Privacy Policy.

Who we are and what this policy covers

ALLFAWISE is a recruitment and selection company. We run searches for the companies that hire us, and we run them on our own platform, with our own team.

This policy covers the ALLFAWISE public site and the platform where the searches happen: the enquiry form, applications to open roles, the optional candidate account, and the assessments used during a search.

ALLFAWISE decides how this data is handled during the search. The client company that opened the role receives the finalists at the end, along with the evidence behind each name — and the hiring decision is theirs.

What the enquiry form sends

The form on the contact page is a commercial channel, for companies looking to hire. It is not an application, and nothing arriving through it enters a selection process.

When you send it, we store:

• your name
• your work email
• your company
• your role
• the subject, if you pick one
• the message you wrote
• the language the form was filled in, so we reply in the same one, and the date you sent it

What the form does without asking anything of you

The form carries a hidden field that no person sees or fills in. When it arrives filled in, the submission came from a bot and nothing is stored.

We also cap how many messages one email address can send per hour. To do that, the system counts how many that address has already sent in the period — it does not read what they said.

What an application sends

Applying takes no account. What we receive is what you fill in on the role's form:

• your name and email
• your phone number, when the role asks for it
• the link to the CV or portfolio you give us
• your answers to that role's questions — text, number, yes/no or options — stored alongside the question exactly as it was worded on the day you answered
• how the application is progressing: which stage it is in, the dates, the team's notes, and the messages exchanged with you about it

The CV itself stays with you

The platform neither receives nor stores your CV file. What we keep is the address you gave us; the document stays hosted where you put it, under your control, and stops being reachable by us the moment you take it down.

Assessments and work samples

When a role includes a structured assessment or a work sample, we receive the participant's name and email, the answers given, the material submitted and the result recorded. Those records are attached to the application they belong to.

A candidate account, if you want one

The account is optional and exists so you can follow your applications in one place. It uses an email address and a password. The password is held by the authentication service we use, and ALLFAWISE has no access to it.

If you choose to fill in the profile, it may hold a phone number, city, state, country, a professional headline, a summary you write yourself, and links to LinkedIn, a portfolio and a CV. None of it is required to apply.

When you create an account and confirm your email, applications you had already sent without an account from that same address start appearing in it.

What we use the data for

We use what we receive to:

• answer your enquiry and carry on the conversation it started
• run the search: screening, assessment, interviews and shortlist
• tell you where your application stands
• present the client company with the finalists and the evidence behind each name
• operate and protect the platform: authentication, access control, submission limits and technical operating records

What we don't do with it

We don't use your data for advertising, we don't sell it, and we don't build a commercial profile from it. The site carries no tracking, advertising or audience-measurement tooling.

We produce no overall candidate score and no automated ranking. The stages produce records and evidence; people read those records, and the hiring decision belongs to the client company.

Who else processes this data for us

For the service to exist at all, a few technical providers process the data on our behalf and on our instructions:

• Vercel — hosting and delivery of the site and the application
• Supabase — database and authentication
• Resend — the transactional emails about your application

Cookies

The site uses two kinds of cookie, both needed for it to work: one that remembers the language you chose, so your next visit opens in the same one, and the authentication session cookies that keep your account signed in as you move around.

There is no advertising cookie, no cross-site tracking and no audience measurement.

How long we keep it

We keep each piece of data for as long as the purpose that produced it lasts: an enquiry, while the conversation it opened is live; an application and its evidence, while the search is running and for as long as we need to show how each decision was reached.

We have not yet fixed a single retention period in months. We would rather say so than publish a figure the operation doesn't keep to. When that period is set, it appears on this page with a new update date.

Either way, you can ask us to delete your data at any time, through the channel below.

Security

Access permissions are enforced by the database itself, not only by the application: every query is filtered by the database according to who is asking. The public form has no direct access to the tables — it writes through a specific function that validates the content before storing it.

Traffic between your browser and the platform is encrypted, and your account password is held by the authentication service.

No system is impenetrable, and we don't claim ours is. If a security incident affects personal data, we notify the people affected and the competent authority.

Your rights

Brazil's data protection law (LGPD) gives you, among others, the right to:

• know whether we hold data about you, and see it
• correct data that is incomplete, inaccurate or out of date
• ask us to delete your data
• ask who we share it with
• withdraw consent, where the processing rests on it

How to ask

Write to peterson@allfawise.com. We reply from the same address, and we may ask for something extra to confirm the request is yours — which is what stops someone else asking for your data in your name.

If your application is already under way, replying to the email you received about it also reaches us.

Where the data is processed

The providers listed above operate outside Brazil, and your data may be processed abroad.

We have no international transfer certification to declare, and we don't claim one. What we can state is what this page describes: which providers we use, what each is used for, and how to have your data deleted.

Changes to this policy

When this policy changes, we change the version and the date at the top of this page. A change to how the data is used, or to the list of providers, is flagged here rather than buried in a footnote.