workspace owner sees what the workspace spends, not who made each call;
- show your workspace owner, on the Dashboard’s Team tab, your activity totals for a period: how many candidates you own, searches, companies reviewed, pitched, replied, interviews, offers, placements and the share of the workspace’s credits your searches used. These are counts only, including for candidates you haven’t shared, and never show a candidate’s or a company’s name (performance of our contract with your agency, and its legitimate interest in managing its team) ;
- answer support and privacy requests (contract and legal obligations);
- send the service emails you need: a code to confirm your email address, password reset links, “You’re in” when your access is approved, and, if you put a headhunter forward, one email when your free run lands (contract);
- tell the founders by email about what you send them: an access request, a top-up request, feedback or a flagged issue, with your name, email, workspace name and the text you wrote (our legitimate interests).
We don’t send marketing email from shrtlst and we don’t use advertising or analytics cookies.
Where we are processor, your agency decides the legal basis for processing candidate information. Before you add a candidate, you confirm: “I’m authorised to process this candidate’s information for business development research.”
4. How AI is used
shrtlst uses AI models from a provider we name in our sub-processor list to:
- read the CV, attachments and your context, and write the brief;
- in Talk, transcribe each recording, read your spoken and typed answers to understand the brief, and, when available, write and speak the follow-up questions with an AI voice (otherwise Talk plays recordings we reviewed);
- suggest companies and explain why each one may fit, using the brief;
- answer questions about using shrtlst in Ask shrtlst, the in-app help assistant. It answers only from our own description of the product and isn’t given candidate or company information: don’t paste candidate details into it, because whatever you type is sent to the AI provider with your question. We don’t store the questions or answers.
AI suggests and you decide. Fit reasons are inferences, and we label them as such. shrtlst doesn’t decide anything about the candidate. It suggests companies, and you decide whether to approach them.
No training. We don’t use candidate information or your content to train our models, any shared model or the provider’s models. We don’t opt your data into any provider training programme.
Not anonymous. The brief describes a real person, so we never call it anonymised. It is kept separate from company searches. Searches look up companies, not the candidate.
What the provider keeps. We ask the provider not to store our requests. Its terms still let it keep what it receives for up to 30 days to detect abuse. It also receives a hashed identifier of your account for the same reason.
5. What shrtlst doesn’t do
- shrtlst never contacts companies or people, and never sends a candidate’s CV, name or details to anyone.
- The pitch shrtlst writes doesn’t name the candidate. You copy it into your own tools and decide if and when to share it.
- Companies receive nothing about the candidate. To check a company, shrtlst reads its public website directly.
- We don’t sell personal data and don’t use it for advertising.
6. Who receives data
We share personal data only with:
- service providers that run shrtlst for us: hosting and application servers, database, authentication and file storage, AI models, and email (which carries the emails listed in section 3, including the text of feedback and flagged issues, names and workspace names). They process data only on our instructions and under data protection terms. Our sub-processor list names each one, what it does and where. We update the list before we add or replace a provider;
- people in your workspace you give access to a candidate;
- professional advisers under a duty of confidentiality;
- a buyer or successor if our business is sold or reorganised, with the same protections;
- authorities, where the law requires it or to protect rights and safety.
7. International transfers
We operate from the United Arab Emirates. Our database and file storage are in the European Union (Frankfurt, Germany). Application-server locations are still being confirmed. Our AI provider processes data in the United States.
When data leaves the country it came from, we rely on a mechanism the law allows, such as an adequacy decision, standard contractual clauses (including those issued by the Saudi Data & AI Authority for transfers from Saudi Arabia) or another permitted basis.
