Privacy Policy

Who we are

Sasha Rec AB (“Sasha”, “we”, “us”), company registration number 559553-3851, c/o Recommended By, Epicenter, Malmskillnadsgatan 44 A, 111 57 Stockholm, Sweden, operates the Sasha AI-assisted recruitment screening platform. For any privacy question, contact us at privacy@sasharec.ai.

Two roles — please read the one that applies to you

We handle personal data in two different capacities:

• • As a processor — when you are a candidate. If a recruiter or employer invited you to a screening interview, that recruiter is the controller of your interview data and decides why and how it is used. We process it on their behalf and on their instructions. For your rights about the interview, your first point of contact is the recruiter who invited you — we will assist them.
• • As a controller — for our website and accounts. When you visit our website, request a demo, join our waitlist, or use a recruiter account, we are the controller of that data and this policy governs it directly.

If you are a candidate

You are invited by a recruiter to a short screening conversation for a specific role. Sasha is an AI screening assistant and tells you it is an AI at the start of the call. Every candidate for a given role is assessed against the same criteria and the same scoring rubric and is asked the same opening question for each criterion; the follow-up questions adapt to your answers, and the order can vary with the conversation.

After the call, a separate AI evaluation reviews the transcript against the role's criteria and produces a summary with quotes from your answers as evidence. This is decision support for the recruiter, not a decision. A human recruiter makes the actual decision — Sasha does not automatically advance or reject candidates, and does not make decisions based solely on automated processing (Article 22 GDPR). Sasha does not perform biometric identification or emotion recognition and does not infer personality traits or protected characteristics.

What we process: the name, email and access PIN you use to join; your spoken answers, processed in real time into a transcript; your salary expectations and availability (such as notice period or earliest start) if Sasha asks and you choose to share them — these are optional, passed to the hiring team as-is, and not scored; the AI evaluation (scores, per-criterion summaries, evidence quotes); and the technical data needed to run the call. We do not keep the raw call audio after the call ends — we keep the transcript and the evaluation.

The transcript and evaluation are available to the recruiter who invited you and to Sasha staff who operate the platform. The legal basis and retention period are set by the recruiter (the controller) — typically their legitimate interest in assessing candidates; retention follows their data policy, and you can ask them for specifics. Please do not volunteer special category data (such as health, religion, or political opinions) — it is not needed and is not used in the evaluation.

If you are a website visitor or recruiter

When you browse our site we process usage and device data and cookies to run and improve the site (our legitimate interests, and your consent where required). When you request a demo or join our waitlist we process the contact details you provide, to respond to you and take steps toward a possible agreement. When you use a recruiter account we process your account identity, authentication data, and activity logs to provide the service.

Automated decisions and the EU AI Act

The Sasha system is used in recruitment and is treated as a high-risk AI system under the EU AI Act (Annex III, point 4); the relevant obligations apply from 2 August 2026. The service is a decision-support tool with a mandatory human review step. AI-generated scores and summaries are non-binding; the recruiter can disregard, modify or override them and makes the recruitment decision.

Service providers and where your data is processed

Personal data is stored at rest within the EU/EEA. Some processing in transit is carried out by specialist providers located in the United States; those transfers are made under the EU Standard Contractual Clauses (and, where applicable, the EU–US Data Privacy Framework) with supplementary measures. We do not use your interview data to train foundation models, and our language-model providers do not train on it. The full list is on our service providers page.

Security

We apply appropriate technical and organisational measures, including access controls, tenant isolation, encryption in transit and at rest where appropriate, audit logging, and confidentiality undertakings for our personnel. Our observability tooling is configured to exclude the content of prompts and answers.

Retention

• • Raw call audio is not retained after the call ends.
• • Candidate transcripts and evaluations are kept according to the inviting recruiter's retention policy (we act on their instructions).
• • Website, account and marketing data is kept for as long as needed for the purpose described, then deleted or anonymised.

Your rights

You have the rights under the GDPR to access, rectification, erasure, restriction, portability, and objection, and to withdraw consent where processing relies on it.

• • Candidates: because we process your interview data as a processor, please send these requests to the recruiter who invited you (the controller). We will assist them, including with requests for human review and, from 2 August 2026, an explanation of AI-assisted decisions.
• • Website and account data: contact us at privacy@sasharec.ai.

You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) or your local supervisory authority.

Cookies, children, and changes

We use strictly necessary cookies to operate the service and limited analytics and anti-bot tooling. The service is intended for adults in a professional recruitment context and is not directed to children. We may update this policy; we will note the date above and, for material changes, give notice before they take effect. Prior versions are available on request.