Doowings

Privacy Policy

Version 1.0 · Last updated: 2026-10-16

This policy explains how Doowings handles personal data in Doowings Hire, our recruiting platform, and in Doowings for LinkedIn, our Chrome extension. In short: our customers decide what happens to the candidate and contact data they put into our products, and we process it for them as their processor. We decide only about our own users' accounts, the security of our service, and our own business. AI drafts and suggests, but a person confirms every message and every decision. We sell no data and run no advertising.

Contents

Who we are

Doowings is a company based in Belgium. We build and operate:

  • Doowings Hire, a recruiting platform (applicant tracking system) at app.doowings.com, including the careers pages our customers publish on it
  • Doowings for LinkedIn, a Chrome extension that connects LinkedIn to a Doowings Hire workspace

Registered entity: [[OPERATOR-FILL: registered legal name, legal form, registered office, enterprise number]]

This policy covers both products, this website's legal pages, and our own business contacts.

Our role: controller and processor

Our customers are the controllers of the data they process with our products. When a staffing agency or an employer uses Doowings Hire or Doowings for LinkedIn, that organisation decides why and how it processes the personal data of candidates, people whose profiles it sources, its client contacts, its communications, the LinkedIn data its recruiters capture (including the LinkedIn connection described below), and the AI outputs about its candidates. Doowings is its processor: we handle that data only on the customer's instructions, under the data-processing terms in our agreement with that organisation.

Doowings is the controller only for our own purposes: administering our users' accounts and our customers' billing contacts; keeping the platform secure, preventing abuse and keeping audit logs of our users' actions; this website and its legal pages; vulnerability reports sent to us; our own business contacts; and pilot product feedback that users send us to improve the product.

We never build or sell a database of people. We do not act as the controller of candidate or prospect data, with one exception: a product-feedback note that mentions a candidate, which we use for our own purpose of improving the product (see Product feedback that mentions a candidate).

Personal data we process

As a controller, we process:

  • Account data: name, work email address, organisation, role, a one-way hash of your password, and multi-factor authentication settings where they are used
  • Sign-in and security data: sign-in events (web app sign-ins record the IP address, and a failed attempt for an unknown account records a hash of the email address used), and technical request logs (IP address, the path requested, time, outcome)
  • Audit logs: records of actions users take in our products, including through the extension (see Audit records)
  • Product feedback: notes users send us about the product, and an optional screenshot attached to a note
  • Correspondence: messages you send us, including support requests and vulnerability reports
  • Business contacts: names and work contact details of people at customers, prospects and partners

As a processor, we process whatever our customers put into the platform. That is described in Data our customers process with Doowings Hire and Doowings for LinkedIn.

For the data we control:

  • Providing and administering accounts: to perform our contract with your organisation and in our legitimate interest in giving its users a working service (GDPR Art. 6(1)(b) and (f))
  • Security, abuse prevention and audit logs: our legitimate interest in protecting the service, our customers and the people in their data, and to meet our legal obligations (Art. 6(1)(f) and (c))
  • Product feedback: our legitimate interest in improving the product (Art. 6(1)(f))
  • Vulnerability reports and correspondence: our legitimate interest in answering you and fixing problems (Art. 6(1)(f))
  • Business contacts: our legitimate interest in running our business (Art. 6(1)(f))
  • Legal obligations: accounting, tax and responding to lawful requests (Art. 6(1)(c))

Do you have to provide data? Account data is needed to create and secure your account; without it you cannot use our products. Correspondence, product feedback and vulnerability reports are up to you.

For customer data, the customer determines the purpose and the legal basis, and tells candidates what it needs from them and why. In the platform, a candidate who applied or registered themselves is recorded with their consent, and a sourced or imported candidate on the basis of the customer's legitimate interest in recruitment. A staffing customer can choose to keep applicants in its talent pool after their application ends on the basis of its legitimate interest instead of a second consent, with a standing right to object; the platform allows this only after the customer has completed and attested a legitimate-interest assessment in the product.

