Privacy Policy

Interview Express (“we”, “us”, “our”) operates an AI-powered interview screening platform (the “Service”). This Privacy Policy explains how we collect, use, store, and protect the personal data of our users.

This policy applies to two categories of individuals:

• Employers (Account Holders) — organizations and their authorized users who subscribe to and use the Service
• Candidates (Interview Participants) — individuals who participate in AI-powered interviews through the Service

For Employers: By creating an account, you expressly consent to this Privacy Policy and our data processing practices as described herein. Consent is obtained through explicit acceptance during account registration.

For Candidates: Before beginning an interview, you will be presented with a consent screen where you must actively acknowledge this Privacy Policy and the data processing described herein. Your participation in an interview constitutes informed, affirmative consent.

From Employers (Account Holders)

• Account info: Name, email, phone, job title, password (stored as a cryptographic hash, never in plaintext)
• Organization info: Company name, website, industry, HQ location, logo, contact email
• Payment info: Credit card last 4 digits and card brand only. Full payment card data is processed directly by Stripe and is never transmitted to or stored on our servers.

From Candidates (Interview Participants)

• Identity info: Name, email address (provided to us by the employer)
• Interview data: Real-time voice audio is processed for transcription in real-time. If the employer has enabled interview recording for their organization, audio recordings of interviews may also be captured and stored securely in cloud storage (see Section 7). Full text transcripts of the interview conversation, interview duration, and timestamps are also collected.
• AI-generated assessments: Numerical scores, competency evaluations, personality trait indicators, risk flag assessments, hiring recommendations
• Documents: Resumes and supporting documents uploaded by the employer on the candidate’s behalf

Automatically Collected

• Device and browser information (user agent string)
• IP address
• Server request logs (HTTP method, URL path, response status, timestamps)
• Authentication cookies (httpOnly, secure)

We use the information we collect to:

• Provide, operate, and maintain the Service
• Conduct AI-powered voice interviews and generate candidate evaluations
• Process billing, credit transactions, and payment operations
• Send interview invitations and system notifications via email
• Enforce our Terms of Service and prevent misuse
• Improve service quality, reliability, and security
• Comply with legal obligations under applicable Indian law

• Interview transcripts are processed by AI language models to generate structured candidate evaluations
• AI outputs include: numerical scores (0–100), textual analysis, competency ratings, personality trait assessments, risk indicators, and hiring recommendations
• These outputs are assistive tools provided to the employer — the platform does NOT make automated hiring decisions
• The employer (as data controller) retains full decision-making authority over all hiring outcomes
• AI processing involves transmitting transcript data to third-party AI model providers (detailed in Section 5)
• AI models are probabilistic and may produce different outputs for similar inputs

To deliver the Service, we engage specialized third-party service providers who process data on our behalf. These providers are categorized by function:

These service providers operate under their own terms of service and privacy policies. We select providers that maintain industry-standard security and privacy practices.

Sub-processor changes: The specific providers we use may change from time to time as we optimize the Service. We will notify registered employers via email at least 30 days before making material changes to our sub-processors (such as switching AI model providers or speech processing providers). Employers who object to a new sub-processor may terminate their account in accordance with our Terms of Service.

What we do NOT do

• We do NOT sell, rent, or trade personal data to any third party
• We do NOT share candidate data, interview results, scores, transcripts, or organizational data with other job platforms, recruitment agencies, competitors, or any such third party for their independent use or benefit
• We do NOT use customer or candidate data to train, fine-tune, or improve our own or any third-party AI models
• We do NOT provide data to advertisers or marketing platforms
• We do NOT aggregate or anonymize candidate data for sale or distribution

Employer-Configured Data Sharing

The Service provides employers (as data controllers) with the ability to configure the following data-sharing mechanisms for integration with their own systems:

• Webhooks: Employers may configure webhook endpoints that receive interview data (including transcripts, scores, and candidate information) via automated HTTP delivery to the employer’s designated systems
• Client API: Employers may generate API keys to programmatically access their candidate and interview data from external systems

These integrations are configured and controlled entirely by the employer. Data shared through webhooks and the Client API is transmitted to endpoints and systems designated by the employer. We are not responsible for how the employer processes data received through these channels.

When we may disclose data

• To sub-processors listed above, strictly as necessary to deliver the Service
• When required by law, regulation, court order, or governmental request under Indian law
• To protect our legal rights, safety, or property
• In connection with a merger, acquisition, or sale of assets (with prior notice to affected users)
• With the explicit, informed consent of the data subject

• Data stored in secure, access-controlled databases with encryption in transit (TLS/SSL)
• Passwords are never stored in plaintext — they are cryptographically hashed using industry-standard algorithms
• Authentication tokens stored as httpOnly, secure cookies with short expiry
• Role-based access control within each organization
• Rate limiting on authentication and sensitive API endpoints
• Idempotency controls on financial transactions to prevent duplicate charges
• Interview audio recordings (when enabled) are stored in encrypted cloud storage with access restricted to the subscribing organization

We implement reasonable security practices and procedures as mandated under Section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

In the event of a personal data breach that may affect the confidentiality, integrity, or availability of personal data processed through the Service:

• We will notify affected employers (as data controllers) without unreasonable delay, and in any event within 72 hours of becoming aware of the breach
• The notification will include, to the extent known: the nature of the breach, categories and approximate number of individuals affected, likely consequences, and measures taken or proposed to address the breach
• We will cooperate with the employer’s breach response and provide reasonable assistance in fulfilling the employer’s own notification obligations
• We will notify the Data Protection Board of India as required under Section 8 of the Digital Personal Data Protection Act, 2023
• We will take immediate steps to contain the breach, mitigate its impact, and prevent recurrence

