Privacy Policy

Last updated: November 4, 2026. Effective: November 4, 2026.

1. Who We Are

Rotto is a recruiting platform that helps recruiters and employers find candidates, reach them, and book time with them. Its products include candidate search, Candidate Outreach, and Contact Lookup, which can also be used through our API and connected tools.

Rotto is operated by Migrate Mate Inc. (“Migrate Mate”, “we”, “us”). Except as described in Section 6, Migrate Mate is the “data controller” (under the GDPR) and the “business” (under the California Consumer Privacy Act, as amended by the CPRA) responsible for the personal information described in this policy. Migrate Mate’s job platform for international job seekers has its own privacy policy.

For privacy questions or requests, contact support@rotto.com or use our privacy request form.

2. Who This Policy Covers

This policy describes personal information about:

Customers: recruiters, employers and others with a Rotto account (Section 3).
People in our candidate search: including people who have not used Rotto themselves (Section 4).
People our customers contact through Rotto: see Section 6.
Visitors and prospective customers: people who visit rotto.com or whom we contact about Rotto (Section 7).

3. What Data We Collect From Customers

Depending on how you use Rotto, we may collect the following personal data:

Identity and Contact Data: Name, email address, phone number, job title, company, role, professional profile links, and photo.
Account Information: Login credentials (we use passwordless email codes), your team and seats, and usage data for accessing the platform.
Company and Onboarding Data: Information about your company and your hiring needs. We may use public sources to fill in your details.
Payment Information: Processed securely through a third-party payment processor. We do not store your full card details.
Product Data: How you use Rotto, including your searches, notes, lists, lookups, uploads, exports, emails and purchases.
Connected Google Account Data: If you connect Gmail and Google Calendar to Candidate Outreach, the data described in Section 5.
Communication Data: Messages, feedback and support correspondence, and demo bookings.
Tracking and Analytics Data: Information collected via cookies, tracking pixels, session replay, and third-party tools to monitor engagement across our site and product (e.g. pages viewed, browsing behavior, device and approximate location data). See Section 18.

When you sign up for some products, we may use your email address to find your public professional profile, including through a third-party data provider. That profile may be added to our candidate search (Section 4).

4. Candidate Search and Profiles

Rotto’s candidate search helps customers find people for job opportunities. Profiles in it come from:

Public sources. Many profiles describe people who have not used Rotto. We build these from publicly available professional information, such as career history, education, skills, location and photo. We do not collect sensitive data (such as health information or political views) from these sources.
Migrate Mate candidate profiles. People who created a candidate profile on Migrate Mate’s job platform, which its privacy policy explains is searchable by recruiters. These profiles can include information the person gave Migrate Mate, such as contact details, résumé, and visa status and eligibility.
Activity on Rotto. When someone looks a person up or provides a link to a public professional profile, we may add that public profile.

Contact details. Profiles we build from public sources carry no contact details when we build them. When a customer asks for someone’s contact details, we may obtain them, such as email addresses and phone numbers, from third-party data providers. We may retain the contact details we obtain and provide them to other customers.

For profiles in our candidate search:

Customers can find and view them, including professional information and, where a profile includes it, visa status and eligibility.
Contact details can be provided to customers, so they can contact people about opportunities.
Profiles are processed with AI, to power search and matching and to summarize experience.
Customer activity is stored, such as searches, notes, pipeline statuses and exports.

You can ask us to remove your profile, or to stop selling or sharing your information, whether or not you have an account with us. See Section 13.

Making profiles and contact details available to customers may constitute a “sale” or “sharing” of personal information under California law. You can opt out at any time. See Section 11.

5. Google Account Data (Candidate Outreach)

Candidate Outreach lets customers email candidates from their own Gmail account and book calls on their Google Calendar. To use it, you connect your Google account. Google shows you each permission before you agree, and calendar access is optional.

What we access. When you connect your Google account, Rotto may access:

Basic account information: your name, email address and profile picture.
Gmail: to send the emails you approve from your address; to identify replies and bounce notices on conversations Rotto started, and read those messages; to use your Gmail display name and signature; and to label the conversations Rotto started. Rotto does not read the content of your other email, and does not delete or change your messages.
Google Calendar (optional): your free and busy times, not the details of your events, to offer times you are available; and permission to create events, to add calls you book with candidates.

