Candidate Privacy Notice (Aviso de Privacidad)
Last updated: October 2026
This Candidate Privacy Notice explains how Shortcut Studio ("Shortcut", "we", "us") collects, uses, stores, and protects personal data submitted by job applicants through our careers portal, in compliance with Mexico's Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP) and international data protection standards (GDPR).
1. Data Controller
The data controller responsible for processing your personal data is Shortcut Studio. For any questions, data subject requests, or to exercise your ARCO rights, contact us at jobs@shortcut.is.
2. Personal Data We Collect
We collect information provided directly by you in your application, including: identification and contact data (name, email address, location, timezone), professional data (portfolio URL, CV/résumé, public professional profile links, employment history, work authorization), and voluntary compensation expectations.
3. Purposes of Processing
- Evaluating your qualifications and suitability for the position you applied for.
- Communicating with you regarding your application status, interviews, and potential offers.
- Maintaining your application on file for future opportunities (only if you gave affirmative consent).
- Fulfilling legal, statutory, and regulatory obligations.
4. Data Retention & Deletion
Application data and uploaded CV files are retained for a maximum of 6 months following the closure of the job opening. If you explicitly consent to consideration for future openings, we retain your information for up to 24 months. After this retention period, your data is securely deleted from our databases and private storage.
5. Data Storage & Subprocessors
Your data is processed using secure, private cloud infrastructure: Cloudflare (private object storage in R2 and D1 database), Vercel (serverless application hosting), Resend (transactional email notification), Slack (internal team notifications), and Google Workspace (the shared hiring inbox and team sign-in). Your data is never sold, leased, or shared with external recruiters or commercial third parties.
6. Your Rights (ARCO & GDPR)
You hold the right to Access, Rectify, Cancel, or Oppose (ARCO rights) the processing of your personal data at any time, as well as request deletion. To exercise these rights, send an email from your application email address to jobs@shortcut.is with your request. We will process and confirm your request within 15 business days.