Privacy Policy
Last updated: October 2026
This policy is available in English, French and Dutch.
1. Who we are
Neurho Solutions SRL ("Rhox", "we", "us") operates Rhox, the candidate portal for our recruitment services. This policy explains what personal data we process about you, why, and your rights.
Data controller
Neurho Solutions SRL, Rue de Priesmont 153, 1495 Villers-la-Ville, Belgium. BCE/KBO 0464.600.997, VAT BE 0464.600.997.
Privacy contact
2. What data we collect
We collect data directly from you (registration, CV, applications), automatically (see our Cookie Policy), and from third parties: LinkedIn if you sign in or connect with LinkedIn (profile details and photo), and referrals. Categories:
- Identity data: Name, email address, phone number, postal address, profile photo, and your date of birth, nationality and gender where a client's compliance process requires them or our recruiters recorded them (since October 2026 our AI never takes them from your CV)
- Professional data: CV, work history, job titles, employers, skills, certifications, education, languages, work authorization
- Employment preferences: Desired salary, preferred locations, availability, work mode (remote/hybrid/onsite), notice period
- Technical and usage data: IP address, browser and device information, sign-in history, pages viewed and features used (linked to your account only if you accept analytics cookies)
- Correspondence: Emails you exchange with our recruiters. We keep only those, as text, and read what you state about your skills, experience, languages and availability to match you with missions, as we do with your answers to client questionnaires. Other people's contact details are removed first, and nothing about your age, gender, origin, family or health is used.
Identity documents
Where a client's compliance process requires it, we ask you at that step for a copy of your identity document. We tell you before you upload it and keep it only as long as that process requires.
Is providing your data mandatory?
Registration fields marked as required are necessary to provide our recruitment services; without them we cannot create your account or match you with jobs. Everything else is optional.
Talent pool
Unless you object or delete your account, we keep your profile in our recruitment reserve so we can consider you for future opportunities.
3. Why we process your data, and on what legal basis
We process your data for the following purposes:
To provide the service (contract, Article 6.1.b GDPR)
Creating and maintaining your profile, matching you with job opportunities, managing applications and proposals, and communicating with you about them
With your consent (Article 6.1.a GDPR)
Sharing your profile with a specific client, marketing communications, analytics and marketing cookies, processing data your CV happens to contain about your health or other sensitive matters (Article 9.2.a)
For our legitimate interests (Article 6.1.f GDPR)
Keeping the platform secure and preventing fraud, improving our services, producing cookieless visit statistics (see the Cookie Policy). You can object at any time
To comply with the law (Article 6.1.c GDPR)
Accounting, tax and social-security obligations, and responding to lawful requests from authorities
4. How we use AI
Our code, not AI, compares you with our missions: it checks the skills, languages, experience and education on your profile and in your CV, what you told us in your answers and emails, your availability, the country you live in and whether you need a work permit against what each mission asks. Its results are what our recruiters see and what the Rhox app shows you about your fit with a job. We use artificial intelligence for the tasks below. For them, your CV, your profile data, your answers and your emails, and for our recruiters' assistant any other data in your file (section 2), are processed by our AI provider (currently OpenAI, acting on our instructions), which does not use them to train its models and keeps them for no more than 30 days to detect misuse, unless a longer period is required by law or needed to prevent harm.
What AI does
It reads the CV you upload or that reaches us and turns it into a structured profile, never taking your date of birth, gender, nationality or availability from it. It reads the text of each mission to list what the mission asks, with no data about you. It reads what you state about yourself in your emails to our recruiters (section 2). It turns the professional part of your profile into a numerical summary that our code uses only to order matches that are otherwise equal. When we ask you for the right to represent you on a mission whose client asks questions, it prepares suggested answers from your profile, your CV and your earlier answers; you can keep or remove each one before you reply. At our recruiters' request, it also assesses how readily clients would take your profile, writes the paragraph that presents you in the CV we send a client and translates that CV when needed, prepares their calls with clients (with your skills and availability, never your name) and answers their questions about our records.
The human role
Our code and AI produce suggestions and rankings; they do not select candidates. A Rhox recruiter reviews suggestions, applies their own judgement and decides whom we contact and whom we propose, and we present you to a client only after you confirm you want us to.
Your choices
You can ask how our code and AI were used in your file, ask a recruiter to take a second look at a decision about your application, and object to automated matching or to AI assessments of your profile. We will consider your request and tell you the outcome. Contact: contact@neurho.com.
5. The Rhox Plugin (Claude and ChatGPT)
The Rhox Plugin lets you use Rhox inside an AI app you choose, today Claude (Anthropic) or ChatGPT (OpenAI). It works only once you connect it yourself, from that app, with your Rhox account, and you can disconnect it at any time.