How we use it. Only to provide Candidate Outreach features to you, such as sending your emails, stopping follow-ups when someone replies, organizing those conversations in your Gmail, showing you replies with a suggested answer, and booking calls. We use AI providers to help with this, for example to understand a reply. They process this data on our behalf only.

What we store. What Candidate Outreach needs to work: your account details and signature, the emails sent through Rotto and the replies to them, and the calls you book. Your Google access token is stored encrypted. We do not store your other email or your calendar events.

How we share it. We never sell data we receive from Google, and we never use it, or transfer it to anyone, to serve ads. We do not transfer it to anyone except: service providers that help us run Candidate Outreach for you, under contract; the people you choose to email or invite; where necessary for security; to comply with the law; or as part of a merger or acquisition, with your prior consent.

Who can see it. Our staff do not read data we receive from Google, unless you ask us to (for example, for support), it is necessary for security purposes, it is required by law, or it has been aggregated and anonymized for internal operations.

No AI model training. We do not use data we receive from Google, or anything derived from it, to develop, improve or train generalized artificial intelligence or machine learning models. Google Workspace APIs are not used to develop, improve, or train generalized AI and/or ML models.

Limited Use. Rotto’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting. You can disconnect your Google account at any time in Rotto, which revokes our access and deletes your stored access token. You can also remove access from your Google account permissions. Information already stored in your Rotto account is handled as described in Section 17.

6. Data Customers Bring to Rotto

Customers bring their own information to Rotto, such as candidate lists they upload, their notes, and the emails they send through Candidate Outreach and the replies they receive (“Customer Data”). We process Customer Data on our customers’ behalf, and each customer is responsible for it. If a customer contacted you through Rotto, or holds your information in Rotto, please contact that customer about it first. We will help them respond.

If you reply to a customer asking not to be contacted, Rotto may stop that customer and their organization from emailing you through Rotto. Where Customer Data includes a link to a public professional profile, we may add that public profile to our candidate search under Section 4, without the other details the customer provided.

7. Visitors and Prospective Customers

Sign-ups and demos. If you sign up or book a demo, we collect the details you provide and may send you emails about Rotto.
Our own outreach. We may contact recruiters about Rotto using business contact information from public sources and data providers. You can unsubscribe at any time.
Product demos. We keep limited records of how our public demos are used, to prevent misuse.

8. How We Use Your Data

We process your data for the following purposes:

Provide and operate Rotto, including obtaining and providing contact details when customers ask for them.
Process payments and subscriptions.
Troubleshoot technical issues and improve the performance of our platform.
Send service updates and important notifications.
Send promotional or marketing communications. You can opt out of marketing messages at any time: use the unsubscribe link in an email, or contact us at support@rotto.com.
Track ad performance and user engagement using third-party advertising and analytics services to improve marketing campaigns and user experience.
Detect, prevent, and investigate fraud and abuse.
Comply with legal obligations.

Data we receive from Google is used only as described in Section 5.

9. AI and Automated Processing

We use artificial intelligence from third-party providers in parts of our platform, such as search, matching, summaries, reading uploaded files, and helping customers write emails and handle replies.

These providers process your data as our service providers and are not permitted to use it for their own purposes. We do not make decisions producing legal or similarly significant effects about you based solely on automated processing. Hiring decisions are made by our customers.

10. Legal Basis for Processing Your Data

Where the GDPR applies, we process your data under the following legal bases:

Contractual Necessity: To provide Rotto to customers and process payments.
Consent: For marketing communications where the law requires consent, and for the Migrate Mate candidate profiles that their owners chose to make available to recruiters.
Legitimate Interest: To improve our platform, track ad performance, prevent fraud, ensure the security of your data, contact recruiters about Rotto, and collect and show public professional information in our candidate search, including obtaining contact details when a customer asks to make contact. Recruiters can already find that information on the public networks it comes from; our interest is in organizing it so they can search it. You can object at any time (see Section 13).
Legal Obligation: To comply with applicable laws.

