Google Calendar data handling
This section explains specifically how Guru4You accesses, uses, stores, protects, shares, and deletes Google user data when a user voluntarily connects a Google Calendar.
- Data accessed: the connected Google account email address, an OAuth refresh token, and busy/free intervals (start and end timestamps only) from the account's primary calendar. Guru4You requests the
calendar.freebusyscope and does not request or receive event titles, descriptions, attendees, locations, meeting links, or other event content. - How the data is used: the email address identifies the connected account. Busy/free intervals are used only to prevent already-booked times from being offered to candidates in Guru4You's interview scheduler. Guru4You never creates, changes, or deletes Google Calendar events.
- How the data is stored and protected: the OAuth refresh token is encrypted at rest using AES-256-GCM. Calendar availability is cached as start and end timestamps in Guru4You's secured production database. Data is encrypted in transit using TLS.
- Retention and deletion: availability is kept only for a rolling 90-day window. Choosing Profile → My Calendar → Disconnect immediately deletes the connection and all cached Google Calendar availability from Guru4You and requests revocation of the Google OAuth grant. Users may also revoke access from their Google Account permissions page.
- Sharing and transfers: Guru4You does not sell Google user data or share it with advertisers, data brokers, information resellers, or other third parties for their own purposes. Calendar data is not used for advertising, credit decisions, surveillance, or any unrelated purpose.
- Artificial intelligence: Guru4You does not use Google Workspace APIs, or any data obtained through them, to develop, improve, or train non-personalized AI/ML models. Google Calendar data is never sent to AI providers and is not used to develop, improve, or train any AI or machine-learning model, whether generalized or personalized.
Guru4You's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Guru4You™ Data Protection & Privacy Policy Comprehensive Privacy Notice pursuant to Articles 13 and 14 EU GDPR
Effective Date: 2 July 2026 (this revision effective 16th September 2026)
Version 1.3 — adds the optional Google Calendar connection (§3.4, §5, §8, §10)
1. Data Controller
The Data Controller responsible for the processing of personal data through the Guru4You platform is:
Guru4You is provided by Recuvia Ms. Heidi Ott
Address: Alt-Mariendorf 25d 12107 Berlin, Germany Email: heidi@guru4you.io Phone: +49 30 39713071 Managing Director(s): Ms. Heidi Ott VAT ID: DE363288611
1.1 Data Protection Officer
Our Data Protection Officer can be contacted at:
Name: Axel Weber
Email: dataprotection@guru4you.io
Address: Axel Weber c/o Impressumservice Dein-Impressum Stettiner Straße 41 35410 Hungen
Phone: +49 1579-2341672
2. Scope and Purpose of Data Processing
We process personal data in accordance with the EU General Data Protection Regulation (GDPR), applicable national data protection laws (including the German BDSG where applicable), and other relevant privacy regulations. We are committed to the principles of data minimization, purpose limitation, and storage limitation.
2.1 Our Roles in Data Processing
Guru4You operates in two distinct data processing roles depending on the context:
- As Data Controller: When we process data of Company Administrators and Users who register for and manage accounts on the Platform. We determine the purposes and means of this processing.
- As Data Processor: When we process data of Participants (candidates) on behalf of our Company Customers. The Company Customer, as Data Controller, determines the purposes and means of processing candidate data. Our processing activities are governed by a Data Processing Agreement (DPA) pursuant to Article 28 GDPR.
3. Categories of Personal Data Collected
3.1 Company Administrator and User Data
When you register for and use the Platform, we collect and process the following categories of personal data:
Data Category Specific Data Points Legal Basis (Art. 6 GDPR)
Identity Data First name, last name, email Art. 6(1)(b) - Contract
address, preferred language performance
Authentication Data Password (hashed), session Art. 6(1)(b) - Contract; Art.
tokens, last login timestamp 6(1)(f) - Legitimate interest
(security)
Company Data Company name, address, Art. 6(1)(b) - Contract; Art.
phone, website, tax ID 6(1)(c) - Legal obligation (tax)
(encrypted), VAT number
(encrypted), billing address
(encrypted)
Payment Data Card brand, last 4 digits, Art. 6(1)(b) - Contract; Art.
