Privacy Policy

• As a controller: for account and billing data of Customer organizations and their staff, for visitors to our marketing website, and for our own compliance and security records (e.g. audit logs).
• As a processor: for candidate data submitted through a Customer's recruitment — name, contact details, identity documents, assessment answers, proctoring evidence, and CV content — which we handle only on that Customer's documented instructions, for the purpose of operating the assessment they configured.
• If you are a candidate and have a question about how your data is used for a specific assessment, your first point of contact is the organization that invited you, since they control that recruitment. We are still glad to help — see "Contact us" below.

We only collect what the Service actually uses to run assessments and operate the platform — nothing here is aspirational or collected "just in case."

• Organization and staff accounts: name, work email, password (hashed, never stored in plain text) or Google sign-in identity, organization membership and role, and team invitation records.
• Candidate identity and application data: name, email, application reference, and — where a Customer has enabled identity verification for a given assessment — a government-issued ID or passport image, required before starting. Where collected separately, application-stage CV/résumé content and any reference file you upload as part of your submission.
• Assessment content: your answers to assessment questions, including any files you upload as part of an answer.
• Proctoring and monitoring data — only where a Customer has enabled it for a given assessment, and only after you explicitly consent: periodic webcam snapshots, a one-time guided room-scan capture, screen-share captures (where enabled), and browser/device event logs (tab visibility, window focus, fullscreen state, copy/paste/right-click attempts, connectivity changes, user-agent changes). We never record continuous video, and this data is never used for automatic identification or to generate an automatic accusation — see "How we use AI" below and our Proctoring Consent Policy.
• Technical and usage data: IP address (used transiently for rate-limiting and abuse prevention, not retained as a persistent profile), device/browser type, and standard server request logs. Separately, visitors who accept analytics cookies may have page paths processed by first-party analytics on public marketing pages and by Google Analytics on public marketing pages and the sign-up entry page. Google Analytics receives a generic site label rather than the page title. It does not record recruiter dashboard or candidate assessment activity.
• Billing and payment records: for Customer organizations, the details submitted with a payment (amount, currency, payment method, payment date, transaction reference, an optional note) and the proof-of-payment file uploaded (PDF or image), plus our verification decision. Payment proofs are stored privately and are visible only to the Customer's owners, administrators, and billing members, and to authorized Evalynq staff. We do not collect or store card numbers.
• Support and correspondence: anything you send us directly, e.g. by email.

• To operate the Service a Customer has configured: delivering invitations, running timed assessments, scoring, enabling human review, and generating results and reports for that Customer.
• To verify candidate identity and assessment integrity, including through the proctoring features a Customer has enabled and a candidate has consented to.
• To maintain, secure, and improve the Service, including audit logging, abuse and rate-limit protection, and debugging.
• To communicate with you — transactional email (magic links, invitations, reminders, interview scheduling) and, where you contact us, support correspondence.
• To meet legal, accounting, and regulatory obligations, and to enforce our agreements.
• We do not sell personal data, and we do not use candidate assessment content or proctoring data for advertising.

Where a legal basis is required by applicable law, we rely on one or more of the following, depending on the data and context:

• Contract: processing a Customer's account data, and processing a candidate's assessment submission, is necessary to provide the Service the Customer subscribed to and the assessment the candidate was invited to complete.
• Consent: camera monitoring, screen-share monitoring, and the identity/room-scan capture are only ever activated after a candidate affirmatively consents via a dedicated, unticked checkbox — never on by default, and never a condition bundled into a broader agreement.
• Legitimate interests: securing the Service, preventing fraud and abuse, and maintaining audit and security logs, balanced against your rights and expectations.
• Legal obligation: where retention or disclosure is required by law.
• If you are located in a jurisdiction that requires a specific legal basis be named for a particular processing activity not covered above, contact us and we will clarify it for that activity.

A Customer may optionally enable AI-assisted scoring suggestions or CV screening for their own assessments. This is off by default, and never active unless a Customer has explicitly turned it on.

• When enabled, submitted answer content or CV content is sent to a third-party AI inference provider (currently Google's Gemini API) to generate a suggested score, match rating, or rationale.
• This is advisory only. The AI never scores, rejects, shortlists, or accepts a candidate automatically — a human reviewer at the Customer organization always makes the final decision, and every AI suggestion is logged as such.
• We do not use candidate data to train our own or any third party's general-purpose AI models.
• We never use facial recognition, and we never make or apply an automated decision about a candidate's honesty or eligibility. Proctoring signals only ever produce an advisory concern score that routes an attempt for human review.

We share personal data only with the service providers ("sub-processors") necessary to run the Service, and only to the extent needed for the purpose stated. We do not sell personal data or share it for third-party advertising.

