whowhy

Claude (web or desktop)

In Claude, open Customize → Connectors and add whowhy. To add it by hand, choose Add custom connector and paste this URL. Sign in with your work email: your first sign-in creates your account. No card is needed to start.

Claude Code

Then start Claude Code, type /mcp, pick whowhy and sign in with your work email.

Codex

Sign-in page not opening by itself? Run codex mcp login whowhy.

Grok

Open grok.com/connectors, click New Connector and pick Custom. Paste this URL and sign in with your email.

Custom connectors need a paid Grok plan.

1. Agreement

These Terms of Service ("Terms") govern your access to and use of WhoWhy, provided by WhoWhy OU ("WhoWhy", "we", "us"), a company registered in Estonia. By installing, accessing or using WhoWhy, you agree to these Terms. If you use WhoWhy on behalf of an organization, you represent that you have authority to bind that organization, and "you" refers to that organization.

2. The service

WhoWhy is an AI recruiting assistant that works in the web app, by email and through MCP, and helps hiring teams source, research, evaluate and reach out to candidates. WhoWhy uses large language models and third-party data providers to generate results. We may update, improve or change the service over time.

3. Accounts and eligibility

You must be at least 18 years old and able to form a binding contract to use WhoWhy. You are responsible for your account, for the actions taken through it, and for maintaining the security of your credentials and connected accounts.

4. Acceptable use

You agree not to use WhoWhy in violation of any law; to unlawfully discriminate against candidates or applicants; to misuse candidate personal data or process it without a lawful basis; to reverse engineer, resell or scrape the service; to interfere with its operation or security; or to send spam or unlawful communications.

5. Your responsibilities as a hiring customer

You are responsible for how you use WhoWhy's outputs and candidate data. In particular, you are responsible for complying with all applicable employment, anti-discrimination, privacy and data-protection laws; for having a lawful basis to process candidate personal data; for reviewing outputs before acting on them; and for your outreach to candidates. Where WhoWhy processes personal data on your behalf, our Privacy Policy and any applicable data processing terms apply.

6. AI outputs

WhoWhy uses large language models, which can produce inaccurate or incomplete results. Outputs are suggestions to support human decisions, not professional, legal or hiring advice, and not a substitute for your own judgment. You are responsible for verifying outputs and for any decision you make. WhoWhy does not guarantee any hiring outcome.

7. Third-party services

WhoWhy integrates with and depends on third-party services, including data providers. Your use of those services is subject to their own terms, and we are not responsible for them. If a third-party service changes or becomes unavailable, the service may be affected.

8. Fees

A role starts with $100 on its balance, which pays for its first two meetings. After that, each meeting costs $50 and is charged only when a candidate who replied moves to Meeting. If a role meets no one and you answered everyone who said yes, the $100 is refunded to your card when you archive the role. Other fees, if any, will be described at the point of purchase or in a separate order or agreement. Except as stated in this section, fees are non-refundable. We may change pricing on reasonable notice.

9. Intellectual property

WhoWhy and all related software, content and trademarks are owned by WhoWhy OU. We grant you a limited, non-exclusive, non-transferable right to use the service subject to these Terms. You retain ownership of the content you submit, and grant us the rights needed to operate the service for you.

10. Confidentiality

Each party may receive confidential information from the other. The receiving party will use it only to perform under these Terms and will protect it with reasonable care.

11. Disclaimers

The service is provided "as is" and "as available", without warranties of any kind, whether express or implied, including fitness for a particular purpose, merchantability, accuracy and non-infringement, to the fullest extent permitted by law.

12. Limitation of liability

To the fullest extent permitted by law, WhoWhy will not be liable for any indirect, incidental, special, consequential or punitive damages, or for lost profits, revenues or data. Our total liability arising out of or relating to the service will not exceed the greater of the amounts you paid us in the twelve months before the claim, or one hundred euros (EUR 100).

13. Indemnification

You will indemnify and hold WhoWhy harmless from claims arising out of your use of the service, your content, your outreach to candidates, or your breach of these Terms or of applicable law.

