Data Processing Addendum

You are the Data Fiduciary for candidate personal data: you decide whom to assess, why, and what to do with the result. We are your Data Processor and act only on your instructions. Where the DPDP Act 2023 does not apply to a given candidate, equivalent controller/processor terms apply under whichever data protection law does.

We remain the Data Fiduciary for your own account and billing data, which is covered by our Privacy Notice rather than by this Addendum.

Categories of data subject: candidates you invite to an assessment.

Categories of personal data: name and email address (as entered by you), assessment answers and written explanations, scores and grading feedback, and session timing.

Purpose: delivering assessment invitations, administering assessments, grading them, and reporting results to you.

Special categories: none. The platform neither requests nor accepts demographic, health, biometric, or financial data about candidates, and we ask you not to enter any into free-text fields.

• Process candidate personal data only to provide the service and only on your instructions — never for our own purposes, and never to train AI models.
• Keep the data confidential and impose equivalent duties on anyone with access to it.
• Apply the security measures described on our security page, and not materially weaken them during your subscription.
• Isolate your data from that of other customers, so no other customer can read your candidates’ results.
• Notify you without undue delay after becoming aware of a personal data breach affecting your data, with enough detail for you to meet your own notification duties.
• Assist you in responding to candidate rights requests, and pass on any request a candidate sends us directly.
• Delete or return your data on termination, subject to the statutory retention described in section 7.
• Make available the information you reasonably need to demonstrate compliance.

• Have a lawful basis for assessing each candidate, and give them whatever notice your own obligations require, before you invite them.
• Enter only the candidate data the assessment needs — in practice, a name and an email address.
• Not use company assessments to assess anyone under 18. The platform enforces this: an account that has declared it is under 18, or has not declared an age at all, cannot start an assessment.
• Treat assessment scores as one input among several. The score is generated without human review, so you remain responsible for the hiring decision and for any human oversight your jurisdiction requires.
• Keep your account credentials secure, and tell us promptly if you believe they are compromised.

Scores are produced by an AI evaluator without a human in the loop. We are transparent about this so you can meet your own obligations:

• The candidate’s written explanation is sent to Anthropic for comparison against a stored reference answer; the accuracy of the flagged lines is scored arithmetically. The two are combined into a score out of 100.
• No candidate name, email, or account identifier is sent to the AI provider.
• We do not currently provide a bias or adverse-impact audit, and we collect no demographic data, so one cannot be produced from platform data. If you hire in a jurisdiction that mandates such an audit — New York City, for example — tell us before you deploy the tool.
• We do not use emotion recognition, attention inference, webcam monitoring, or keystroke analysis, and have no plans to.

You authorise the subprocessors listed on our subprocessor page. We remain responsible for their performance. We will give you at least 30 days’ notice before a new subprocessor begins processing your data; if you reasonably object on data protection grounds, we will work with you to find an alternative, and if we cannot, you may terminate the affected service and receive a pro-rata refund of unused credits.

Several subprocessors operate outside India, so engaging us involves a cross-border transfer.

You can delete candidate data from your account at any time. On termination we delete candidate personal data within 30 days, except that transaction records are retained for 8 financial years as Indian tax and companies legislation requires. Those retained records hold no candidate personal data.

Candidate name and email on an invitation that expires unused are deleted automatically, without waiting for a request.

On reasonable notice, and no more than once a year unless a breach or a regulator requires otherwise, we will respond to a security questionnaire and provide the documentation we hold. We do not currently hold a SOC 2 or ISO 27001 certification, and our security page says plainly what we have and have not built — please read it before you sign.

Liability under this Addendum is subject to the limitations in the Terms of Service. Where this Addendum conflicts with the Terms on the handling of candidate personal data, this Addendum prevails. Our aggregate liability under this Addendum is capped at the total amount you paid us in the 12 months before the claim arose.