11. Sale and Sharing of Personal Information

We may sell or share certain categories of personal information about people in our candidate search with our customers, including recruiters, employers, and staffing and recruiting companies:

Identifiers: Name, email address, phone number, and professional profile links.
Professional and Employment Information: Work history, education, skills, location, and résumé contents.
Inferences: Profile summaries and match information derived from the above.
Visa and Work-Authorization Information: Visa status and eligibility, where included in a Migrate Mate candidate profile. This is “sensitive personal information” under California law, and you may limit its use. See Section 14.

We never sell: data we receive from Google (Section 5); Customer Data (Section 6); payment information; account credentials; precise geolocation; or the personal information of anyone we know to be under 16 years of age.

We also “share” (as defined by California law) identifiers and internet activity data with third-party advertising networks and partners for cross-context behavioral advertising.

You can opt out of the sale and sharing of your personal information at any time by submitting our Do Not Sell or Share My Personal Information form or emailing support@rotto.com. We also honor opt-out preference signals such as the Global Privacy Control (GPC).

12. Who We Share Your Data With

In addition to the sale and sharing described in Section 11, we share your data with the following categories of parties. They process your data on our behalf under contractual confidentiality and data protection obligations, and the specific providers we use may change as our platform evolves:

Payment Processors: For secure payment processing.
Hosting and Infrastructure: Cloud hosting, database and security providers, to operate our website and product.
AI Providers: For the processing described in Section 9.
Data Providers: Providers of contact details and public professional information.
Email and Communications: To deliver login codes, service emails, marketing, and scheduling.
Analytics and Advertising: Analytics providers (including session replay) and advertising networks, to track usage and ad performance.
Legal: Authorities, courts, or advisers where required by law or to protect our rights, and a successor entity in the event of a merger or acquisition.

International Data Transfers: Migrate Mate is a U.S.-based company. Your data is hosted and processed in the United States, the United Kingdom, and other countries where we and our service providers operate. Where personal data is transferred out of the European Economic Area or the United Kingdom, we rely on appropriate safeguards such as adequacy decisions, Standard Contractual Clauses, or transfer to recipients certified under approved frameworks like the EU-U.S. Data Privacy Framework and its UK Extension.

13. Your Rights

Depending on where you live, you have some or all of the following rights:

Access / Know: Request a copy of the personal data we hold about you and information about how we use and disclose it.
Delete: Request that we delete your personal data, including removing your profile from our candidate search.
Correct: Request that we correct inaccurate personal data.
Portability: Receive your data in a portable format.
Object: Object to processing based on our legitimate interests.
Opt Out of Sale/Sharing: Stop us selling or sharing your personal information (see Section 11). Opting out is different from deletion: to have your profile removed, ask us to delete it.
Withdraw Consent: Withdraw consent for processing based on consent at any time.
Complain: File a complaint with your local data protection authority.

To exercise any of these rights, submit our privacy request form or email support@rotto.com. You do not need an account with us to make a request. If your profile was built from public sources, use the same form and tell us where to find it. We will verify your identity (typically by confirming control of the relevant email address) before fulfilling access, deletion, or correction requests, and we will respond within the timeframes required by law. We will never discriminate against you for exercising your privacy rights.

Your rights may be limited in some cases, for example where fulfilling a request would affect the rights of others or conflict with our legal obligations. For Customer Data, we may refer your request to the customer responsible for it (Section 6).

14. California Privacy Rights (CCPA/CPRA)

This section applies to California residents and supplements the rest of this policy.

Categories of personal information we collect (and have collected in the preceding 12 months): identifiers (name, email, phone, online identifiers); customer records (payment information); characteristics of protected classifications (such as citizenship and immigration status, gender and date of birth, where included in a Migrate Mate candidate profile); commercial information (subscription and purchase history); internet or network activity (browsing and usage data, session replay); geolocation data (approximate location); professional or employment-related information; education information; audio/visual information (photos); sensitive personal information (see below); and inferences drawn from the above. The sources, purposes, and recipients for each category are described in Sections 3 to 12.

Sensitive personal information. We collect sensitive personal information including citizenship and immigration status, account log-in credentials, and the contents of emails sent and received through Candidate Outreach. With one exception, we use sensitive personal information only for the purposes permitted by the CCPA: providing the services you request, security, and legal compliance. The exception is visa and work-authorization status: where a Migrate Mate candidate profile includes it, it can be disclosed to customers as described in Section 11, and you have the right to limit that use by submitting a Limit the Use of My Sensitive Personal Information request.

