aramo.ai
Request demo

Platform and Candidate-Data Privacy Notice

Effective date: 2026-07-26 · Version 1.0

This notice describes how Astre Consulting Services Inc., operating Aramo, handles personal information in the Aramo platform. Aramo is a business-to-business recruiting and staffing platform. It is not a consumer job board and does not sell platform access to job seekers.

1. Our roles

1.1 Customer-directed processing

When a staffing, consulting, or IT-services firm uses its Aramo workspace to collect or process candidate, client, requisition, submittal, interview, placement, or related information, that firm determines the business purpose and means of processing. The firm acts as controller or business, and Astre acts as its processor or service provider, subject to the customer agreement and the firm’s instructions.

1.2 Candidate-direct processing

Astre acts as controller for limited candidate-direct relationships that Aramo determines and administers, such as direct identity verification, portable credentials, a direct privacy request, or a candidate-authorized cross-firm consent grant. This notice addresses those activities in addition to explaining our processor role.

2. Information processed

  • Identification and contact information, such as name, email address, phone number, and professional profile details.
  • Professional history and work product, including resumes, roles, skills, qualifications, work samples, and related records.
  • Recruiting workflow information, including requisitions, submissions, interviews, placements, communications, notes, and status history.
  • Verification and evidence records, including verified-email attestations, employment corroborations, eligibility or clearance attestations, provenance, and evidence status.
  • Consent, preference, identity-verification, and audit records.
  • Workspace account and security information, including authentication, role, permission, device, and activity information.
  • Location or geography information supplied for business purposes, such as addresses or work locations.

3. Sources

Information may come from the candidate, an Aramo customer, the customer’s client, tenant-connected sourcing channels, verification interactions, public or customer-authorized professional sources, service providers, and platform activity. The customer is responsible for ensuring it has authority and an appropriate legal basis to submit and use customer-directed data.

4. Purposes

  • Provide and administer customer workspaces and recruiting workflows.
  • Ingest, organize, deduplicate within permitted boundaries, and maintain candidate records.
  • Support identity verification, evidence capture, and evidence-graded assessments.
  • Generate AI-assisted extraction, summaries, drafts, and recommendations for human review.
  • Maintain tenant isolation, security, auditability, support, and service integrity.
  • Comply with customer instructions, contracts, law, rights requests, and legal process.
  • For candidate-direct processing, administer consent, verification, portable credentials, and candidate-authorized features.

5. Human decision-making and AI

Aramo uses AI-assisted tools for tasks such as evidence extraction, assessment drafting, and agent reasoning. These tools propose or assist; they do not make the final decision to submit, reject, interview, hire, or place a person. A human user must make each such decision.

Aramo does not create a general numeric score, grade, or rank of a person. It presents evidence-linked, dimension-specific assessments intended to help an authorized human understand the basis and limitations of information. Customers remain responsible for lawful employment decisions, required notices, accommodations, validation, bias audits, and human review applicable to their use.

6. Tenant isolation and cross-tenant identity controls

Each customer’s candidate and client data is maintained within that customer’s tenant boundary. Channel-sourced candidate data is not pooled, commingled, or disclosed across customers. Aramo maintains a limited, PII-free cross-reference layer using cryptographic fingerprints and evidence references. It contains no names, resumes, contact information, government identifiers, or tenant identifiers.

A deterministic fingerprint may indicate that the same person appears in more than one tenant, but Aramo does not disclose that signal to a customer unless the individual activates a candidate-direct relationship and gives the required consent. Aramo does not use probabilistic cross-tenant identity matching. Non-deterministic record merges require human approval and recorded provenance.

7. Model training

Customer and candidate data processed in a tenant workspace is not used to train models shared across Aramo customers. Service providers may process data only to provide contracted services, subject to applicable terms and safeguards.

8. Disclosures and subprocessors

We disclose personal information to subprocessors that help provide Aramo, including infrastructure, authentication, storage, email, AI-processing, and location-service providers. The current list is published in the Aramo Subprocessor List. We may also disclose information at a customer’s direction, to comply with law, protect rights or safety, investigate abuse, or complete a corporate transaction subject to appropriate safeguards.

9. Retention

For customer-directed data, the customer controls the retention period subject to its agreement, instructions, legal obligations, and sourcing-channel restrictions. At the end of services, we delete or return customer personal data as required by the applicable agreement, unless law permits or requires continued retention. Candidate-direct records are retained only as long as reasonably necessary for the disclosed purpose, to maintain consent and audit evidence, resolve disputes, protect the service, and comply with law. Specific records may be retained longer when necessary to establish, exercise, or defend legal claims.

10. Privacy rights

10.1 Customer-directed data

If your information was submitted or used by a staffing or consulting firm in its Aramo workspace, that firm is ordinarily the controller. Direct your request to the firm. We assist the firm in responding as required by law and contract.

10.2 Candidate-direct data

For information Astre controls directly, you may contact hello@aramo.ai to request access, correction, deletion, or a copy, or to withdraw a consent where applicable. Depending on applicable law, you may also have a right to appeal a denied request or opt out of certain processing. We do not sell personal information or use it for targeted advertising.

11. Security

Aramo uses tenant isolation, encryption in transit, least-privilege access, role-based access controls, customer-configured SSO/SAML capabilities, and audit logs of agent and user actions. Security practices evolve, and no security program can eliminate all risk. This notice does not represent that Aramo holds any security certification.

12. United States processing

Aramo currently serves United States business customers and uses United States regions for its listed subprocessors. Information may be processed in the United States, where privacy laws may differ from those in other jurisdictions.

13. Contact and complaints

Email privacy questions or candidate-direct requests to hello@aramo.ai. If your request concerns a customer’s workspace, identify the relevant firm so we can route or assist appropriately. You may also contact the appropriate regulator or attorney general where applicable.

14. Changes

We may update this notice to reflect product, legal, or operational changes. The posted version and effective date govern from publication, subject to any additional notice required by contract or law.