Who are we?
Company name: GENIUS for PEOPLE, S.L. · Tax ID (CIF): B44879849 · Main activity: Software development, cloud-based business management programs, web development, and e-commerce. · Address: C/ Badajoz Nº 32, 08005, Barcelona · Contact email: admin@mainder.ai · Website: http://www.mainder.ai. We are at your disposal—please don't hesitate to contact us.
What will we use your data for?
In general, your personal data will be used to maintain our relationship with you and to provide our services. They may also be used for other activities, such as sending you advertising or promoting our activities.
Why do we need to use your data?
Your personal data is necessary for us to interact with you and provide our services. To this end, we will provide you with checkboxes and clear options so you can easily decide how your personal information is used.
Who will have access to your information?
In general, only authorized personnel from our company will have access to the information you provide. In some cases, other entities that need access to your data in order to provide our services may also view it. For example, our bank will have access to your details if payment for our services is made by card or bank transfer. Additionally, public or private entities to which we are legally required to disclose your personal data may also have access—for example, tax authorities in compliance with tax law. If, outside of these cases, we need to share your personal information with other entities, we will first ask for your permission through clear options that allow you to decide.
How will we protect your data?
We protect your data with effective security measures appropriate to the risks involved in its use. To this end, our company has approved a Data Protection Policy and conducts annual controls and audits to ensure that your personal data remains secure at all times.
Google data we collect and access
When you authorize Mainder to connect with your Google account, we access the following specific types of data depending on the permissions (scopes) you grant: Google Profile Information (full name, primary email, profile picture if available, unique Google user ID); Gmail Data if authorized (reading emails related to recruitment, sending emails on your behalf, metadata, attachments such as CVs, draft creation, label management); Google Calendar Data if authorized (reading events, creating interview events, modifying events, attendee information, Google Meet links); Google Contacts Data if authorized (professional contacts, contact details, notes, groups); Google Drive Data if authorized (files explicitly shared with Mainder, CVs and candidate documents, shared recruitment folders).
How we use Google data
Google data is used exclusively to provide and improve Mainder's recruiting functionalities: communication management (interview invitations from Gmail, automated candidate responses, conversation sync, attachments); interview scheduling (availability checks, calendar events, Google Meet links, reminders); talent database management (importing contacts, enriching profiles, organizing groups); document storage (CVs and portfolios in Drive, process organization, team sharing). We do not use Google data for advertising or marketing unrelated to the requested services, selling data to third parties, creating profiles for other purposes, training AI models without explicit consent, or any purpose not described in this policy.
Google data storage and protection
We implement enterprise-grade security measures: encryption in transit (TLS 1.3), encryption at rest (AES-256), OAuth 2.0 authentication with temporary tokens, mandatory 2FA and RBAC, full access logs retained for 90 days, and full data isolation between clients. Primary servers: AWS EU-West-1 (Ireland). Backups: AWS EU-West-2 (London). Compliance: GDPR, ISO 27001, SOC 2 Type II (in progress).
Google data retention and deletion
Active subscription: data retained while you use Mainder. After cancellation: 90-day retention for potential reactivation, then automatic deletion. Access tokens renewed or expired per Google's configuration. To request immediate deletion: email privacy@mainder.ai, web form https://mainder.ai/eliminar-datos, response within 72 business hours, with data deletion certificate by email.
Google access revocation
You can revoke Mainder's access at any time from Mainder (Settings → Integrations → Google Workspace → Disconnect) or from Google (https://myaccount.google.com/permissions → Mainder → Remove access). Revocation stops new data access immediately, deactivates Google-dependent features, and previously processed data is retained per our retention policy. You can reconnect anytime.
Compliance with Google policies
Mainder strictly complies with Google API Services User Data Policy, Google OAuth 2.0 Policies, Limited Use Requirements, Google Cloud Platform Terms of Service, and sensitive/restricted scope verification. We conduct annual review of Google policy compliance, quarterly security audits, and Google Workspace Developer Certification (in progress).
Transparency of requested Google scopes
Mainder requests access to Google OAuth 2.0 scopes required for the integrations you enable (profile, Gmail, Calendar, Contacts, Drive as authorized). The exact scopes depend on the permissions granted in your specific integration configuration.
Updates to this policy
This policy is updated whenever Google's services or policies change. We will notify you by email about significant changes. The date of the last update appears at the end of this document. Your continued use constitutes acceptance of any changes.
Contact and privacy requests (Google data)
To exercise your rights regarding Google data or for any inquiries: Privacy email: admin@mainder.ai.
Providers that process browsing data
GENIUS FOR PEOPLE, S.L. relies on the following providers, which process browsing data on our behalf. PostHog: product analytics, with the project hosted in the European Union region and collection sent, through this website itself, to PostHog's European endpoint; it records the pages visited, clicks and other interactions with the page, heatmaps and session recordings in which the content of form fields and of elements marked as sensitive is masked and not recorded; it does not create person profiles for unidentified visitors. Google Analytics 4 and Google Tag Manager: audience measurement; the Google Analytics 4 code is only loaded if you accept the statistics category, and tags managed through Google Tag Manager operate under Google Consent Mode v2 with the four signals denied by default. YouTube (Google): embedded videos, only loaded after you accept the marketing category. Vercel: website hosting and performance measurement (Core Web Vitals metrics through Speed Insights).
Will your data be sent to other countries?
Some countries are considered safe for your data, and others are not. For example, the European Union is considered a safe environment. Our policy is not to transfer your personal information to any country that is not deemed secure in terms of data protection. If, for service-related reasons, it becomes necessary to send your data to a country less secure than Spain, we will always request your prior consent and implement effective security measures to reduce any risks associated with the transfer.
How long will we keep your data?
We will retain your data for the duration of our relationship and as long as required by law. Once the applicable legal periods expire, we will securely delete your data in an environmentally responsible manner.
What are your data protection rights?
At any time, you may contact us to know what information we hold about you, correct it if it is inaccurate, and delete it once our relationship ends, if legally permitted. You also have the right to request the transfer of your data to another entity (data portability). To exercise any of these rights, submit a written request to our address with a copy of your ID. Specific forms are available at our offices. For more information, visit the Spanish Data Protection Agency (www.agpd.es).
Can you withdraw your consent later?
You can withdraw your consent regarding the use of your data at any time. For example, if you previously agreed to receive advertising about our products or services but no longer wish to, you can notify us through the opposition form available at our offices.
Where can you file a complaint?
If you believe your rights have been disregarded by our company, you can file a complaint with the Spanish Data Protection Agency: electronic headquarters www.agpd.es; postal address Agencia Española de Protección de Datos, C/ Jorge Juan Nº 6, 28001 Madrid; telephone 901 100 099 / 912 663 517. Filing a complaint with the Agency is free of charge and does not require a lawyer.
Will we create profiles about you?
Our policy is not to create profiles of our service users. However, in certain situations—such as providing services or for commercial purposes—we may need to create information profiles about you. For example, we may use your purchase or service history to offer you products or services tailored to your preferences. In such cases, we will apply strong security measures to protect your information from unauthorized access or misuse.
Will we use your data for other purposes?
Our policy is not to use your data for purposes other than those stated. If we ever need to use your data for a different purpose, we will always request your prior consent through clear options allowing you to decide accordingly.