Sale and sharing. We sell and share the categories of personal information described in Section 11 to the categories of third parties described there. You have the right to opt out via the Do Not Sell or Share My Personal Information form, and we honor Global Privacy Control signals as a valid opt-out request. We do not knowingly sell or share the personal information of consumers under 16 years of age.

Exercising your rights. California residents may exercise the rights in Section 13 via the privacy request form or by emailing support@rotto.com. You may designate an authorized agent to submit requests on your behalf; we will require proof of the agent’s authority and may verify your identity directly. We will respond to verifiable requests within 45 days (extendable by a further 45 days where reasonably necessary, with notice).

15. Other US State Privacy Rights

If you live in Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah, Virginia, or another state with a comprehensive privacy law, you may have the following rights with respect to your personal data, subject to the exceptions in your state’s law:

Confirm whether we are processing your personal data and access it.
Correct inaccuracies in your personal data.
Delete your personal data.
Obtain a copy of the personal data you provided to us in a portable format.
Opt out of the sale of your personal data and of its use for targeted advertising.

We do not use your personal data for profiling in furtherance of decisions that produce legal or similarly significant effects. Where your state’s law requires consent to process sensitive personal data (such as citizenship or immigration status), we process it only to provide the services you request or with your consent.

To exercise these rights, submit our privacy request form or email support@rotto.com. We will verify your identity before fulfilling access, correction, or deletion requests, and we honor Global Privacy Control signals as an opt-out of sale and targeted advertising. Nevada residents may opt out of the sale of their personal information by emailing us a “Nevada Opt-Out of Sale Request.”

Right to appeal. If we decline to act on your request, you may appeal by replying to our decision or emailing support@rotto.com with the subject “Privacy Request Appeal.” We will respond to appeals within the timeframe required by your state’s law. If we deny your appeal, you may submit a complaint to your state Attorney General, for example: Colorado, Connecticut, Texas, Virginia, or your own state’s Attorney General office.

16. Children

Rotto is a business product and is not directed at children. You must be at least 18 years old to create a Rotto account. We do not knowingly collect personal information from anyone under 16, and we do not knowingly sell or share the personal information of anyone under 16. If you believe a child’s personal information is in Rotto, contact support@rotto.com and we will delete it.

17. Data Retention

We retain personal information only for as long as necessary for the purposes outlined in this Privacy Policy, or as required by law. In deciding how long, we consider the nature and sensitivity of the information, the risk of harm, and our legal obligations. In general, account data is retained while your account is active, files you upload for processing are deleted after a limited period, profiles in our candidate search are retained until the person asks us to remove them, and payment records are retained as required by tax and accounting law.

18. Cookies and Tracking

We use cookies and other tracking technologies to:

Keep you signed in and protect our site from abuse.
Track usage for analytics and performance insights.
Measure and deliver personalized ads.

Cookie Categories:

Essential Cookies: Required for the operation of our website and product.
Analytics Cookies: Set by our third-party analytics providers to understand user behavior and improve our platform.
Marketing Cookies: Set by third-party advertising networks to deliver targeted advertisements and track ad performance.

Marketing cookies and pixels involve “sharing” data with advertising partners as described in Section 11. You can opt out via the privacy request form or a Global Privacy Control signal.

If you visit from the European Economic Area, the United Kingdom or Switzerland, we ask before setting analytics or marketing cookies, and they stay off unless you allow them. Anyone can change their choice at any time in their cookie settings.

19. Data Security

We use technical and organizational measures to protect your data, including encryption of data in transit and of especially sensitive data at rest, access controls, and periodic security reviews. Access to personal data is limited to authorized personnel. No security measure is perfect, and we cannot guarantee the absolute security of your information.

In the unlikely event of a data breach, we will notify the relevant authorities within the timeframes required by applicable law (for example, within 72 hours under the GDPR) and will notify affected users without undue delay.

20. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We review this policy at least once every 12 months. If we make significant changes, we will notify you via email or through a prominent notice on our website at least 14 days before the changes take effect.

21. Contact Us

For privacy questions, to exercise your rights, or for general support, use our privacy request form or email support@rotto.com. Rotto is operated by Migrate Mate Inc.