Privacy Policy

Saplic is a job and people-management platform. This document explains what personal data we process, what for, who we share it with, and what you can do about it. It is written to be understood without a law degree.

It covers everything we offer today: the public job board, the recruitment module (ATS) used by companies, candidate assessments, and the HR and payroll module, the last one available only to companies in El Salvador.

If anything here is unclear, write to us at contacto@saplic.com. We would rather explain it than leave you guessing.

The controller of the data entered directly into Saplic is:

There is one case where Saplic is not the controller: CVs a company uploads to its ATS about people who are not Saplic users. There the company is the controller and we act as processor. See Third-party CVs uploaded by companies.

Saplic operates in 40 countries. Depending on where you are, different frameworks protect you. We expressly recognise the following, and in each case we apply whichever gives you more protection:

Four things the GDPR requires and we comply with

• An explicit legal basis per purpose. Every use we make of your data has a declared legal basis. See the table in What we use it for.
• A 30-day response deadline. We answer any rights request within 30 calendar days of receiving it. If the case is complex and we need longer, we tell you within that same period and explain why.
• Effective portability. On request we hand over your data in a structured, machine-readable file (JSON or CSV) — not a PDF, not screenshots.
• No automated decision-making. Saplic does not make decisions producing legal or similarly significant effects based solely on automated processing. Neither an assessment score nor any internal ranking rules anyone out on its own: the decision is made by a person at the recruiting company. See Candidate assessments.

If you are in the EU, Brazil or South Africa and believe we handled your request poorly, you have the right to complain to your national supervisory authority. Write to us first if you can — it is almost always faster.

If you are looking for a job

• Account: first and last name, email, phone and country. If you sign in with Google or Facebook, we receive your name, email and profile picture from them — never your password.
• Professional profile: CV, work experience, education, skills, salary expectations and availability. You enter it and you can delete it.
• Activity: jobs you applied to, saved jobs, job alerts and messages with companies.
• Technical data: IP address, browser and operating system, pages visited, and date and time.

If you are a company

• Account and company: trade name, tax ID, address, phone, email, industry and logo.
• Users: name, email and role of each person you add to the account.
• Jobs and processes: what you publish and how your candidates move through the ATS.
• Payments: transaction records. We do not store card numbers: Wompi processes them and they never reach our servers.
• HR and payroll (El Salvador only): your employees' data, salaries, deductions, leave and loans. You enter it, about your own staff, and you are responsible for having a legal basis to process it.

If you were invited to an assessment

Detailed under Candidate assessments. No Saplic account is required.

What we do not collect

We neither ask for nor want data on health, ethnic origin, religion, political or union membership, sex life or criminal records. If a company types such data into a free-text field, it does so on its own account and against our instructions.

Every purpose has its declared legal basis. Here is the full table:

Where the basis is consent, you can withdraw it at any time and without giving reasons; that does not affect what we did before you withdrew it. Where the basis is legitimate interest, you can object and we will assess the case.

We do not sell your data. Ever. We also do not hand it to third parties so they can advertise to you.

The recruitment module lets a company upload CVs of people who do not have a Saplic account: CVs received over WhatsApp, by email, through a referral or on paper. This section explains exactly what happens with that data, because this is where it is easiest to lose track of who answers for it.

Who answers for that data

In this case the company is the controller and Saplic is only the processor. We store and process those CVs following the company's instructions; we do not decide what is done with them.

It is the company that must have a legal basis for having collected that CV — normally the person's consent when sending it for a specific process — and that must inform the person their data is being processed. By using the module, the company declares that it complies.

What Saplic does with them

• Stores them. The file is kept in Azure Blob Storage in a private container: not reachable by public URL, not indexable by search engines. It is served only to authenticated users of the owning company.
• Uses them for nothing else. They do not feed models, they are not used for advertising, and they do not build any Saplic candidate database.
• Never shares them between companies. Each account sees only its own candidates. A CV uploaded by one company never appears in another company's ATS, even if both uploaded the same person.
• Does not publish them. These candidates are not part of the public job board and have no visible profile on saplic.com.

If your CV is there and you never registered

You can exercise your rights all the same, without creating an account. There are two routes and both work:

1. Write to the company holding your CV. It is the controller and can delete it directly from its panel.
2. Write to us at contacto@saplic.com with the subject "CV uploaded by a company". We need your full name and the email or phone shown on the CV so we can locate it. If you know which company holds it, say so — it speeds everything up.

If you write to us, we do two things within 30 days: we confirm whether we found data about you, and we forward your request to the controlling company. Where the request is for deletion and the company does not respond within a reasonable time, we delete the file anyway: we are not going to keep the CV of someone who asked for it to be removed.

How long they are kept

• For as long as the company keeps the candidate in its ATS and its account active.
• If the company closes its account, its candidates and the associated files are deleted within 90 days. That window exists so an accidental closure can be reversed; after it, deletion is final and no recoverable copy remains.
• If the person requests deletion, it is deleted without waiting for any deadline.

A company may invite you to take an assessment as part of a selection process. You receive a unique link by email or WhatsApp. You do not need a Saplic account to take it.

What data is collected

• Your answers to each question.
• Timings: when you started, when you finished and how long you took. The clock is kept by our server.
• Your IP address and browser identifier (user-agent), on start and on finish.
• The result: score obtained out of the maximum, percentage, correct, incorrect and skipped answers, and whether the test was closed by the time limit.
• The date and version of this policy you accepted before starting.

IP and user-agent are recorded for one reason only: to evidence that the test was taken in a single session from start to finish. They are not used to profile or locate you.