Data our customers process with Doowings Hire

Customers use Doowings Hire to manage recruitment. Depending on what they use, this includes:

  • Candidates: CVs, contact details, work history, education, skills, notes, pipeline stages, interview details and messages
  • Sourced profiles: people a recruiter finds and saves, for example from LinkedIn with our extension
  • Client contacts (CRM): if the organisation enables the client CRM, business contacts at its client companies. Contacts can be added by hand, captured with the extension, or through the AI assistant. A contact the recruiter dictates to the assistant is treated as collected directly; a contact the assistant's hiring-manager finder surfaces comes from another source, so the obligation to inform that person is recorded (see Art. 14 notices below)
  • Communications: emails and LinkedIn messages a recruiter sends from their own connected account, and replies from people already in the workspace
  • AI outputs: summaries, match scores, extracted skills and drafted messages (see Artificial intelligence)

Clients and end employers as recipients. Staffing customers can submit a candidate to their client, the company that is hiring. That client receives the candidate's data. The platform records each submission and the client's feedback on it.

Skill normalisation. The skills in a profile may be matched to a standard vocabulary with AI, so that searches find people with equivalent skills. If this is switched on, only the skill names are sent, never the candidate's own text: to Mistral AI (EU) for organisations set to the EU or UK jurisdiction, and to Anthropic (US) for organisations set to the US jurisdiction. Every correction this makes to a profile is recorded, so a customer can tell anyone it had already shared that profile with (GDPR Art. 19).

Product feedback that mentions a candidate. A recruiter's product-feedback note may mention a candidate, or its screenshot may show one. We use these notes only to improve the product, in our legitimate interest. A note is deleted with the candidate it is linked to, and the platform's retention schedule sets 180 days for it (see How long we keep data).

How candidates exercise their rights. The recruiting organisation is your first point of contact. Its privacy notice is on its careers site at /careers/{organisation}/{language}/privacy. If you write to us instead, we pass your request to that organisation and help it respond.

Art. 14 notices. When a customer obtains someone's data from a source other than that person (a saved LinkedIn profile, an imported CV, a contact found by the assistant), the platform records that the person still has to be informed. Where the organisation has this enabled, the notice is offered as fine print, with an unsubscribe line, on the next email a recruiter sends that person, and the recruiter reviews it before sending. A first contact by LinkedIn message, InMail or connection request does not carry the notice, and no later LinkedIn message does either, so the platform keeps the obligation recorded as open until an email carries the notice or the recruiter records that the person already has this information. Nothing is sent automatically.

Objecting and opting out. If you object, the organisation can mark you as do-not-contact, which blocks outreach to you and blocks saving your profile again. If your data is later erased, the platform keeps only a keyed one-way fingerprint of your identifiers, with no name, so that you are not added back.

Doowings for LinkedIn (Chrome extension)

This section is the privacy policy for the Doowings for LinkedIn Chrome extension.

What the extension does

Doowings for LinkedIn has one purpose: to let recruiters who use Doowings Hire save LinkedIn profiles to their organisation's recruiting workspace and reach out to those people, with every message confirmed by the recruiter. It works only on linkedin.com and only for someone signed in with a Doowings Hire account. By default you sign in with your Doowings Hire email address and password; where your organisation uses company sign-in, signing in runs through our sign-in service instead.

What happens automatically. While you are signed in, each time you open a LinkedIn profile (including in LinkedIn Recruiter and Sales Navigator), the extension reads the profile page in your browser and sends the web address of that profile to your organisation's Doowings Hire workspace. The workspace answers whether the person is already saved as a candidate or, if your organisation uses the client CRM, as a contact, and the extension shows the answer as a badge on the page. While you are signed in, LinkedIn pages can detect that the extension is active, because the badge is present on the page, but not what the badge shows. Only the profile's web address is sent, and only to your workspace; what the extension read from the page stays in your browser until you choose to save the profile. Doowings Hire keeps no record of which profiles were looked up in its application data or audit logs. Because the address travels as part of the request, it can appear in the technical request logs kept by us and our hosting and network providers, which are kept only as long as needed to run and secure the service. The extension explains this lookup under its sign-in form and in a notice after you sign in.