• Account data: Retained while the account is active, plus 90 days after account termination to allow data retrieval
• Interview transcripts & AI analysis: Retained for the duration of the subscribing organization’s active account
• Interview audio recordings: When recording is enabled, audio files are retained for the duration of the subscribing organization’s active account. Employers may request deletion of specific recordings at any time.
• Billing records & usage logs: Retained for 7 years as required by Indian tax and financial record-keeping laws
• Candidate data: Retained as long as the employer’s account is active. Employers may request deletion of specific candidate records at any time.
• Upon account termination: All data (except legally mandated records) is retained for 90 days after termination to allow retrieval, after which it is permanently deleted

We do not retain data beyond what is necessary for the stated purposes or legal requirements.

Under the Digital Personal Data Protection Act, 2023 (DPDPA) and applicable Indian law, you have the following rights:

• Right to Access: You may request a summary of the personal data we process about you and the processing activities undertaken. Rights requests are currently handled manually and can be submitted to [email protected]. We will respond within 30 days of receipt.
• Right to Correction: You may request correction or updating of inaccurate or incomplete personal data
• Right to Erasure: You may request deletion of your personal data, subject to legal retention requirements and legitimate business needs. Please note that deletion of candidate data may cascade to associated interview records and documents due to system architecture. If you require selective erasure or anonymization, please contact us to discuss available options.
• Right to Grievance Redressal: You may contact our Grievance Officer (see Section 15) to raise concerns about our data processing practices
• Right to Nominate: You may nominate another individual to exercise your data rights in the event of your death or incapacity

• Our third-party service providers are primarily based in the United States
• Personal data (including interview transcripts and candidate information) may be transferred to and processed in the United States for AI processing, real-time communication, and document storage
• We ensure that appropriate contractual safeguards are in place with each provider to protect your data
• By using the Service (for employers) or participating in an interview (for candidates, as communicated by the employer), you acknowledge and consent to such international data transfers
• We will comply with any data localization requirements as may be notified by the Government of India under the DPDPA

• We use essential/strictly necessary cookies only for authentication and session management
• We use temporary browser storage for interview connection data (automatically cleared when the browser session ends)
• We do NOT use third-party analytics cookies
• We do NOT use advertising, retargeting, or tracking cookies
• We do NOT use social media tracking pixels

As we only use strictly necessary cookies, no separate cookie consent is required.

The Service is not directed at individuals under the age of 18. We do not knowingly collect, process, or store personal data from minors. If we become aware that we have collected data from a minor, we will promptly delete it.

Employers are responsible for ensuring that all candidates invited to interviews through the Service meet the minimum age requirement of 18 years. If an employer becomes aware that a candidate is under 18, they must immediately notify us and refrain from using the Service for that candidate.

Under data protection law, the employer is the data controller for candidate data processed through the Service. Interview Express acts as a data processor on behalf of the employer.

• Employers must ensure they have a lawful basis (such as consent or legitimate interest) to process candidate personal data through the Service
• Employers must inform candidates, prior to sending interview invitations, that: (a) the interview will be conducted by an AI agent, (b) the conversation will be transcribed and analyzed, (c) AI-generated evaluations will be produced, and (d) if recording is enabled, the interview audio will be recorded and stored
• Employers are responsible for compliance with all applicable employment laws, anti-discrimination laws, and data protection regulations in their jurisdiction
• Employers must not use AI-generated outputs as the sole or primary basis for adverse employment decisions without independent human review
• Employers are responsible for ensuring that all candidates invited to interviews are at least 18 years of age

Data Processing Terms

By using the Service, employers agree to the following data processing terms, which govern our processing of candidate data on the employer’s behalf:

• We process candidate data solely in accordance with the employer’s instructions and only for the purpose of providing the Service
• We maintain appropriate technical and organizational security measures to protect candidate data (see Section 7)
• We will not engage additional sub-processors without notifying the employer of material changes (see Section 5)
• We will assist the employer in responding to data subject rights requests and data protection impact assessments as reasonably required
• We will notify the employer of any personal data breach in accordance with Section 8
• Upon termination, we will retain and delete data in accordance with Section 9
• We will make available information necessary to demonstrate compliance with applicable data protection obligations upon reasonable request
• Enterprise customers requiring a standalone Data Processing Agreement (DPA) with additional terms may contact us at [email protected]

In accordance with Section 23 of the DPDPA, 2023 and Rule 5(9) of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011:

The designated Grievance Officer details are as follows:

• Designation: Grievance Redressal Officer
• Email: [email protected]

We will acknowledge your grievance within 48 hours and endeavor to resolve it within 30 days of receipt.

We may update this Privacy Policy from time to time. Changes will be reflected by updating the “Last Updated” date at the top of this page.

For material changes to this Privacy Policy (including changes to data collection practices, sub-processor usage, or data sharing mechanisms), we will notify registered users via email at least 15 days before the changes take effect. We encourage you to review this page periodically to stay informed of any updates.

Continued use of the Service after the effective date of updated terms constitutes acceptance. If you do not agree with the revised Privacy Policy, you must stop using the Service.

For all inquiries (general, privacy, grievances), please contact us at: [email protected]

For more information about our terms of use, please review our Terms of Service.