What is processed
When your AI app asks, Rhox sends it the open missions as Rhox publishes them (without client names, rates or margins) and the professional part of your profile: skills with years, languages and levels, certifications, education, the titles and dates of the roles you held, your availability, and your town and region for job searches. It also sends counts of how many missions ask a keyword, and how rare the keywords of your own profile are among Rhox candidates, as a band (rare, uncommon, common), never a count of people or a rank. It also sends where your own applications stand: the interests you sent, the Right to Represent requests and the proposals Rhox made for you, with their step and status as the Rhox app shows them, without the company's name, rates or your answers. It never sends your contact details, date of birth, gender, nationality, ID documents, work permit, photo, CV file or its text, the names of your employers or your references. If you confirm it in the conversation, your AI can also change the skills, languages, certifications, education and roles (title, employer and dates) of your profile; Rhox never sends it back an employer the profile holds. Legal basis: the service you asked for (contract); the records below serve our legitimate interest in running it securely.
Your conversations
Rhox never receives or stores your conversations with your AI app. It receives only the requests your AI makes to the plugin, such as a search with its filters.
What Rhox records
For each request: your account, the AI app, the tool used, its filters (any free text only as its length, never its words), the outcome, the size of the answer and its duration. Each record is kept 180 days; after that only daily totals per tool remain, until your account is deleted. The profile changes your AI made are kept 180 days, the latest ones listed in Settings > Connected AIs with an Undo; the AI apps you connected (which app, when you allowed it, when it was last used, when it was disconnected) are kept until your account is deleted. All of this is deleted with your account, except the audit entry of each change your AI made, which is kept without your email or IP address like our other security logs (section 8). We use these records to run the plugin, apply its limits, prevent abuse and see how it is used.
Your AI app
Claude is provided by Anthropic and ChatGPT by OpenAI. What you write to them, and what Rhox sends them at your request, is processed under their own terms and privacy policies, not on our instructions, and possibly outside the EEA. Check their settings for how long they keep your chats and whether they use them to train their models. This is separate from the AI processing we do ourselves (section 4).
Disconnecting
In Settings > Connected AIs, Disconnect ends the connection at once: your AI app can no longer reach Rhox. Removing the connector in Claude or ChatGPT alone may not end it on our side, so disconnect in Rhox too. We may end a connection ourselves to protect your account.
6. Who receives your data
Rhox recruiters
Our recruitment staff, who review profiles and manage matching
Client companies
Only when you express interest in a specific job or confirm a proposal for a specific client
Service providers
Providers processing data on our instructions:
- Supabase (database and authentication hosting, EU region)
- OpenAI (AI processing of CVs, profiles, questionnaire answers, the emails you exchange with our recruiters and, through our recruiters' assistant, other data in your file; OpenAI Ireland Ltd, which may process data in the United States under the European Commission's Standard Contractual Clauses)
- Google (analytics and advertising measurement, United States, only with your consent)
- Vercel (website hosting, and site analytics and performance measurement with your consent)
- Cloudflare (Turnstile bot protection on the sign-up, sign-in and password forms, United States)
- Resend (transactional email delivery)
- Apple (map display when you open the jobs map)
- LinkedIn (only if you choose to sign in with LinkedIn)
7. International transfers
Your data is hosted in the EU. Where a provider processes data outside the EEA (OpenAI, Google, Vercel, Cloudflare: United States), the transfer is covered by an EU adequacy decision or by the European Commission's Standard Contractual Clauses. You can request a copy via contact@neurho.com.
8. How long we keep your data
- Your account and profile: While your account is active, and up to 2 years after your last activity; we contact you before deleting
- Accounting and tax records: 7 years, as required by Belgian law
- Contracts and records needed for legal claims: 10 years, matching the Belgian limitation period
- Rights to represent you confirm: When you confirm that we may present your CV to a client for a mission, we keep what you confirmed, when, the IP address and device you used, and the document we give the client and its intermediary, for 10 years, including after you delete your account: it is the proof of your agreement that clients and their intermediaries may ask for (Articles 7(1) and 17(3)(e) GDPR)
- Security logs: Up to 3 years, for fraud prevention and security investigations
- Rhox Plugin records: Each request your AI app makes: 180 days, then daily totals only, until the account is deleted; the profile changes it made: 180 days; the AI apps you connected: until the account is deleted
9. Your rights
Under the GDPR you have the right to:
Access (Article 15)
Get a copy of the personal data we hold about you
Rectification (Article 16)
Correct inaccurate or incomplete data
Erasure (Article 17)
Have your personal data deleted, apart from the records section 8 says we keep after an account is deleted
Restriction (Article 18)
Limit how we use your data
Portability (Article 20)
Receive your data in a portable format
Objection (Article 21)
Object to processing based on our legitimate interests
Withdraw consent (Article 7)
Where processing is based on your consent, withdraw it at any time; this does not affect processing that already happened
Automated decisions (Article 22)
Not be subject to a decision based solely on automated processing that legally or similarly significantly affects you; we do not make such decisions
How to exercise your rights
Write to contact@neurho.com. We respond within one month.
10. Contact, complaints and changes
Contact
Privacy contact: contact@neurho.com
Neurho Solutions SRL, Rue de Priesmont 153, 1495 Villers-la-Ville, Belgium
Right to complain
You can lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit) if you believe your rights have been violated.
Changes to this policy
If we make significant changes, we will tell you by email or in the app.