Privacy Policy

AI Interview Analyzer sp. z o.o., ul. Kaliny Jędrusik 6/53, 01-748 Warszawa, Poland ('we', 'us', 'our') is the data controller responsible for your personal data. We are committed to protecting your privacy in accordance with the EU General Data Protection Regulation (GDPR) and applicable national data protection laws. For any privacy-related inquiries, contact us at contact@aiinterviewanalyzer.com.

We collect the following categories of personal data

1. Account data - name, email address, company name, and role when you register
2. Interview data - audio recordings, transcripts, AI-generated analysis, scores, and reports created through the platform
3. Candidate data - name, email, and consent records for interview candidates
4. Connected account data - the email address, display name, provider account identifier, granted permissions, encrypted OAuth credentials, connection health, and synchronization metadata for email or calendar accounts that a user chooses to connect
5. Usage data - pages visited, features used, and technical logs for service improvement
6. Payment data - billing details processed securely through Stripe (we do not store credit card numbers)
7. Contact data - information you provide when contacting us through the contact form
8. Document safety and processing metadata - file hashes, malware verdicts, parsing/job status, provider/model identifiers, configuration revisions, credit charges and usage records needed for security, billing and auditability. Uploaded CVs and requested job materials are processed for the selected recruitment operation.

When you use the AI Interview Analyzer browser extension, the extension accesses only what is needed to support an interview recording that you start explicitly. It can detect supported meeting pages such as Google Meet, Zoom, and Microsoft Teams. It may ask you to share meeting audio through the browser's visible sharing picker, where you choose the selected tab, window, or screen before recording starts. If you choose a browser tab, this can include tab audio. The extension may also ask for microphone access to capture your own voice during the interview.

The extension stores authentication tokens, language settings, and active recording recovery state in chrome.storage.local, which is isolated from websites by the browser. Tokens are cleared when you log out or uninstall the extension. The extension does not read page content outside supported meeting detection, does not request access to all websites, and does not use recorded data for advertising or profiling. Audio recordings, transcripts, reports, consent records, retention rules, and deletion rights are the same as for recordings started from the AI Interview Analyzer web application.

When a recruiter or organization administrator connects a Google Workspace or Microsoft 365 account, AI Interview Analyzer requests only the permissions needed for actions that the user initiates. For Google Workspace, the Calendar Events permission is used to create, view, update, and cancel candidate interview events created through AI Interview Analyzer and to add Google Meet links. We may read those specific created events to keep their status synchronized, but we do not read or analyze unrelated calendar events. The Gmail Send permission is used only to send messages explicitly reviewed or requested by the user, such as recruiter-approved candidate feedback and separate recording and AI consent requests. We do not request permission to read Gmail and do not read inbox messages, sent-message content, attachments, or candidate replies. Basic OpenID profile and email permissions identify the connected account and display its sender identity.

For Microsoft 365, the corresponding delegated permissions are used to create, update, and cancel interview events, add Microsoft Teams links, send user-approved messages, identify the connected account, and, when an administrator explicitly connects a shared organization mailbox, send from that mailbox. AI Interview Analyzer does not request permission to read Microsoft 365 mailbox messages.

OAuth access and refresh tokens are encrypted at rest with AES-256-GCM and used only to provide these user-facing features. Tokens are removed from our systems when the account is disconnected. Users can also revoke access through their Google Account or Microsoft account settings.

Information received from Google APIs is used only to provide or improve these visible Google Workspace integration features. It is not used for advertising, profiling, creditworthiness decisions, or AI model training; it is not sold; and it is not transferred except as necessary to provide the requested feature through our contracted infrastructure, for security purposes, to comply with applicable law, or as part of a merger, acquisition, or sale of assets where the required consent is obtained. AI Interview Analyzer's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We process personal data for the following purposes

1. Providing our interview analysis service, including transcription, AI analysis, and report generation
2. Managing your account and organization
3. Creating and maintaining candidate interview events and sending user-approved candidate communications through connected accounts
4. Processing payments and managing subscriptions
5. Sending transactional emails (consent requests, feedback, password resets)
6. Improving our service based on aggregated, anonymized usage patterns
7. Complying with legal obligations. We do NOT use your data for advertising, profiling, or selling to third parties.

We process your data under the following legal bases

1. Contract performance - to provide the services you have subscribed to (Art. 6(1)(b) GDPR)
2. Legitimate interest - for service improvement and security (Art. 6(1)(f) GDPR)
3. Consent - for interview recording and analysis of candidate data (Art. 6(1)(a) GDPR)
4. Legal obligation - for tax, accounting, and compliance purposes (Art. 6(1)(c) GDPR). Before any interview, candidates provide explicit GDPR consent for both recording and AI-powered analysis through a mandatory consent flow integrated into the platform.

