Privacy policy

1. Identity of the controller

Legalpro BV
Registration: BE1005.495.466
Address: Klein Normandie 19, 1950 Kraainem, Belgium
Contact: etienne@alibly.eu

2. Roles under data protection law

In the context of a recruitment process, the recruiter or employer initiating an Alibly check acts as the data controller for candidate data. Legalpro BV acts as a data processor on behalf of that controller.

Legalpro BV acts as an independent data controller for recruiter account data and for compliance, security, and audit logging purposes.

3. Data collected from recruiters

When you use Alibly as a recruiter, we collect:

• Email address for authentication via magic link
• Candidate check details you provide (candidate name, email, company, role)
• Candidate CV (optional, uploaded as PDF). The file is processed once to extract job positions and is immediately discarded. Only extracted structured position data (employer, title, dates) is stored.

Purpose: providing the Alibly service.
Legal basis: contract performance (Art. 6(1)(b) GDPR).

4. Data collected from candidates

When a candidate authorises an Alibly check, we process the following data:

• Consent record (version and timestamp)
• Professional network data transferred to Alibly through official data portability mechanisms, including the LinkedIn Member Data Portability (3rd Party) API:
  • Work history and positions (title, company, dates, location)
  • Connection metadata (connection date, company, role)
  • Connection titles (job position) and company names for classification purposes

Alibly requests access to two specific categories of LinkedIn data: (1) first-degree connection metadata (position title, company name, and connection date) and (2) profile positions (company name, title, and employment dates). No other categories of LinkedIn data are requested or accessed.

LinkedIn data is transferred and processed once per Alibly check. Raw data is discarded immediately after processing. Only anonymised, derived metrics are retained. There is no ongoing access to the candidate's LinkedIn account.

Purpose: generating social corroboration analysis for the recruiter's Alibly check.
Legal basis: explicit consent (Art. 6(1)(a) GDPR).

Where Legalpro BV acts as a processor, the relevant recruiter or employer determines the lawful basis for the recruitment process. Where applicable, Legalpro BV may also rely on Article 6(1)(f) GDPR (legitimate interests) for ensuring platform security, fraud prevention, and service integrity.

5. What is not stored

We do not store:

• Raw connection lists
• Connection names, profile URLs, or email addresses
• LinkedIn messages, posts, private communications, or content
• Unprocessed portability payloads received from third-party platforms
• Uploaded CV files (only extracted position data is retained)
• Individual connection names or identifiers associated with classification data

Only derived analytical metrics and report outputs necessary for the specific recruitment process are retained.

6. Use of artificial intelligence

Alibly uses AI services (currently OpenAI) to assist with data classification and extraction. Specifically:

• Title classification: Job titles from professional network connection data are sent to an AI service to classify seniority level, professional function, and industry sector. Only deduplicated titles and company names are sent. No personal identifiers (names, email addresses, profile URLs, dates of connection) are included in these requests.
• CV position extraction (when a recruiter uploads a CV): The text content of the uploaded PDF is sent to an AI service to extract structured position data (employer name, job title, start and end dates). The uploaded PDF file is not stored. Only the extracted structured data is retained.
• CV-vs-network comparison: Extracted CV positions are compared against positions derived from professional network data to identify matches, date discrepancies, and positions appearing on only one source. This comparison is performed server-side using deterministic logic, not AI.

AI outputs are used for classification and comparison purposes only. No automated hiring decisions or candidate scoring is performed. All AI-generated classifications are clearly labeled as estimates in reports.

OpenAI processes data under a Data Processing Addendum. API data is not used for model training.

7. Data retention

Candidate-derived analytical metrics and reports are retained only for the duration of the relevant recruitment process. Recruiters may delete an Alibly check at any time. Upon deletion, associated data becomes inaccessible and may be permanently purged in accordance with our internal retention schedule.

Raw portability data and unprocessed payloads are discarded immediately after processing.

Recruiter account data is retained while the account remains active and for a limited period thereafter where required for legal, accounting, or compliance purposes.

8. Automated decision-making

Alibly uses artificial intelligence to classify job titles, categorize company sectors, extract position data from uploaded CVs, and compare positions across sources. These are processing aids that generate statistical estimates, not decisions. Alibly does not make automated decisions within the meaning of Article 22 GDPR. All classifications are clearly labeled as estimates. Reports generated by the Service are decision-support tools. All hiring decisions remain solely the responsibility of the recruiter or employer.

9. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you
• Request rectification of inaccurate data
• Request erasure of your data
• Restrict processing in certain circumstances
• Data portability
• Object to processing
• Withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, contact us at etienne@alibly.eu.

You may request deletion of your Alibly check report and all associated derived data at any time by contacting etienne@alibly.eu. The recruiter who created the check may also delete it directly from their dashboard. Deletion permanently removes all derived metrics and report data.

Where Legalpro BV acts as a data processor, we will forward data subject requests to the relevant recruiter or employer acting as controller, unless we are legally required to respond directly.

You also have the right to lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit).

10. Third parties and data transfers

• Hosting: Vercel (US, with EU data processing agreement)
• Database: Neon (managed PostgreSQL)
• AI processing: OpenAI (US, with Data Processing Addendum). Used for job title classification and CV text extraction. No personal identifiers are included in requests.

We do not sell personal data. We do not share personal data with third parties for advertising or marketing purposes. Subprocessors are engaged solely for hosting, infrastructure, and operational support under data processing agreements.

Where personal data is transferred outside the European Economic Area, appropriate safeguards are implemented in accordance with Chapter V GDPR, including standard contractual clauses where applicable.

11. LinkedIn data portability disclosures

Candidate data is accessed through LinkedIn's Member Data Portability (3rd Party) API under the EU Digital Markets Act.

• LinkedIn does not endorse, verify, or sponsor Alibly or its outputs
• Recruiters initiate an Alibly check, and no data transfer occurs unless and until the candidate authorises the transfer through the official portability authorisation flow
• No data is accessed without the candidate's explicit consent

You may revoke Alibly's access to your LinkedIn data at any time through your LinkedIn account settings. Revoking access prevents future data transfers but does not affect reports already generated from previously transferred data, as raw data is discarded immediately after processing.

12. Cookies and tracking

We use authentication session cookies only. These are strictly functional and necessary for the Service to operate. We do not use third-party analytics or tracking cookies.

13. Security measures

We implement appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, role-based permissions, audit logging, and secure infrastructure hosting.

14. Changes to this policy

We may update this privacy policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email.

15. Contact

If you have any questions about this privacy policy or our data practices, contact us at: etienne@alibly.eu