Privacy Policy

Phaedra Solutions ([CONFIRM: exact registered legal form, e.g. “Phaedra Solutions (Private) Limited”]), a company headquartered in Lahore, Pakistan ([CONFIRM: full registered company address], registration [CONFIRM: company registration number]), operates Rubrily, an AI-first applicant tracking system at rubrily.com andapp.rubrily.com. In this policy, “we”, “us” and “our” mean Phaedra Solutions; “the Service” means Rubrily.

This policy explains how we handle personal data when we decide why and how it is used — in legal terms, when we act as a controller. That covers three groups of people:

• visitors to our websites;
• prospects — people who book a demo, download a template or subscribe to our newsletter; and
• customer account users — people who create and use a Rubrily account on behalf of an organization.

If you are a job candidate, this is not your document. When you apply for a job with an employer that uses Rubrily, that employer controls your data and we process it on the employer’s instructions. The Candidate Privacy Notice explains exactly what happens to candidate data, in plain language.

Questions about anything here: privacy@rubrily.com. We have appointed an internal privacy contact. We have not appointed a statutory Data Protection Officer (none is currently required for our processing). [CONFIRM: DPO requirement re-assessment as processing scales].

We collect personal data in five ways:

• Demo requests. Name, work email, company name and team size, plus anything you write in the “what would you like to see” field.
• Template downloads and newsletter. Your email address. The signup text says what you get: the file plus one hiring email a month.
• Customer accounts and billing. Name, work email, organization details, role and permissions, security and audit logs, and — for paid plans — billing details. Payment card numbers are handled by a payment provider, not stored by us ([CONFIRM: payment processor for paid tiers and candidate add-ons]).
• Support. The content of your messages to us and the contact details you use to send them.
• Technical data. Server logs (IP address, user-agent, requested pages, timestamps) kept for security and debugging, and — once our consent banner ships — consent-gated analytics events via PostHog, plus a first-party attribution cookie that remembers which campaign first brought you here. The Cookie Policy lists every cookie with its lifetime.

We do not buy contact lists, enrich profiles from data brokers, or collect data about you from social networks.

Under Article 6 GDPR, each use of personal data needs a lawful basis. Here is the complete map:

Where we rely on legitimate interests, we have weighed those interests against your rights and use the least data that does the job. You can object to any legitimate-interest processing — see Your rights.

On the marketing and account side there is no solely-automated decision-making that produces legal or similarly significant effects about you (Article 22 GDPR). For how automation works in candidate screening — which the employer controls — see the Candidate Privacy Notice.

The Cookie Policylists every cookie we set, what it does, how long it lives, and how consent and withdrawal work. Analytics cookies never run before you consent, and our analytics configuration respects your browser’s “Do Not Track” signal.

We share personal data only with:

• Subprocessors and service providersthat host and operate the Service under contract with us. The complete, maintained list — with each provider’s function, location and transfer mechanism — is at rubrily.com/subprocessors.
• Professional advisers (lawyers, accountants, auditors) under confidentiality, where we need their advice.
• Authorities, if a law, court order or binding request requires it. We review every request and disclose the minimum required.
• A buyer or successor, if we are ever part of a merger, acquisition or asset sale — with notice to you and this policy continuing to apply.

We do not sell personal data. We do not share it for advertising.

We are headquartered in Lahore, Pakistan, and our service providers operate in other countries, including the United States. When personal data protected by the GDPR or UK GDPR leaves the EU/EEA or the UK, we protect it with the European Commission’s Standard Contractual Clauses (2021/914) — and the UK Addendum where UK data is involved — plus any additional technical measures a transfer assessment calls for.

We are not certified under the EU–US Data Privacy Framework and make no claim to it; our transfer tool is the SCCs. The subprocessor list shows the location and transfer mechanism per provider.

Not yet appointed. If you are in the EU/EEA, contact privacy@rubrily.com and we will route your request. [CONFIRM: appoint or formally waive an EU (Art 27 GDPR) representative before EU enterprise sales]
Not yet appointed. If you are in the UK, contact privacy@rubrily.com and we will route your request. [CONFIRM: appoint or formally waive a UK (Art 27 UK GDPR) representative]

When a retention period ends, we delete or irreversibly de-identify the data. Backups roll off on their own schedule shortly after.

If the GDPR or UK GDPR applies to you, you have the right to access the personal data we hold about you (Art 15), correct it (Art 16), have it deleted (Art 17), restrict how we use it (Art 18), receive it in a portable format (Art 20), and object to processing based on legitimate interests (Art 21). Where processing rests on consent, you can withdraw consent at any time, without affecting what happened before withdrawal.

To exercise any right, email privacy@rubrily.com. We may need to verify you are who you say you are; we respond within one month (extendable by two months for complex requests, and we will tell you if so). Exercising your rights is free.

You also have the right to complain to a data protection supervisory authority — in the EU, the authority of your member state; in the UK, the ICO. We would appreciate the chance to resolve your concern first, but you do not need our permission to complain.

If your request concerns candidate data, the employer you applied to controls it — the Candidate Privacy Notice explains the fastest route, and we assist the employer with these requests under our DPA.

Our websites and the Service are directed at businesses and working professionals, not at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact privacy@rubrily.com and we will delete it.

The measures protecting your data — per-organization tenant isolation with row-level security, role-based access control, candidate consent gates, in-product erasure workflows and PII-scrubbed shared reports — are described on our security page and, in contractual form, in Annex II of the DPA. If you find a vulnerability, email legal@rubrily.com and we will respond quickly.

When we change this policy, we update the “last updated” date and the version number above. For material changes we give prominent notice on the site — and email account owners — before the change takes effect. Earlier versions are available on request from privacy@rubrily.com.