OnSkillDemand Privacy Policy

Effective date: September 3, 2026

Last reviewed: September 3, 2026

Canonical URL: https://onskilldemand.com/privacy

1. Who We Are

OnSkillDemand is operated by Yurii Kaplunov, a Private Entrepreneur (FOP) registered in Ukraine, doing business as OnSkillDemand ("OnSkillDemand," "we," "us," or "our").

Our contact details are:

• Business address: Heroiv Kharkova Ave, 27, Kharkiv, Ukraine, 61000
• Ukrainian taxpayer registration number (RNOKPP): 3137906152
• Email: support@onskilldemand.com
• Website: https://onskilldemand.com

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal data when people use the OnSkillDemand mobile applications, related APIs, authentication pages, support features, and other services that link to this Policy (together, the "Service").

2. Scope and Privacy Roles

This Policy applies worldwide to users who are at least 18 years old. Depending on the context, different privacy roles apply.

2.1 Account and service data

For account registration, authentication, security, billing readiness, product communications, support, and operation of the Service, OnSkillDemand generally determines why and how personal data is processed. In those circumstances, OnSkillDemand acts as the data controller or equivalent responsible business under applicable law.

2.2 Candidate and other third-party data

Account holders may enter information about candidates, employees, interviewers, customers, companies, or other people. The account holder decides which third-party data to upload and how to use it. For that data, the account holder is generally the controller or responsible business, and OnSkillDemand processes the data on the account holder's instructions to provide the Service.

Account holders must have a lawful basis and provide all notices or obtain all permissions required to collect, upload, evaluate, share, export, and otherwise process third-party data. Candidates or other individuals should normally direct requests about data uploaded by an account holder to that account holder first. We will reasonably assist the account holder and may respond directly where required by law.

3. Personal Data We Process

The exact data depends on how the Service is used.

3.1 Account and profile information

We may process:

• first and last name;
• email address and email-verification status;
• telephone number, if provided;
• account role and account status;
• company name and profile description;
• internal user, authentication, and identity-provider identifiers;
• account creation and update timestamps; and
• subscription-plan selection or entitlement information. The current Free, Standard, and Premium plan presentation is informational and does not process payments.

Passwords are handled through the authentication system. The mobile application does not intentionally store account passwords in its local database. Verification-pending state may store a normalized email address and resend-availability time on the device.

3.2 Company, vacancy, and recruitment information

Users may provide:

• company name, industry, website, logo reference, employee count, and description;
• vacancy title, company, description, summary, salary range, currency, location, remote-work status, skills, status, and posting information;
• recruitment workflow and vacancy-assignment information; and
• other notes and content entered to organize recruitment activity.

3.3 Candidate information

Candidate records may include:

• name, email address, and telephone number;
• current role, professional description, skills, and years of experience;
• vacancy assignments and recruitment status;
• interview progress, scores, notes, suggested answers, and evaluations;
• generated or user-entered reports; and
• other information an account holder chooses to enter about a candidate.

Users must not upload special-category or highly sensitive information—such as health, biometric, genetic, religious, political, trade-union, sexual-orientation, government-identifier, financial-account, or criminal-record data—unless it is strictly necessary, lawful, and appropriately protected. The current Service is not designed to require such data.

3.4 Interview and report information

We may process interview stages, round names, proposed durations, questions, question categories, suggested answers, ordering, schedules, completion status, scores, notes, reports, report types, summaries, and generated timestamps.

3.5 Waitlist, support, help, and communications data

When a person joins our waitlist, we process the submitted email address, optional message, consent timestamp, applicable Privacy Policy version, landing-page version, referrer, and available campaign parameters. When a user contacts us or uses support features, we may process the sender's contact information, message, subject, attachments, support history, and information necessary to investigate the request. Transactional messages may include account verification, password reset, security, and service-related communications.

3.6 Technical and security data

We may process limited technical and operational data, including:

• IP address and request metadata;
• device or client type, operating system, application version, locale, and time zone;
• timestamps, request identifiers, response status, error and diagnostic information;
• authentication events, token metadata, security events, and rate-limit records; and
• hashed or pseudonymous identifiers used to enforce resend and abuse-prevention limits.

We do not intentionally log passwords, access tokens, SMTP credentials, or email-service API keys. Operational logs may include internal user or resource identifiers and limited output previews needed to diagnose Service behavior. Access to production logs is restricted to authorized operational purposes.