Who sees the result

Only authorised staff of the company that invited you, inside its own ATS. No other company sees it. Saplic does not publish it or use it for anything else. If the company enabled that option, you also see your result when you finish.

Your rights over the assessment

You can request access to your result even without a Saplic account. Write to contacto@saplic.com from the same address the invitation was sent to, or quoting the phone number it was sent to, and we will provide it within 30 days. The same applies to rectification or deletion.

How long it is kept

• Invitations, answers and results: for the duration of the selection process and up to 24 months afterwards, unless you request deletion earlier.
• If the company closes its account, they are deleted along with the rest of its data, within 90 days.
• Invitations that were never opened are purged after 12 months.

We would rather say this before anyone asks.

Saplic publishes around 8,000 job postings and some 2,300 company profiles built from information published in public sources: job adverts the companies themselves circulated on websites, portals and openly accessible social media. Those companies did not register with Saplic and did not give us that information directly.

What such a profile contains

Organisation data, not personal data: trade name, industry, city, logo where public, and the job adverts the company itself circulated. We do not include personal data of its employees or internal contacts.

What the company can do

• Claim the profile and take control of it to update it and post on its own. Every profile carries a link to claim it.
• Correct anything wrong or out of date.
• Ask for it to be removed, with no need to explain or justify why.

For any of the three: write to contacto@saplic.com from an address on the company's domain, giving the profile name and link. We respond within 30 days; in practice, much sooner. Removal requests are carried out without argument.

If you are an individual named in one of those adverts — as an application contact, for instance — write to us anyway and we will take it down.

We share data only with the providers needed for the platform to work, and only the minimum each one needs. All are contractually bound to process it solely for the service they provide.

We may also disclose data when a competent authority requires it through a valid order. If that happens and the law lets us tell you, we will.

We use few cookies and none for advertising. These are all of them, with their real names:

The necessary ones cannot be switched off without breaking the site. The analytics ones you can block from your browser settings or with an extension, and the site keeps working.

• Encryption in transit: the whole site runs over HTTPS (TLS).
• Passwords: stored hashed; nobody at Saplic can read them, ourselves included.
• CVs: in a private Azure Blob Storage container, served only to authenticated users with permission over that candidate.
• Isolation between companies: every database query filters by company. One account cannot see another's data, neither by mistake nor by tampering with the URL.
• Minimal internal access: only staff who need it to operate or provide support.
• Access logging and error monitoring.

No system is infallible. Should a security breach put your data at risk, we will notify you and report it to the relevant authority within the deadlines set by applicable law — 72 hours under the GDPR.

Where a legal deadline forces us to keep something, we keep it for that alone and use it for no other purpose.

Over your personal data you may exercise, free of charge:

• Access: know what data of yours we hold and what we do with it.
• Rectification: correct anything wrong or incomplete.
• Erasure: ask us to delete it.
• Restriction: ask us to stop using it while a dispute is resolved.
• Objection: object to processing based on legitimate interest.
• Portability: receive your data in a structured, machine-readable JSON or CSV file, to take wherever you want.
• Not to be subject to automated decisions with legal or similar effects. We already comply by design: no decision is made without a person involved.
• Withdraw your consent where that is the basis, without affecting what was done before.

How to exercise them

Write to contacto@saplic.com from your account email, or from the address you were contacted at if you have no account. Tell us what you want; no form and no legal wording required.

We respond within 30 calendar days. If the request is complex and we need longer, we tell you within those same 30 days and explain why. We may ask you to prove your identity before handing over data: that is to protect you from someone else requesting it while pretending to be you.

If you are not satisfied with our response, you can complain to the data protection authority in your country.

Saplic does not yet have a self-service button to delete your account from the panel. We are not going to promise it as if it existed. Today deletion is requested and we carry it out, through any of these routes:

1. The Data deletion page, which explains the procedure step by step.
2. An email to contacto@saplic.com with the subject "Data deletion", from your account address.
3. WhatsApp to +503 2514-0552.

What gets deleted

Your name, email, phone, CV, professional profile, application history, alerts, messages and your Google or Facebook connections. If you are a company: your job postings, your candidates, the files you uploaded and your account data.

What may remain, and why

Only what a law obliges us to keep — for example invoicing records for the tax period — and aggregated or anonymised data that can no longer identify you. None of it is used to contact you.

How long it takes

Within 30 days of receiving the request. We confirm by email once it is done.

Saplic is not aimed at minors and we do not knowingly create accounts for people below the minimum working age in their country.

If we detect — or someone tells us — that an account belongs to a minor without the authorisation local law requires, we delete it along with its data. If you are a parent or guardian and believe we hold data on a minor in your care, write to contacto@saplic.com and we will resolve it immediately.

Saplic operates from El Salvador and its infrastructure runs on Microsoft Azure. If you are in the European Union, Brazil or South Africa, your data is transferred outside your country so we can provide the service.

Those transfers rely on the Standard Contractual Clauses approved by the European Commission with our infrastructure providers, and on the equivalent safeguards foreseen by the LGPD and POPIA. We choose providers offering that framework precisely so we can operate in those countries.

If you want to know which specific region hosts your data, write to us and we will tell you.

This policy may change when the product or the law changes. Every version carries a number and a date, at the top.

If a change affects you significantly — a new purpose, a new recipient, processing that did not exist before — we notify you by email or with a visible notice on the platform before it takes effect.

The version number is not decorative: it is what gets recorded when someone accepts this policy before taking an assessment, so that afterwards it is possible to know exactly which text they accepted.

For any privacy question, to exercise your rights or to report a problem:

Write in Spanish, English or Portuguese: we reply in the language you write in.