Candidate data: how long it is kept and how people ask for it
Applications are deleted 3 to 24 months after a job closes, and candidates can see, download or delete their data.
Every apply form has a consent line with a link to a short privacy notice for your business. Your business decides why it uses the details; Viremail keeps them for you.
How long
Under Hiring, Settings, choose how long you keep candidate data: 3 months, 6 months (the default), 1 year or 2 years. It counts from when the job closes, or from when someone was rejected. When the time is up, their application, CV, notes, ratings and interview plans are deleted. People you hired are kept: they are staff now.
When a candidate asks
On your careers page, How your business handles your application has a form. A candidate types the email they applied with and we email that address a link, valid for 24 hours, that shows what you hold, with Download my data and Delete my applications. The page says the same thing whether or not they applied, so nobody can find out who did. You get a notification when someone deletes their data. You can also delete an application yourself from the candidate's page.
Safe files, no spam
CVs must really be PDF, Word, OpenDocument, RTF or text files. Programs, Word files with macros, RTF with embedded objects and PDFs that run scripts are refused. Every CV and offer letter is encrypted where it is stored, and only people who handle hiring can open them. Bots are stopped by a field people never see, a check on how fast the form is sent, and limits on how many applications one network can send.