14. Term and termination

These Terms apply while you use WhoWhy. You may stop using and uninstall the service at any time. We may suspend or terminate access if you breach these Terms or if required for security or legal reasons. On termination, your right to use the service ends; sections that by their nature should survive will survive.

15. Changes to these Terms

We may update these Terms from time to time. We will post the updated version here and change the "last updated" date. Your continued use after changes take effect means you accept the updated Terms.

16. Governing law

These Terms are governed by the laws of Estonia, without regard to conflict-of-law rules. The courts of Estonia will have exclusive jurisdiction, except where mandatory consumer law provides otherwise.

17. Contact

WhoWhy OU, Estonia. Email: denis@whowhy.io.

1. Who we are

WhoWhy OU (“WhoWhy”, “we”, “us”, “our”) is a company registered in Estonia. WhoWhy provides an AI recruiting assistant that helps hiring teams source, research and evaluate candidates. You use it in the WhoWhy web app, or from an AI assistant such as Claude through our MCP server. This Privacy Policy explains what personal data we collect, how we use it, and the rights you have.

Where WhoWhy determines the purposes and means of processing your account and website data, we act as a data controller. Where we process candidate and hiring data on behalf of a customer, we act as a data processor and the customer is the controller. For any privacy question, or to exercise your rights, contact us at denis@whowhy.io.

2. Data we collect

Account and workspace data. When you sign up or sign in, we receive your email address. We authenticate you with a one-time code sent to that address, or with a password where your account has one. When you connect WhoWhy to an AI assistant, the assistant signs in to your WhoWhy account through OAuth.

Content you provide. Job descriptions, hiring criteria, search instructions, messages and decisions you enter while using the product. If you connect a mailbox or a LinkedIn account to reach candidates, the messages sent and received through it.

Candidate data we process for you. To perform sourcing and evaluation, WhoWhy processes information about candidates, including names, professional profiles, current and past employers, job titles, work history, skills, public professional information, public work such as GitHub and X profiles, personal sites and projects, and professional contact details such as email addresses obtained from third-party data providers. WhoWhy generates this data at your direction, as part of the service we provide to you.

Usage and technical data. Log data, timestamps, feature usage and diagnostic information used to operate and secure the service.

We do not intentionally collect special categories of data such as health, race or religion, and we ask that you do not submit them.

3. How we use data

We use personal data to provide and operate the service; authenticate you and manage your account; run sourcing searches, enrichment and candidate evaluation on your behalf; process your instructions through large language models to generate results; communicate with you about your account, support and billing; secure the service and prevent abuse; and comply with legal obligations.

WhoWhy is an AI product. Your instructions and the content you provide are processed by large language models to generate results. We do not use your data, or candidate data, to train third-party foundation models.

4. Legal bases (GDPR)

Where the GDPR applies, we rely on performance of a contract to provide the service you request; our legitimate interests to operate, secure and improve the service and to source candidates on behalf of our customers, balanced against your rights; consent, where required; and compliance with legal obligations.

5. Large language models and automated processing

WhoWhy uses large language models to research and rank candidates, to draft outreach and to draft notes from calls. These outputs are suggestions intended to support human hiring decisions, not to replace them. WhoWhy does not make final hiring decisions, and customers are responsible for reviewing outputs before acting on them. We do not carry out solely automated decision-making that produces legal or similarly significant effects on candidates within the meaning of Article 22 GDPR.

6. Calls

If who@whowhy.io is on the invite for a call, a bot named whowhy joins it.

Our provider Recall.ai records the call and turns it into a transcript. Recall.ai deletes the recording after 24 hours. We keep the transcript to update the candidate's card.

After the call, Claude, by Anthropic, reads the transcript and drafts a note for each person from the hiring company who was on it. Each of them fixes their draft and posts it with their own yes or no; the draft decides nothing. Posted notes and the transcript are on the candidate's card, for the hiring team and the people it invites to its board. A hiring company can turn notes from calls off in its settings.

The hiring company that invited whowhy is the controller of the transcript, and we are its processor.