3.7 Local mobile data and exports

The mobile applications use a local database and device storage to cache Service data and support responsive or cache-first screens. Cached data may include profiles, companies, vacancies, candidates, interview content, reports, help content, and pending verification state. Cached data is associated with the application installation and may remain until it is refreshed, removed, the account is cleared, or the application is uninstalled, subject to platform behavior.

Users may create PDF exports of candidates, vacancies, interview questions, and reports. These files are created or handled on the user's device and may be shared through the operating system's share functionality. After export, the user controls where the file is stored or sent.

The current applications do not request access to precise location, contacts, microphone, camera, or photo library for core Service operation. We do not use advertising SDKs or third-party behavioral analytics in the current product.

4. How We Obtain Personal Data

We obtain personal data:

• directly from account holders during registration and use of the Service;
• from account holders who enter information about candidates and other people;
• directly from people who submit the website waitlist form;
• automatically from application, API, authentication, security, and server interactions;
• from support communications; and
• from service providers that help us deliver authentication, infrastructure, email, and AI-assisted features.

We do not purchase personal data from data brokers.

5. Why We Process Personal Data and Our Legal Bases

We process personal data only where an applicable legal basis is available. Depending on the jurisdiction and context, the bases include:

5.1 Performing a contract or taking requested steps

We use data to create and administer accounts; authenticate users; provide company, vacancy, candidate, interview, report, export, help, and support features; synchronize and cache data; deliver requested AI-assisted functionality; and respond to service requests.

5.2 Legitimate interests

We process data where reasonably necessary to secure, maintain, diagnose, and improve the Service; prevent abuse and fraud; enforce our Terms; understand and resolve failures; protect users and third parties; and manage our operations. We balance these interests against the rights and expectations of affected individuals.

5.3 Consent

We rely on consent where required by applicable law, including to store waitlist submissions and contact people about relevant product access, pilots, or partnership opportunities. Consent may be withdrawn at any time without affecting processing that already occurred lawfully. Joining the waitlist does not create an OnSkillDemand account.

5.4 Legal obligations and legal claims

We may process data to comply with Ukrainian or other applicable law, respond to valid legal requests, preserve evidence, establish or defend legal claims, and meet accounting, tax, security, and regulatory duties.

Account holders are responsible for identifying their own lawful basis for processing candidate and other third-party data.

6. AI-Assisted Features

OnSkillDemand includes AI-assisted features that can help draft or summarize vacancies, propose interview rounds and questions, generate suggested answers, and support report-related workflows. These features use Kimi services provided by Moonshot AI.

When a user invokes an AI-assisted feature, we send only the feature-relevant content needed to produce the requested output, such as vacancy title and description, skills, interview stage, round name and duration, question text, or related instructions. Account identifiers used for internal request tracing are not intentionally added to the AI prompt body.

OnSkillDemand does not use customer or candidate data to train its own AI models, and we do not permit our AI providers to use that data to train their models. We select and configure AI services on that basis. We may use de-identified operational information to maintain and improve non-model aspects of the Service, such as reliability, security, and user experience.

AI output can be incomplete, inaccurate, biased, or inappropriate. It is provided as assistance, not as an authoritative assessment, legal recommendation, or automated hiring decision. Users must independently review AI output and remain responsible for employment decisions, fairness, discrimination compliance, and the accuracy of information communicated to candidates or third parties.

7. How We Share Personal Data

We do not sell personal data and do not share it for cross-context behavioral advertising. We disclose data only as described below.

7.1 Service providers

We use providers that process data for defined operational purposes, including:

• Railway — application and Keycloak hosting, networking, deployment, operational infrastructure, and managed PostgreSQL environments;
• PostgreSQL — storage technology used for Service and authentication databases;
• Keycloak — identity, login, email verification, password reset, account status, and token management within our hosted environment;
• Resend — delivery and logging of transactional email such as verification and password-reset messages; and
• Kimi / Moonshot AI — processing feature-relevant prompts and returning requested AI-assisted output.

These providers may process data in countries outside the user's country. We require providers to protect data and use it only for authorized purposes, subject to their service terms and applicable law.

7.2 Account-directed disclosure

We disclose or export data when a user requests it, shares a PDF, opens an email or telephone action, follows a third-party link, or otherwise directs the Service or device to send data to another recipient.

7.3 Legal, safety, and business protection

We may disclose data where reasonably necessary to comply with law or valid legal process; protect rights, safety, security, or property; investigate abuse or fraud; enforce agreements; or establish, exercise, or defend legal claims.

7.4 Business changes

If OnSkillDemand is involved in a financing, reorganization, sale, merger, acquisition, or transfer of assets, relevant data may be disclosed under appropriate confidentiality and used consistently with this Policy or a notice provided at the time.