8. How long we keep it
| Information | How long |
|---|---|
| Candidate record: brief, extracted text, searches, decisions, statuses, notes | Until someone allowed to delete the candidate does so, or until the workspace is closed |
| Original CV file | Deleted together with the candidate |
| Talk audio | shrtlst doesn’t keep it. Each recording is sent for transcription and then discarded. The AI provider may keep it for up to 30 days (see section 4) |
| Talk transcript and typed answers | Kept only while the brief is created. The candidate record then keeps the brief and its supporting quotes |
| AI voice for questions | Streamed to you and not saved |
| Usage events | 180 days |
| Founder notes | Until a founder deletes them. Notes attached to you are deleted with your account, notes attached to a workspace with the workspace. If you ask us to delete your data, we also search the other notes for you and remove what mentions you |
| Help questions | shrtlst doesn’t keep them: each question is sent to the AI provider to answer, then discarded. The conversation lives in your browser tab until you close or reload it. The AI provider may keep what it receives for up to 30 days (see section 4) |
| Reported problems | Deleted 90 days after the founders mark the problem dealt with; one still open is deleted 90 days after you sent it. Deleting your account deletes them at once. The copy each founder received by email is kept until we delete it on request |
| Feedback | Until you ask us to delete it. If your account is deleted, the feedback stays in shrtlst without your name or email, linked only to the workspace; the copy each founder received by email keeps your name and email until we delete it on request |
| Invitations | Until the workspace is deleted |
| Former members | When someone leaves a workspace, their name and the date they left, so the owner can hand over their candidates (“Omar H. left on 3 Oct”). Kept until the workspace is deleted, or until that person’s account is deleted |
| Referrals | With the access request they belong to. If the person who was put forward deletes their account, their referral is deleted; a free run that already landed stays for the monthly limit, without their name. If the headhunter who shared the link deletes theirs, their name is removed from every referral and any referral still waiting is cancelled |
| Account | Until you or your workspace owner ask us to delete it |
| AI cost records | Kept for accounting. They contain no candidate information. If your account is deleted, they stay with the workspace without your name |
| Backups | Backup retention is still being confirmed; contact us for details |
To delete a candidate, open their profile and choose Delete. To delete your account or a workspace, write to us from the app (Help → Report a problem) or reply to any email from shrtlst using the account’s address. We delete within 30 days, apart from copies in backups, which expire as stated above, and records the law requires us to keep.
9. Security
We protect data with:
- workspace separation enforced in the database;
- private file storage, readable only by the people allowed to see the candidate;
- encryption in transit, and at rest by our database provider;
- pseudonymous usage events (an HMAC of the user, never the raw identifier);
- limits on AI usage per workspace.
No measure is perfect, and this isn’t a certification.
If a breach affects candidate information, we tell the agency without undue delay so it can meet its own duties.
10. Your rights
Depending on where you are, you may have the right to:
- access, correct or delete your data;
- restrict or object to processing;
- receive a copy in a portable format;
- withdraw consent;
- complain to a data protection authority.
If you’re a recruiter using shrtlst, write to us from the app (Help → Report a problem) or reply to any email from shrtlst. We reply within 30 days and may ask you to confirm your identity.
If you’re a candidate, the agency or recruiter who added you controls your information. Contact them first. If you write to us, we pass your request to them and help them answer it.
11. Cookies
shrtlst uses only the cookies and browser storage it needs to work. None of them track you or come from third parties, so shrtlst doesn’t ask for cookie consent. If we ever add an optional cookie, we’ll ask first and list it here. You can see this list at any time from “Cookie settings”.
| Name | Type | Why | How long |
|---|---|---|---|
Sign-in session (sb-…-auth-token) | Cookie | Keeps you signed in | The browser session, or 30 days if you choose “Keep me signed in” |
shrtlst-remember | Cookie | Remembers that you chose to stay signed in | 30 days |
shrtlst-theme | Cookie | Remembers light or dark mode | 1 year |
shrtlst_ref | Cookie | Remembers the headhunter’s referral link you arrived through, including when you return later to request access | 30 days |
| Active workspace and library view | Browser storage | Reopens shrtlst where you left it | Until you clear your browser data |
Usage events (section 2) are recorded on our servers when you take an action. They don’t use cookies.
12. Business use only
shrtlst is for professionals aged 18 or over, acting for a business. It isn’t offered to consumers or children.
13. Changes and contact
We show the version and date at the top of this policy. We tell workspace owners about material changes before they take effect.
Privacy contact: privacy@shrtlst.app.
Scicolone Consulting FZ-LLC, FDBC1714, Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates.
You can also complain to the data protection authority where you live.