What happens only when you click. Everything else starts with an explicit action from you:

  • saving the profile you are viewing, or a selection of people from a LinkedIn Recruiter or Sales Navigator list after you confirm it
  • opening the Doowings side panel
  • connecting your LinkedIn account (see Connecting your LinkedIn account)
  • sending a connection request, message or InMail, or starting an email reach-out, if your organisation enables it
  • starting a reach-out flow in which AI drafts the message: you review, edit and confirm each draft before it is sent, and follow-ups are prepared as drafts for your review, never sent by themselves
  • fetching a full profile through your connected LinkedIn account, if your organisation enables it
  • adding a person as a client contact, if your organisation uses the client CRM

When you save a profile, the extension sends what LinkedIn shows on that page, as read in your browser: name, headline, current title and company, location, experience, education, languages, skills, the About text and the profile's web address. It does not read photos, and it does not read contact details from the page.

What the extension keeps in your browser. Your sign-in tokens (a short-lived access token and a refresh token) are kept in the extension's private database, which only the extension's own pages and its background process can open: web pages and the parts of the extension that run on LinkedIn pages cannot read them. While you finish a two-factor sign-in, that private database also briefly holds the one-time sign-in step our server issued: it is cleared when you finish or cancel the sign-in, it can no longer be used after five minutes, and the extension's own storage keeps only the time that step expires. In the extension's own storage, which web pages cannot read: a random sign-in marker that shows you are signed in (not a credential), your last chosen save target, your last chosen proxy country, your last chosen LinkedIn seat (Sales Navigator or LinkedIn Recruiter), and whether you have seen the lookup notice. Until you close the browser, it also keeps a pending LinkedIn connection step (a server-issued reference, never a credential) and the last sign-in error code. When you start a bulk save, the selection of people is handed to the side panel through the browser's session storage: it can be used for at most two minutes, and it is cleared at the latest when you close the browser or start your next bulk save. The extension never stores your LinkedIn cookies.

All code runs from the installed package; the extension loads no remote code. It talks only to LinkedIn pages, to your Doowings Hire workspace and, for company sign-in, to our sign-in service, always over HTTPS.

Permissions

The extension asks Chrome for these permissions, and only these:

  • storage — keeps a random sign-in marker (not a credential), a few preferences and short-lived hand-offs between the extension's parts in the extension's own storage. Web pages cannot read it, and it never holds your sign-in tokens or your LinkedIn cookies: the tokens are kept in the extension's private database, which needs no permission and which only the extension's own pages and its background process can open.
  • sidePanel — shows the Doowings side panel next to LinkedIn. It opens only when you click to open it, never by itself.
  • identity — runs your company sign-in in a window managed by Chrome, where your organisation uses company sign-in. It is not used to read your Google account or your browser profile.
  • cookies — optional, and not granted when you install the extension. Chrome asks you for it only after you click Connect LinkedIn and tick the disclosure. It is used once to read your own LinkedIn session cookies on linkedin.com, and the extension gives the permission back right after. It never reads cookies of any other website.
  • https://www.linkedin.com/* (site access) — lets the extension run on LinkedIn pages to show the badge and read the profile you choose to save. It gives no access to any other website.

The extension does not request tabs, webNavigation, activeTab or access to all websites.

Connecting your LinkedIn account

To send messages or fetch profiles through your own LinkedIn account, you can connect it to your organisation's account with Unipile, our connection provider. Unipile then keeps your LinkedIn session and acts as your LinkedIn account until you disconnect: profile look-ups and any messages you send from Doowings appear on LinkedIn as coming from you. Connecting this way is not an official LinkedIn integration and may put your LinkedIn account at risk under LinkedIn's terms of use. The extension tells you all of this before you connect.