Stripe customer ID, 6(1)(c) - Legal obligation
subscription status
Usage Data Campaigns created, tests Art. 6(1)(b) - Contract; Art.
administered, analytics, 6(1)(f) - Legitimate interest
feature usage, usage logs (improvement)
Consent Records Terms acceptance Art. 6(1)(c) - Legal obligation
timestamp, privacy consent (accountability)
timestamp, consent hash
3.2 Test Participant (Candidate) Data
When candidates are invited to and participate in assessments, the following data is processed on behalf of the Company Customer:
Data Category Specific Data Points Legal Basis (Art. 6 GDPR)
Identity Data First name, last name, email, Art. 6(1)(b) - Pre-contractual
salutation, preferred measures; Art. 6(1)(f) -
language Legitimate interest of
employer
Assessment Data Test responses (encrypted), Art. 6(1)(f) - Legitimate
scores, time spent, interest of employer in
completion status, question- evaluating candidates
level evaluations
Integrity Data Focus loss events, suspicious Art. 6(1)(f) - Legitimate
behavior flags, fraud event interest in assessment
timestamps, session recovery validity
data
Technical Data IP address, browser user Art. 6(1)(f) - Legitimate
agent, session tokens interest (security, fraud
prevention)
Consent Records Test terms acceptance, Art. 6(1)(c) - Legal obligation
privacy consent, consent (accountability)
hash, acceptance timestamp
3.3 Technical and Log Data
When you access the Platform, our servers automatically collect:
- IP address (used for rate limiting, security, and fraud detection);
- Browser type and version (user agent string);
- Date and time of access;
- Pages visited and features used.
IP addresses are used for security purposes and rate limiting (5 login attempts per 15 minutes per email; 30 requests per 60 seconds per IP). Log data is retained for security investigation purposes and anonymized or deleted within 30 days.
3.4 Optional Calendar Connection Data
If you are a Company Administrator or User acting as an interview panel member, you may voluntarily and individually connect your Google Calendar so that times you are already booked stop being offered to candidates as free. If you do so, the following data is processed:
Data Category Specific Data Points Legal Basis (Art. 6 GDPR)
Calendar Connection Data Google account email, OAuth Art. 6(1)(a) - Consent
refresh token (encrypted at
rest)
Calendar Availability Data Busy/free time intervals Art. 6(1)(a) - Consent
(start and end times only) for
a rolling 90-day window
We request only Google's narrowest calendar scope (“calendar.freebusy”). Event titles, attendees, locations, descriptions, and any other event content are never transmitted to us and therefore never stored. This connection is a personal act of consent: it cannot be established on your behalf by an administrator or by your Company, and it can be withdrawn at any time via Profile → My Calendar → Disconnect, which immediately deletes all cached interval data and revokes our access at Google.
4. Cookies and Local Storage
4.1 Essential Cookies
The Platform uses essential cookies required for authentication and session management. These cookies are strictly necessary for the Platform to function and do not require consent:
- NextAuth session cookie: Stores your encrypted authentication session. HttpOnly, Secure. Expires after 60 minutes of inactivity (configurable).
- CSRF token: Protects against cross-site request forgery attacks.
4.2 Local Storage
The Platform uses browser local storage for functional purposes:
- Wizard state persistence (Guru4You_wizard_state): Temporarily stores campaign creation progress to prevent data loss during navigation. Cleared on logout.
- Wizard step tracking (Guru4You_wizard_step): Records the current step in the campaign creation wizard. Cleared on logout.
4.3 No Tracking or Advertising Cookies
Guru4You does not use tracking cookies, advertising cookies, or third-party analytics cookies. We do not engage in behavioral profiling, cross-site tracking, or retargeting advertising. No data is shared with advertising networks.