• Email delivery (magic links, invitations, reminders) — an SMTP relay provider (Brevo).
• Public-site analytics — Google Analytics receives consented page views from public marketing pages and the sign-up entry page. We disable Google advertising personalization and do not send query strings, page titles, or candidate assessment content to Google Analytics.
• Private file storage (identity documents, proctoring evidence, answer files, question attachments, CV submissions) — an S3-compatible object storage provider (Backblaze B2). Storage is never public; access is exclusively through short-lived, signed links generated on demand for authorized staff, and every access is audit-logged.
• AI-assisted grading and CV screening, only for a Customer that has explicitly enabled it — Google's Gemini API.
• Application hosting and database — Render (web hosting, PostgreSQL database, Redis-compatible cache, scheduled jobs).
• Optional error tracking — Sentry, only where configured; request bodies, cookies, authorization headers, and candidate content are never sent to it, by construction.
• We may also disclose information where required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets (with notice to affected Customers where practicable).

Evalynq and its sub-processors operate infrastructure that may be located outside the country where you or your organization are based. Where we transfer personal data across borders, we take steps intended to ensure it remains protected consistent with this policy, including entering into data processing terms with our sub-processors. If you are located in a jurisdiction that requires a specific transfer mechanism (such as Standard Contractual Clauses) for a particular transfer, contact us and we will provide the applicable detail or documentation.

• Identity documents, proctoring evidence (webcam snapshots, room scans, screen captures), candidate answer files, CV submissions, and question reference attachments are deleted automatically once the retention period configured for that assessment elapses (30 days by default; each Customer can configure a different period, from 1 day up to 10 years, for their own assessments). Deletion is enforced by a scheduled job and is applied at the storage layer, not just hidden from view.
• Account, candidate profile, assessment configuration, and scoring/result records are retained for as long as the Customer's account is active, since a Customer needs ongoing access to their own recruitment history. A Customer can request deletion of a specific candidate's data at any time (see "Your rights and choices" below), or full deletion of their organization's data on account closure.
• Billing and payment records, including proof-of-payment files, are kept as financial records for as long as the Customer's account is active (including after the related assessment is deleted) and are deleted when the organization's data is deleted, unless we must keep them longer to meet a legal or accounting obligation.
• Security and audit logs are retained for the lifetime of the associated account, for accountability and security purposes, and are deleted when the account's data is deleted.
• We may retain limited information beyond these periods where required to comply with a legal obligation, resolve a dispute, or enforce our agreements.

• Private files are never publicly accessible; every access goes through a short-lived signed link generated on demand for an authorized, authenticated staff member, and is logged.
• Every Customer organization's data is isolated from every other Customer's at the database query level, not only in the interface.
• Passwords are stored as salted hashes, never in plain text. Invitation and password-reset links use single-use, hashed tokens.
• Candidate answers, correct-answer data, authentication tokens, and secrets are never written to application logs.
• No system is perfectly secure, and we cannot guarantee absolute security. We will notify affected Customers and, where legally required, affected individuals or regulators, in the event of a data breach affecting personal data.

• Depending on your location, you may have rights to access, correct, export, or request deletion of your personal data, and to object to or restrict certain processing.
• If you are a candidate, contact the organization that invited you first — as the controller for your recruitment, they are best placed to action most requests directly, and we support them in doing so. Deletion of a specific candidate's data (profile, answers, evidence, and files) is a feature the organization can use directly. If you are unable to reach the organization, contact us and we will assist or route your request.
• If you are a Customer or staff member, you can update most account information yourself, and can request export or deletion of your organization's data by contacting us.
• We will respond to a verified rights request within a reasonable time, and in any event within the time limit required by applicable law.

• We use essential, first-party session cookies to keep you signed in. Separately, the public marketing website and sign-up entry page may use optional Google Analytics cookies only after you accept analytics consent. Google Analytics does not record authenticated dashboard or candidate assessment activity.
• The candidate exam runner stores in-progress answers in your browser's local storage so they are not lost if your connection drops — this data stays on your device and is not a tracking mechanism.
• If the Service is installed as an app on your device (a Progressive Web App), a small, content-hashed set of static assets may be cached locally by your browser to make the app load faster; no personal data is cached this way.

The Service is intended for use by working-age job candidates and by organizational staff, and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will take appropriate steps to delete it.

We may update this policy as the Service evolves. If we make a material change, we will update the effective date above and, where appropriate, notify Customers directly. Continued use of the Service after a change takes effect constitutes acceptance of the updated policy.

Questions, requests, or concerns about this policy or how your data is handled can be sent to support@evalynq.com. Evalynq is not yet a registered corporate entity with a fixed registered address at the time of publication; a registered legal entity name and address will be added here once incorporation is complete.