Your LinkedIn cookies are handled in transit only. The extension reads your LinkedIn session cookies only when you click Connect LinkedIn or reconnect, after you have read the in-product disclosure, ticked the acknowledgement and accepted Chrome's cookies permission prompt. On that click it reads li_at and, if it is present (it is set for Sales Navigator and Recruiter seats), li_a. If your connected account is not a Sales Navigator or Recruiter seat, the extension shows a quiet "Using Sales Navigator? Reconnect to enable it." link; reconnecting reads the cookies again in the same way. The cookies and your browser's user agent travel through the Doowings backend, over an encrypted (TLS) connection, to Unipile, to connect your own LinkedIn account, and they are never stored and never logged, by the extension or by Doowings. The proxy country you pick is sent the same way and is not stored by Doowings; the extension remembers your last choice in your browser to prefill the form.

Doowings keeps a connection record while you are connected. It contains:

  • Unipile's reference for your connected account
  • the LinkedIn identity Unipile reports for that account
  • your LinkedIn account type, and when it was last checked
  • the connection status, and when and how you connected
  • your acknowledgement of the disclosure: which version you saw and when you acknowledged it

If you connect from the Doowings Hire web app instead of the extension, a pending record is also kept until you confirm the connection there. It holds the kind of account being connected, when the connection was started and its confirmation deadline, and one-way digests only: a keyed hash tied to your signed-in browser session, and hashes of a one-time confirmation code and of your browser's user agent.

We keep this record so your messages and profile fetches go through your own account and so your organisation can show who connected which LinkedIn identity. You can disconnect at any time in Settings: we ask Unipile to remove the connection and then delete the record, and if Unipile cannot be reached, the record is kept, you are told the disconnect failed, and you can try again. If your Doowings Hire account is deactivated, we ask Unipile to remove the connection and delete our record. If Unipile cannot be reached at that moment, the connection may remain on Unipile's side until it is cleaned up; write to [email protected] if you want us to check. Each connection is also written to your organisation's audit log with the same details, and that entry remains after you disconnect (see Audit records).

People whose profiles you save

The extension saves a person's profile only when a recruiter chooses to, and only what LinkedIn shows on the page. The recruiter's organisation is the controller of that data and decides its legal basis, which for a sourced person is normally the organisation's legitimate interest in recruitment. The first time a profile is saved, the platform records the obligation to inform that person (GDPR Art. 14), and, where the organisation has this enabled, the notice is offered as fine print on the next email the recruiter sends them. A first contact by LinkedIn message, InMail or connection request does not carry the notice, and no later LinkedIn message does either, so the obligation stays recorded as open until an email carries the notice or the recruiter records that the person already has this information. A save is refused when the person is marked do-not-contact or blocked, or has asked to be suppressed. A saved profile becomes a record in the organisation's workspace: the recruiter's colleagues can see it, the organisation may share it with a client it submits the person to, and our service providers process it on our behalf, for example to host and store it and to index it for AI search. Anyone whose profile was saved can object or exercise their rights through that organisation, or by writing to [email protected], and we will pass the request on (see Objecting and opting out).

Audit records

Actions taken through the extension are recorded in your organisation's audit log against your user account: for example signing in, saving or enriching a profile, connecting LinkedIn, and sending a message. An extension sign-in record notes that you signed in through the extension; it does not store your IP address.

After a bulk save in which some rows failed, the extension sends one summary for that run: the number of people attempted, saved, already present and failed, and coarse failure reasons (such as a network error). It contains no candidate names, profile addresses or other identifiers. The summary is recorded as an audit event under your user account. It also raises an operational warning in our error-monitoring service (Sentry, EU region), where that service is enabled for the environment; the warning carries only the counts and the main failure reason, never your identity or your organisation's, and is sent at most once every 15 minutes for the same kind of failure.

We keep these records for accountability, for post-market monitoring of our AI features under the EU AI Act, and to keep the service reliable. They stay in your organisation's audit log for as long as your organisation's data is held, and are deleted with it when the contract ends; the platform's retention schedule sets 12 months for sign-in records (see How long we keep data).

The extension does not track clicks, scrolling, mouse movements or keystrokes, and it keeps no browsing history.