5. Third-Party Service Providers (Sub-Processors)
We engage the following categories of third-party service providers to deliver the Platform. All sub-processors are bound by Data Processing Agreements and are required to maintain appropriate technical and organizational measures:
Provider Purpose Data Processed Location /
Safeguards
Stripe, Inc. Payment processing Payment method USA (EU SCCs + PCI-
details, billing DSS certified)
information,
transaction records
Brevo (Sendinblue) Transactional email Recipient name, EU (GDPR compliant)
email, campaign
details, invitation
links
OpenAI AI skill extraction, Job descriptions, USA (EU SCCs, no
test generation, assessment context data retention for
response evaluation (PII minimized) training)
Google (Gemini) AI analysis with Job descriptions, USA/EU (EU SCCs,
search grounding company URLs Google DPA)
Anthropic (Claude) AI processing Assessment context USA (EU SCCs)
(PII minimized)
DeepSeek AI processing Assessment context China (EU SCCs +
(PII minimized) supplementary
measures)
Pusher Real-time Channel events, EU/USA (EU SCCs)
notifications user/campaign IDs
Digital Ocean Infrastructure All Platform data EU (GDPR compliant)
hosting, database
Google (Calendar Reading busy/free Busy/free time USA/EU (EU SCCs,
API) calendar availability intervals only (no Google DPA)
for panel members event content)
who opt in
We will notify affected Company Customers at least 30 days in advance of adding new sub- processors. An up-to-date list of sub-processors is available upon request.
6. International Data Transfers
Some of our sub-processors are located outside the European Economic Area (EEA). Where personal data is transferred to countries without an adequate level of data protection (as determined by the European Commission), we ensure appropriate safeguards are in place:
- EU Standard Contractual Clauses (SCCs) pursuant to Commission Implementing Decision (EU) 2021/914;
- Supplementary technical and organizational measures where required (e.g., encryption in transit and at rest);
- Transfer Impact Assessments (TIAs) evaluating the legal framework of the recipient country;
- Binding Corporate Rules where applicable.
Copies of the applicable transfer mechanisms are available upon request from our Data Protection Officer.
7. Data Security Measures
We implement comprehensive technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:
Encryption
- Sensitive company data (tax ID, VAT number, billing address) is encrypted at rest using AES- 256-GCM encryption;
- AI provider API keys are encrypted at rest using AES-256-GCM;
- Test questions and candidate responses are stored as encrypted JSON;
- All data in transit is protected with TLS 1.2 or higher;
- Passwords are hashed using bcrypt with a minimum of 12 rounds (one-way hashing; passwords cannot be recovered).
Access Controls
- Role-based access control (RBAC) with granular permissions;
- Multi-tenant data isolation ensuring company data separation;
- Rate limiting on authentication endpoints (5 attempts per 15 minutes);
- Automatic session timeout after 60 minutes of inactivity;
- Comprehensive audit logging of all administrative actions.
Infrastructure Security
- PostgreSQL database with encrypted connections;
- Regular security updates and patch management;
- Security incident tracking and response procedures;
- IP-based rate limiting for API endpoints.
8. Data Retention
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law:
Data Category Retention Period Basis
Account Data Duration of account + 30 Contract performance
days after termination for
data export
Billing and Tax Data 10 years from end of fiscal Legal obligation
year (German tax law: AO,
HGB)
Candidate Assessment Data As determined by the Company instruction (as
Company Customer; default processor)
12 months post-assessment
or until deletion request
Security Logs 30 days, then anonymized or Legitimate interest (security)
deleted
Consent Records Duration of relationship + 3 Legal obligation
years (limitation period) (accountability)
Audit Logs 3 years from creation Legitimate interest
(compliance)
Calendar Availability Data Rolling 90 days; deleted in Consent (Art. 6(1)(a));
full immediately on withdrawal per Art. 7(3)
disconnect
Upon expiration of the retention period, data is permanently deleted or irreversibly
anonymized. GDPR deletion requests for candidate data are honored and tracked via dedicated
deletion flags in our system.
9. AI Processing and Automated Decision-Making
9.1 AI-Powered Features
The Platform uses artificial intelligence to provide its core features, including skill extraction from job descriptions, test question generation, and candidate response evaluation. When data is sent to AI providers for processing:
- We minimize the transmission of personally identifiable information; job contexts are anonymized where possible;
- Our AI provider contracts prohibit the retention or use of submitted data for model training;
- AI processing is performed in real-time and data is not persistently stored by AI providers beyond the immediate request-response cycle;
- AI provider API keys are encrypted at rest and access is restricted by role.