To say no, remove who@whowhy.io from the invite before the call and the bot won't come. During the call, the host can refuse to let it in or remove it. To have a transcript deleted, write to denis@whowhy.io and we'll delete it within 30 days.

7. Sharing and sub-processors

We share personal data with service providers who process it on our behalf, under contract and only as needed to run the service:

Anthropic — large language model processing of your instructions and content.

TypeSafe — large language model processing of candidate profiles and public work, to evaluate candidates for your search.

Supabase — application database and hosting.

Vercel — hosting of the WhoWhy web app.

Amazon Web Services (AWS) — underlying cloud infrastructure.

Stripe — payments. Your card details go to Stripe directly; we never see or store them.

Resend — delivery of sign-in codes and notification emails from WhoWhy.

Composio — sending and receiving outreach email through the mailbox you connect.

Unipile — LinkedIn messaging through the LinkedIn account you connect.

Data-enrichment providers, including Apollo, FullEnrich and Exa — to find and enrich candidate profiles and professional contact details.

Recall.ai — joins calls, records them and produces the transcript (United States).

Parallel — web research that finds the public work of candidates, such as GitHub and X profiles, personal sites and projects.

We may also disclose data where required by law, to protect our rights, or in connection with a merger or acquisition. We do not sell personal data.

8. International transfers

WhoWhy and its providers may process data in the European Union and the United States. Where data is transferred outside the European Economic Area, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

9. Data storage and security

Customer Data is stored in a managed PostgreSQL database (Supabase, running on AWS) and encrypted in transit (TLS) and at rest. We restrict access to authorized personnel and enforce database-level access controls.

10. Data retention

We retain personal data for as long as your account is active. On account termination, uninstall, or a verified deletion request, we delete Customer Data within 30 days, except where longer retention is required by law. Routine encrypted backups are purged on a rolling basis.

11. Your rights

Depending on your location, you have the right to access, correct, delete, restrict or object to the processing of your personal data, and the right to data portability. You may also withdraw consent where processing is based on consent. To exercise any of these rights, contact denis@whowhy.io. You have the right to lodge a complaint with a supervisory authority; in Estonia this is the Data Protection Inspectorate (Andmekaitse Inspektsioon).

12. Candidates

If you are a candidate and WhoWhy processes your data on behalf of a hiring customer, that customer is the controller of your data. You can contact us at denis@whowhy.io and we will route your request to the relevant customer, or handle it where we are able. You may ask to access or delete the professional data we hold about you.

13. Cookies

Our website uses only essential cookies needed to serve and secure the site. The WhoWhy web app uses cookies to keep you signed in and does not use advertising cookies.

14. Children

WhoWhy is a business product and is not directed to children. We do not knowingly collect data from anyone under 16.

15. Changes

We may update this Privacy Policy from time to time. We will post the updated version here and change the "last updated" date above. Material changes will be communicated where appropriate.

16. Contact

WhoWhy OU, Estonia. Email: denis@whowhy.io.

Reporting a vulnerability

Please email denis@whowhy.io with the details. Include a description of the issue, the steps to reproduce it, the affected URL or component, and its potential impact. A proof of concept helps us confirm and fix the problem faster.

Our commitment

We will acknowledge your report within three business days, investigate promptly, keep you informed of our progress, and remediate confirmed issues as quickly as we reasonably can. We are grateful for reports made in good faith and are happy to credit you once an issue is resolved, if you would like.

Safe harbor

If you make a good-faith effort to comply with this policy during your research, we will consider your testing authorized, will not pursue legal action against you, and will work with you to understand and resolve the issue. Please act in good faith: avoid privacy violations, data destruction, and any disruption to the service; access only the minimum data needed to demonstrate an issue; and give us reasonable time to fix a problem before disclosing it publicly.

Scope

This policy covers whowhy.io, and app.whowhy.io. Please avoid denial-of-service testing, spam, social engineering of our staff or customers, and physical attacks. Findings in third-party services we rely on should be reported to those providers directly.

Contact

WhoWhy OU, Estonia. Security contact: denis@whowhy.io.