Data categories

In Chrome Web Store terms, the extension handles these categories of data:

  • Personally identifiable information — the name, headline, work history and other profile details of people a recruiter chooses to save, and the recruiter's own account details
  • Authentication information — your Doowings Hire email address and password, sent over HTTPS when you sign in with a password (the extension does not keep your password); your LinkedIn session cookies, relayed once when you connect and never stored; and the extension's own sign-in tokens, kept in the extension's private database, which only the extension's own pages and its background process can open (web pages and the parts of the extension running on LinkedIn pages cannot read them)
  • Personal communications — the messages you write or approve and send to people from the extension
  • Location — the proxy country used for your LinkedIn connection, suggested from your browser's time zone or language setting without any IP lookup; and the IP address your browser connects from, which our servers receive with every request, including when you sign in, and use to limit repeated sign-in attempts. It can appear in technical request logs; the extension's sign-in record does not store it
  • Web history — the web address of each LinkedIn profile page you open while signed in, sent for the in-ATS badge lookup
  • Website content — the LinkedIn profile content read from the page when you save a profile

Saved profiles are visible within your organisation and processed by our service providers, as described in People whose profiles you save. We sell none of this data, we do not use it for advertising, and no Doowings personnel reads it except as the Chrome Web Store Limited Use requirements allow: with your explicit consent, for security, to comply with the law, or in aggregated form for internal operations.

Limited Use

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Artificial intelligence

Doowings Hire uses AI to parse CVs, summarise and enrich profiles, suggest matches and searches, and draft messages. We design these features around human control:

  • AI drafts, a person decides. AI never sends a message by itself and never changes a candidate's status. A recruiter reviews, edits and confirms every message before it is sent.
  • Rankings are advisory. Match scores and rankings help a recruiter decide where to look. They do not make hiring decisions.
  • No solely automated decisions. No decision that produces legal effects for a person or similarly significantly affects them is taken solely by automated means. Rankings are advisory, and a person decides.
  • High-risk AI. Under the EU AI Act, AI used to recruit and select people is high-risk. We treat these features that way: human oversight, record-keeping and monitoring.
  • Every AI call is logged. We record which model was used, for what purpose and for which record, without the personal data itself. The platform's retention schedule sets 24 months for these records (see How long we keep data).
  • Personal data is minimised. Names and contact details are removed before a call when the task does not need them. CV parsing is the exception: extracting identity and contact details is its purpose, so the full CV is sent, to Mistral AI in the EU, and to Anthropic only if that first parse fails.
  • No training. We do not train AI models on customer data, and the terms of Anthropic and Mistral AI exclude using data sent through their APIs to train their models.
  • Routing by jurisdiction. Each organisation has a jurisdiction setting (EU, UK or US) that decides which AI provider serves each task, as described under Service providers.

Service providers

We use these providers (processors) to run our products:

  • Railway — application hosting, EU (Netherlands)
  • Neon — database, EU (Frankfurt, Germany)
  • Scaleway — document storage for CVs and feedback screenshots, AI search embeddings, and system emails to users, EU (France)
  • Cloudflare — network edge and access protection for our web addresses, worldwide network
  • Unipile — connection to the email, calendar and LinkedIn accounts users connect, EU-hosted
  • Anthropic — AI models for drafting, the assistant, search and most other AI tasks, United States
  • Mistral AI — AI models for CV parsing and profile enrichment (and skill normalisation for EU and UK organisations, if switched on), EU (France); see International transfers
  • Sentry — error monitoring, EU region, only where enabled

When a user connects their own mailbox or calendar (for example Microsoft 365 or Google Workspace), messages and meeting invitations go through that account's provider under the user's organisation's own agreement with it. Messages a recruiter sends on LinkedIn are delivered by LinkedIn.

Some optional features rely on further providers, such as external profile search, contact-detail lookup and job-board publishing. They are switched off and not in use today; we will update this list before any of them receives personal data.