9.2 Automated Decision-Making (Article 22 GDPR)
The Platform generates AI-based scores and evaluations of candidate responses. These outputs constitute profiling within the meaning of Article 4(4) GDPR. However:
- AI scores are advisory only and do not constitute automated decision-making with legal effects;
- All employment decisions must involve meaningful human review by the Company Customer;
- Candidates have the right not to be subject to decisions based solely on automated processing that produce legal effects or similarly significant effects (Article 22(1) GDPR);
- Candidates may request human intervention, express their point of view, and contest decisions made with the assistance of AI outputs by contacting the Company that invited them to the assessment.
9.3 Anti-Cheating Monitoring
During assessments, the Platform monitors candidate behavior for integrity purposes (focus loss events, suspicious activity patterns, timing anomalies). This monitoring involves automated profiling but does not result in automated decisions. Integrity data is provided to the Company Customer, who determines how to use it in accordance with applicable laws.
10. Your Rights as a Data Subject
Under the GDPR, you have the following rights regarding your personal data. To exercise any of these rights, please contact us at dataprotection@guru4you.io or our Data Protection Officer: Right of Access (Article 15 GDPR)
You have the right to obtain confirmation of whether your personal data is being processed and, if so, access to that data along with information about the purposes, categories, recipients, and retention periods.
Right to Rectification (Article 16 GDPR)
You have the right to request correction of inaccurate personal data and completion of incomplete data.
Right to Erasure (Article 17 GDPR)
You have the right to request deletion of your personal data when it is no longer necessary for the purposes for which it was collected, you withdraw consent, or the data has been unlawfully processed. This right is subject to legal retention obligations.
Right to Restriction of Processing (Article 18 GDPR)
You have the right to request restriction of processing in certain circumstances, such as when you contest the accuracy of the data or the processing is unlawful.
Right to Data Portability (Article 20 GDPR)
You have the right to receive your personal data in a structured, commonly used, and machine- readable format, and to transmit that data to another controller without hindrance.
Right to Object (Article 21 GDPR)
You have the right to object to processing based on legitimate interests (Article 6(1)(f) GDPR) at any time. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
Right Regarding Automated Decision-Making (Article 22 GDPR)
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you. See Section 9.2 for details on how this applies to Platform assessments.
Right to Withdraw Consent (Article 7(3) GDPR)
Where processing is based on consent, you have the right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing performed prior to withdrawal.
Where you have connected a Google Calendar, withdrawal is self-service and immediate: Profile → My Calendar → Disconnect deletes all cached availability data and revokes Google access in the same action, with no need to contact us. Right to Lodge a Complaint
You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. The competent supervisory authority for the Provider is: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Friedrichstr. 219, 10969 Berlin, Germany, https://www.datenschutz- berlin.de.
10.1 Rights of Test Participants (Candidates)
Test Participants whose data we process on behalf of a Company Customer should direct data subject rights requests to the Company that invited them to the assessment, as the Company is the Data Controller for candidate data. We will assist the Company in fulfilling such requests in accordance with our Data Processing Agreement.
10.2 Response Times
We will respond to data subject rights requests within one month of receipt. This period may be extended by a further two months where necessary, taking into account the complexity and number of requests. We will inform you of any such extension within one month of receipt of the request.
11. Children's Privacy
The Platform is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that personal data of a child under 16 has been collected, we will take immediate steps to delete such data.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal requirements, or Platform features. Material changes will be communicated via email or through a prominent notice on the Platform at least 30 days before they take effect. We recommend reviewing this policy periodically. The date of the most recent revision is indicated at the top of this document.
13. Contact Information
For questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact:
Name: Mr. Axel Weber
Email: dataprotection@guru4you.io Address: Axel Weber c/o Impressumservice Dein-Impressum Stettiner Straße 41 35410 Hungen
Phone: +49 1579-2341672
We aim to resolve all privacy-related inquiries promptly. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.