Wrangle

GDPR overview

GDPR is addressed concretely rather than by slogan. A dated Data Processing Addendum, last updated on 5 August 2026, is published in full and is incorporated automatically from first use of the service. It commits each party to the data protection laws that apply to it, relies on the European Standard Contractual Clauses for transfers to the United States (Module Two for controller-to-processor, Module Three for processor-to-sub-processor, Irish law and Irish courts), and adds the UK International Data Transfer Addendum and Swiss adjustments. It covers breach notification without undue delay, assistance with data subject requests and impact assessments, one audit per calendar year, and a named list of twenty-one sub-processors with a thirty-day objection window. Two gaps are worth noting: no Article 27 EU representative and no data protection officer is designated, and no independent certification is claimed.

Who owns the data?

The Data Processing Addendum sets the customer as data controller, or as processor where relevant, and Wrangle Jobs Inc. as its processor or sub-processor. Everything loaded into or generated by the workspace counts as Customer Data, and the addendum extends that definition to AI inputs and outputs whenever they contain or derive from customer information. Wrangle processes it only on the customer's documented instructions, does not sell personal information, and acts as a service provider under United States privacy laws. On termination, or on written instruction, the customer's data is returned or deleted, and exports are unlimited on every plan, so the pipeline built inside Wrangle can be taken out again.

Reuse rights

Customers keep the right to use, share and export their workspace freely: unlimited exports are included on every plan, candidates can be pushed to Ashby, Greenhouse, Lever or Recruit CRM, and shortlists can be shared with clients without asking Wrangle for permission. In exchange, the customer carries the legal responsibility: the addendum requires it to hold the rights, notices, consents and lawful bases needed to feed candidate data into the platform, and to configure retention, sharing and outreach accordingly. On the vendor side, use is narrower than the customer's. Wrangle states that it does not train foundation or generalised models on customer data unless the customer signs a separate arrangement, and that Google Workspace API data never feeds model training. Aggregated, de-identified telemetry may be used to operate and improve the service, provided it is not turned back into identifiable customers, users or candidates.

Data retention & training

Hosting summary

The Data Processing Addendum states that customer data may be processed in the United States and in other jurisdictions where Wrangle or its sub-processors operate. No European hosting region is offered or announced. Transfers covered by the GDPR, UK GDPR or Swiss law rely on an adequacy decision or the Standard Contractual Clauses, with the UK addendum and Swiss adjustments applied where relevant. The infrastructure is named in the published sub-processor list: Google Cloud Platform and Firebase for storage, database, background processing and logs, Vercel for application hosting and observability, PlanetScale for the managed database, Upstash for caching, queues and temporary workflow state, and turbopuffer for search and retrieval. The domain resolves to an Amazon network node geolocated in the United States. Security measures listed in the addendum include TLS in transit, encryption at rest where the infrastructure providers supply it, role-based access controls, logical separation of customer workspaces, logging and monitoring, and backup and disaster recovery. The privacy policy adds that data is encrypted at rest and in transit and shielded behind an additional authorisation mechanism.