International transfers

We host and store data in the European Union. For each of our service providers, this is where data goes and how a transfer outside the EEA is protected:

  • Anthropic (United States): AI requests leave the EEA, protected by the European Commission's Standard Contractual Clauses
  • Mistral AI (France): AI requests are processed in the EU. Mistral AI's terms allow its own sub-processors to handle data outside the EEA on the basis of an adequacy decision or Standard Contractual Clauses; we are confirming how this applies to our use
  • Scaleway (France): storage, AI search embeddings and system emails stay in the EU; no transfer
  • Railway: hosts our application in the EU (Netherlands). Railway is a United States company; we are confirming the transfer mechanism that covers any access from outside the EEA
  • Neon: stores our database in Frankfurt. Neon's parent company is in the United States; we are confirming the transfer mechanism
  • Cloudflare: requests to our web addresses pass through the Cloudflare network location nearest to the user, which may be outside the EEA. Cloudflare is a United States company; we are confirming the transfer mechanism
  • Sentry: error monitoring in its EU region, only where enabled. Sentry is a United States company; we are confirming the transfer mechanism
  • Unipile: EU-hosted; we are confirming that every connected account is served from the EU
  • Mailbox, calendar and LinkedIn accounts: where a user connects an account hosted outside the EEA, data reaches it under the user's organisation's own agreement with that provider

Where we say a mechanism is being confirmed, we are completing our review of that provider's transfer terms. You can ask us for the details of the safeguards for any transfer at the address in Contact.

How long we keep data

We keep data only as long as it serves its purpose. The retention schedule configured in the platform sets these periods:

  • Candidate data: decided by each customer. The default is 12 months (employers) or 24 months (staffing agencies) after the last real contact with the person, and nobody in an open recruitment process is removed. Customers can change these periods and preview the effect before deletion is switched on.
  • Account data: for as long as the account exists
  • Sign-in and security events: 12 months
  • Search records: 12 months
  • AI call records: 24 months
  • Product feedback: 180 days, or earlier if the candidate it is linked to is deleted
  • Audit records of user actions: as long as the customer organisation's data is held
  • LinkedIn connection record: until you disconnect or your account is deactivated
  • Records of erasure requests: kept, because they prove the erasure happened
  • Technical request logs: only as long as needed to run and secure the service and to investigate incidents

Automatic deletion is not yet active. We are switching on automatic deletion at the end of each period; it is not yet running. Until it is, data that has passed its period is not removed automatically. What is true today: Doowings can apply the schedule by hand, previewing what would be removed before anything is erased; users of a customer organisation who are allowed to delete candidates can erase a person's record, with its linked data, at any time; and we act on any deletion instruction a customer gives us.

When a customer's contract ends, we delete the organisation's data.

Security

We protect data with encryption in transit (HTTPS/TLS), access control scoped to each customer organisation, multi-factor authentication for administrators, audit logging, and EU hosting. To report a vulnerability, see our Vulnerability Disclosure Policy.

Your rights

Under the GDPR you can ask for access to your data, correction, deletion, restriction of processing and a copy in a portable format, and you can object to processing based on legitimate interests. Where processing is based on your consent, you can withdraw it at any time.

If your data is in a customer's workspace, for example as a candidate or a contact, send your request to that organisation; we will help it respond. For data we control, write to [email protected]. We may ask you to confirm your identity, and we answer within one month.

Complaints

You can complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels, Belgium, www.dataprotectionauthority.be, or to the authority in the EU country where you live or work. We would appreciate the chance to address your concern first.

Contact

Write to [email protected] for any privacy question or request. We have not appointed a Data Protection Officer; [email protected] reaches the person responsible for data protection at Doowings.

Cookies and local storage

Doowings Hire uses only what it needs to work:

  • Sign-in cookies: a session cookie and a refresh cookie that keep you signed in. They are marked HttpOnly, so scripts on the page cannot read them.
  • Security cookies: short-lived cookies used during sign-in, multi-factor authentication and when you confirm your identity again for a sensitive action
  • Appearance cookie: dh_appearance remembers your display preferences (theme, text size, contrast, density and motion) for one year, so pages open in the appearance you chose
  • Local storage: your organisation identifier, display name and role for the interface; display preferences such as saved views and your appearance settings; and a token that protects forms against cross-site request forgery, which is useless without the sign-in cookie

We use no advertising or analytics trackers. The extension's storage is described in What the extension does.

Changes to this policy

We version this policy and show the date of the last update at the top. If we make a material change, we will tell customers and users in advance, by email or in the product. Earlier versions are available on request.