We use Microsoft Azure for cloud hosting, AI processing and storage. Production application records, document storage and audio storage are hosted in Azure West Europe. GPT-6 Luna, GPT-6 Sol and GPT-6.1 Sol use Azure EU Data Zone deployments. This is Microsoft's defined EU Data Boundary, which can include EFTA locations; it is not a promise of processing in one country or exclusively in EU member states. GPT-6 Astra uses Global Standard and may process prompts and responses outside Europe. The Azure account location in Sweden Central does not make a Global deployment EU-only.

Azure Speech uses West Europe and the LLM speech resource uses North Europe. Soniox is offered only through its European Union (EU) content region for real-time assistance and a separate final transcription of the recording. The US route is not offered. EU use requires a region-specific project, credential and matching EU endpoints, with no US fallback. Account metadata, usage and billing information can be processed outside the Soniox EU content region. Soniox states that API content is not used to train its models. Microsoft states that Azure OpenAI customer prompts and responses are not used to train its foundation models. These are provider commitments, not a claim of zero operational retention.

Azure also provides isolated document parsing in Container Apps, quarantined Blob Storage, Defender for Storage malware scanning, Event Grid and Queue Storage for scan results and background jobs, audio merge/conversion workers, PostgreSQL, managed Redis, Key Vault, monitoring, and isolated public-web retrieval with temporary file custody. These services process uploaded documents, extracted text, audio or operational metadata only as needed for the requested feature and its security controls. Public downloads use storage separate from candidate files.

Other providers include Stripe for payments, Fakturownia for invoicing, Brevo and Azure Communication Services for transactional email, and home.pl as an emergency SMTP fallback. Connected Google Workspace and Microsoft 365 features use the account and applicable provider terms selected by the customer. These providers can process service, delivery and account metadata under their terms; the location of a contracting entity alone is not a guarantee that every processing activity stays in the EU.

Transfers outside the EEA require an applicable GDPR Chapter V safeguard and the relevant processor agreements before customer-data use. Regional restrictions must cover the whole route, including final transcription and AI Coach. The current DPA and sub-processor notices govern processing on behalf of recruiting organizations. This policy update does not retroactively amend an accepted DPA.

We retain candidate data for a configurable period set by each organization (default: 12 months from the date a hiring decision is made). This period can also be adjusted per individual candidate when needed. All interview-related data - audio recordings, transcripts, AI-generated reports, and candidate documents - is treated as a unit and deleted together when the retention period expires. Before automatic deletion, candidates receive a warning email with the option to request an extension. Organizations can adjust the default retention period in their settings. Soniox asynchronous files and transcription objects are scheduled for deletion after the final result has been safely stored, with retries when provider deletion fails. This is not a zero-retention promise: provider operational metadata and legally required records may follow separate retention terms. Quarantined files, temporary processing objects and security-event queues follow their documented cleanup rules. Account data is retained while your account is active and deleted within 30 days of account closure. Payment records are retained for 7 years as required by EU tax law. Consent records are retained as long as the associated candidate data exists.

Under GDPR, you have the right to

1. Access - request a copy of all personal data we hold about you
2. Rectification - correct inaccurate personal data
3. Erasure - request deletion of your data ('right to be forgotten')
4. Restriction - limit how we process your data
5. Portability - receive your data in a machine-readable format
6. Object - object to processing based on legitimate interest
7. Withdraw consent - withdraw consent at any time without affecting prior processing. To exercise any of these rights, email us at contact@aiinterviewanalyzer.com. We will respond within 30 days.

We implement industry-standard security measures including

1. Encryption at rest (AES-256) for all stored data
2. Encryption in transit (TLS 1.2+) for all data transfers
3. Private Azure Virtual Network endpoints
4. Role-based access control
5. Regular security audits
6. PII detection and redaction capabilities. Despite our best efforts, no system is 100% secure. In the event of a data breach, we will notify affected users and the relevant Data Protection Authority within 72 hours as required by GDPR.

For privacy inquiries, data access requests, or complaints, contact AI Interview Analyzer sp. z o.o., ul. Kaliny Jędrusik 6/53, 01-748 Warszawa, Poland, at contact@aiinterviewanalyzer.com. You also have the right to lodge a complaint with your local Data Protection Authority.