Enlist Promax

Privacy Policy

Last updated November 6, 2026

Enlist Promax is a workspace where hiring teams manage jobs and candidates, with AI assistance that a person always reviews. This policy explains what personal data the service handles, why, who we share it with, how long we keep it, and the rights you have under the Philippine Data Privacy Act of 2012. We don't sell personal data, we don't use it for advertising, and we don't use it to train AI models.

1. Who we are

Enlist Promax (https://enlist-promax.site) is operated by Cyril Dave Legaspi, based in the Philippines (“we”, “us”). We handle personal data in line with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission.

For any privacy question or request, contact us at cyrildave.legaspi@gmail.com.

2. Our role

  • People who use Enlist Promax (members of a workspace): we decide how your account information is used, so we are the personal information controller for it.
  • Candidates and other people whose information an organization adds to its workspace: that organization decides why and how the information is used, so it is the personal information controller. We process the information on its behalf and only on its instructions, as a personal information processor.

If you are a candidate, the best place to start with a question or request is the organization you applied to. If you contact us instead, we will pass your request on and help that organization respond.

3. What we collect

  • Account information: your name, email address and password. Passwords are stored by our sign-in provider in a form that can’t be read back, and we never see them. If you choose “Continue with Google”, we receive your name, email address and profile picture from your Google account.
  • Workspace information: your organization’s name and timezone, its members and their roles, invitations (the email address and role), and settings.
  • Hiring information your organization adds: candidate names and contact details, resumes and other documents, applications, assessments, interview notes, and messages. Where a candidate has agreed to it, this can include interview recordings and transcripts.
  • Activity records: an audit trail of actions in the workspace (who did what, and when), so organizations can review how decisions were made.
  • Technical information: IP address, browser type and request logs, recorded by our hosting provider to run and protect the service.

Enlist Promax is not designed for sensitive personal information as defined in the Data Privacy Act, such as health information, religious or political affiliation, or government-issued identifiers. Organizations should not add it unless the law allows them to.

4. How we use it

  • To provide the service: sign you in, run your workspace, show your team its information, and send invitations and notifications.
  • For AI assistance: when your organization uses an AI feature (for example, summarizing a resume or drafting a message), the relevant workspace information is sent to an AI model to produce a suggestion. AI output is advisory. A person must review and approve it before any offer, hiring or rejection decision, and before any message is sent. This safeguard can’t be switched off.
  • To keep the service secure and reliable: prevent abuse, keep audit trails, and find and fix problems.
  • To communicate with you: invitations, password resets, and notices about important changes to the service.
  • To meet legal obligations that apply to us.

We rely on the legal grounds in the Data Privacy Act: providing the service you or your organization signed up for, our legitimate interest in keeping it secure and working, compliance with the law, and consent where the law requires it. For candidate information, the organization is responsible for having a lawful basis and for giving candidates the notices the law requires.

5. Who we share it with

We share personal data only with service providers that help us run Enlist Promax, and only what they need to do their job, on our instructions:

  • Neon: database, sign-in and file storage. Your workspace data is stored in Singapore.
  • Cloudflare: hosting, and delivering the site over its global network.
  • Resend: sending email, such as invitations and notifications.
  • OpenRouter and the AI model providers it connects to: AI features. We set these requests up to exclude providers that collect the data or keep it after answering.
  • Google: when you choose to sign in with Google, or when your organization connects a Google service.

Inside a workspace, members see the organization’s information according to their role. We also disclose personal data when the law requires it, and if Enlist Promax is ever transferred to another operator, we will tell you beforehand.

6. Data outside the Philippines

Our providers store and process data outside the Philippines: our database is in Singapore, and Cloudflare, Resend, OpenRouter and AI model providers operate in other countries, including the United States. We choose providers that protect personal data with appropriate security, and we remain responsible for it under the Data Privacy Act.

7. How long we keep it

  • Account information: while your account is active. You can ask us to delete it at any time.
  • Workspace and candidate information: for as long as the organization keeps it. Organizations decide how long to keep candidate information and can delete it. When an organization deletes information or its whole workspace, we remove it from the live service, and copies in backups are deleted as those backups expire.
  • Audit trail: for as long as the workspace exists, so its history can be reviewed.
  • Technical logs: for a short period, to run and protect the service.

8. How we protect it

  • All traffic to Enlist Promax is encrypted with HTTPS.
  • Our database provider encrypts stored data.
  • Rules in the database limit each workspace’s information to its own members, and admin-only actions are also checked on our servers.
  • We never store passwords in a form that can be read.

No system is perfectly secure. If a personal data breach happens, we will notify the affected organizations and, where the law requires, the National Privacy Commission and the people affected, within the time the law sets.

9. Your rights

Under the Data Privacy Act, you have the right to:

  • be informed about how your personal data is processed;
  • access your personal data;
  • object to its processing;
  • have it corrected if it’s inaccurate or incomplete;
  • have it erased or blocked;
  • get a copy in a commonly used electronic format (data portability);
  • claim damages if it’s processed unlawfully; and
  • file a complaint with the National Privacy Commission (privacy.gov.ph).

To use any of these rights, email cyrildave.legaspi@gmail.com. We may need to confirm your identity first, and we will reply within a reasonable time. For information an organization added about you as a candidate, see section 2.

10. Cookies and browser storage

We use only what the service needs to work:

  • cookies that keep you signed in;
  • short-lived cookies that complete Google sign-in securely; and
  • browser storage that remembers your light or dark theme choice.

We don’t use advertising cookies or third-party analytics cookies.

11. Children

Enlist Promax is a tool for organizations and is not directed at children. You must be at least 18 to create an account.

12. Changes to this policy

When we change this policy, we will post the new version here and update the date at the top. If a change is significant, we will also tell you by email or in the app before it takes effect.

13. Contact

Cyril Dave Legaspi, who also acts as our data protection officer: cyrildave.legaspi@gmail.com. See also our Terms of Service.