8. International Data Transfers

OnSkillDemand operates from Ukraine and uses service providers that may process data in other jurisdictions. As a result, personal data may be transferred to and processed in countries with privacy laws different from those in the user's location.

Where required, we use appropriate safeguards, such as contractual data-protection terms, transfer mechanisms recognized by applicable law, provider security commitments, and data-minimization measures. Users may contact us for information about safeguards relevant to their data, subject to confidentiality and legal limitations.

9. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including to provide the Service, maintain security and continuity, comply with law, resolve disputes, and enforce agreements.

Retention depends on the type of data and context:

• active account and recruitment data is generally retained while the account remains active or until the user deletes it;
• verification, password-reset, and throttling records are retained only as needed for completion, security, and abuse prevention;
• waitlist submissions are retained while the waitlist and related outreach remain active, until consent is withdrawn, or until the information is no longer reasonably needed;
• transactional email and infrastructure records follow the retention practices of the relevant provider and our operational needs;
• logs are retained for a limited operational and security period, with access restricted;
• user-generated PDF exports remain under the user's control on the device or destination chosen by the user; and
• backups are retained for resilience and age out according to backup rotation rather than being edited immediately record by record.

We may retain information longer where required by law, necessary for legal claims, or needed to protect the Service and its users. When data is no longer required, we delete, anonymize, or securely isolate it.

10. Account and Data Deletion

Users can request or initiate account deletion through available account controls or by contacting us. The current deletion workflow removes the account holder's application-owned companies, vacancies, candidate records, assignments, interview rounds, questions, progress, reports, and associated records, and requests removal of the corresponding Keycloak identity.

To prevent a deleted identity or old session from silently recreating an account, we retain a minimal deletion-protection record consisting of the former Keycloak user identifier and deletion timestamp. This record does not contain the deleted profile, candidate, vacancy, interview, or report content.

Deletion from active systems may not immediately remove data from disaster-recovery backups. Backup copies are access-restricted and removed through normal rotation. We may also retain limited records where required by law or necessary to establish or defend legal claims.

11. Security

We use reasonable technical and organizational safeguards appropriate to a startup software service, including authenticated access, environment and database isolation, encrypted network transport, access controls, secret management, rate limiting, pseudonymous throttle identifiers, logging controls, and account verification and password-reset protections.

No system can guarantee absolute security. Users must protect their credentials, maintain control of their devices, use strong and unique passwords, and promptly report suspected unauthorized access to support@onskilldemand.com.

12. Privacy Rights and Choices

Depending on applicable law, individuals may have rights to:

• obtain information about processing and request access to personal data;
• correct inaccurate or incomplete data;
• request deletion or restriction of processing;
• object to processing based on legitimate interests;
• withdraw consent where processing relies on consent;
• receive certain data in a portable format;
• lodge a complaint with a competent data-protection authority; and
• receive information about safeguards for international transfers.

To exercise a right, email support@onskilldemand.com and describe the request. We may need to verify identity and authority before acting. Where data was entered by an account holder about a candidate or another person, we may refer the request to that account holder or coordinate the response with them.

We will respond within the period required by applicable law. Rights are not absolute, and lawful exemptions may apply. We will explain any material refusal where required.

Individuals in the European Economic Area may contact the data-protection authority in their country. Individuals in Ukraine may exercise rights under the Law of Ukraine "On Personal Data Protection" and other applicable legislation.

13. Children

The Service is intended only for people aged 18 or older. We do not knowingly permit children to create accounts. If we learn that a child has provided personal data contrary to this requirement, we will take reasonable steps to delete it. Contact support@onskilldemand.com with relevant details.

14. External Links and Device Features

The Service may open websites, email applications, telephone applications, or operating-system sharing interfaces. Those services operate under their own privacy terms. We are not responsible for the privacy practices of a third party merely because the Service opens or links to it.

15. Changes to This Policy

We may update this Policy to reflect changes in the Service, providers, law, or operational practices. We will update the effective date and provide additional notice where required. Continued use after an update takes effect is subject to the revised Policy, but we will obtain consent where applicable law requires it.

16. Contact Us

Questions, requests, or complaints about privacy may be sent to:

Yurii Kaplunov, FOP, doing business as OnSkillDemand

Heroiv Kharkova Ave, 27, Kharkiv, Ukraine, 61000

Ukrainian taxpayer registration number (RNOKPP): 3137906152

support@onskilldemand.com

We encourage people to contact us first so that we can try to resolve the concern. This does not limit any right to contact a competent regulator or seek another remedy available under law.