1. Purpose of This Policy
This policy explains how we collect, use, store, transfer, and protect your data when you participate in an automated audio/video interview as part of our hiring process. Section 15 covers visitors to our website and people who request a free trial or demo.
This policy combines global privacy standards and complies with GDPR (EU/UK), CPRA/CCPA (USA – California), other U.S. state privacy laws (Virginia, Colorado, etc.), PIPEDA (Canada), the APPs under the Australian Privacy Act, Singapore PDPA, Hong Kong PDPO, Taiwan PDPA, and common APAC recruitment and labor regulations.
2. What Data We Collect
During the automated interview, we collect:
Interview Data
- Audio/video recording of your responses
- Automatically generated transcript
- AI-assisted analysis (e.g., summaries, keyword extraction, skill indicators)
- Voice-derived expression features. During a voice interview, our voice-AI provider derives signals about expression and tone from your voice. These are generated for, and stored as part of, your interview record. They are not used for identity matching or biometric identification.
- Interview metadata (time, duration, technical logs)
Profile Data
- Name, email, phone number
- Resume/CV and application details
- Any information you voluntarily provide during the interview
No biometric identification
We do not perform facial recognition, voiceprint identity matching, or other biometric identification. The expression features described above are derived signals, not identity biometrics.
3. Why We Collect Your Data
We process your data for:
- Evaluating your suitability for the position applied for
- Ensuring fair and consistent hiring
- Maintaining legally required recruitment records
- Audit, compliance, and dispute-resolution purposes
- Considering you for future roles for up to 3 years
- Ensuring the functionality and security of our interview platform
We do not use your data for marketing or advertising.
4. Legal Basis for Processing
Depending on your jurisdiction, we rely on:
EU/UK (GDPR & UK GDPR)
- Consent — for recording, analysis, and 3-year retention
- Legitimate interest — fair evaluation, record keeping, security
- Legal obligation — required retention (e.g., anti-discrimination laws)
United States (CPRA/CCPA + Other States)
- Notice at collection
- Legitimate business purpose
- Consent for recording where required (e.g., two-party consent states)
Canada (PIPEDA)
- Meaningful consent
- Reasonable business purpose
Australia (APPs)
- Consent for audio recording
- As required for recruitment and reasonable business purposes
Singapore / Hong Kong / Taiwan (PDPA/PDPO)
- Notified purpose + consent
- Reasonable necessity for recruitment
5. How Long We Keep Your Data
Default retention: 3 years. Your audio, transcript, AI-generated analysis, and derived features are stored for up to three (3) years to support future opportunities, compliance and audit needs, and defending against potential discrimination claims.
Early deletion. You may request deletion at any time. We will delete your data unless we are legally required to retain it (e.g., an ongoing investigation or regulatory requirement).
6. Your Rights
Your rights depend on your location, but generally include:
- Access — request a copy of your audio, transcript, or report
- Correction — fix errors in your transcript or personal information
- Deletion (Right to Erasure) — request that your data be deleted
- Restriction of Processing (GDPR Art. 18) — ask us to pause processing temporarily, without deleting your data
- Withdraw Consent — stop the use of your data for extended retention, future-role matching, or voice analysis
- Data Portability — receive your data in a downloadable, machine-readable format
- Right to Object (GDPR/UK GDPR Art. 21) — object to legitimate-interest processing
- Rights regarding Automated Decision-Making (GDPR Art. 22) — the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, and the right to obtain human intervention, express your view, and contest the decision (see Section 9)
- Lodge a Complaint (GDPR Art. 77) — complain to your local data protection authority (e.g., CNIL, ICO, BfDI)
- Do Not Sell or Share (CPRA) — we do not sell or share candidate data for advertising (for website visitors, see Section 15)
To exercise your rights, contact privacy@verahire.ai.
7. Who We Share Data With
Internal recipients. The hiring company's recruiting team and hiring managers, and authorized VeraHire personnel for support and operations, with access scoped to each organization.
Infrastructure sub-processors. Each operates under a binding Data Processing Agreement. Changes follow our sub-processor notification process, with advance notice to customers:
- Supabase — hosting, database, storage, authentication
- Vercel — application hosting
- Cloudflare — intermediate audio storage
- ElevenLabs — speech-to-text
- OpenAI — AI analysis and interview conversation
- Hume — voice AI and expression features
- Twilio — voice and SMS
- Postmark — email delivery
- Sentry — error monitoring
- PostHog — product analytics (see Section 11)
- Axiom — logging and observability
Applicant tracking systems. Where your prospective employer connects a third-party ATS, your data is shared at their direction, under their own instructions and integrations. They are the controller of data held in their own ATS.
We do not sell or monetize your personal data.
8. International Transfers of Data
Our primary systems and most sub-processors are located in the United States. Where data is transferred outside your home jurisdiction, we rely on:
- the EU-US / UK-US Data Privacy Framework (DPF) for sub-processors that are DPF-certified;
- the 2021 EU Standard Contractual Clauses (the post–Schrems II modular SCCs) and the UK International Data Transfer Addendum (IDTA) for sub-processors not covered by DPF; and
- supplementary technical and organizational measures.
You may request details of the safeguards applying to a particular sub-processor at privacy@verahire.ai.
9. Automated Decision-Making
Our automated systems assist with:
- transcription
- summarizing
- highlighting skills and keywords
- resume match-scoring
- generating structured reports
On the default workflow, these outputs are advisory and are reviewed by a person before any hiring decision.
Optional workflows, where your prospective employer chooses to enable them, may act on an automated score without a person in the loop — for example automatically inviting candidates above a score threshold, or advancing or declining an application at the resume stage. Where such a decision produces a legal or similarly significant effect for you, your GDPR Article 22 rights apply, including the right to obtain human intervention and to contest the decision (see Section 6).
10. Security Measures
We use industry-standard security practices, including:
- Encryption in transit (TLS) and at rest (AES-256)
- Role-based access controls and per-organization data isolation
- Signed, time-limited URLs for stored files
- Audit logging of recruiter actions
- Data minimization
- Regular security reviews
- Vendor risk management
11. Cookies & Analytics
We use PostHog for product analytics, on both the recruiter application and candidate-facing pages. On both, analytics run only where analytics cookies have been accepted.
Candidate interview and application pages. Where you accept, we record product-usage events associated with your candidate record, and session replay may capture a recording of your session as it appears on screen. Declining stops both, and does not affect your application.
Recruiter / customer application. Where a recruiter accepts, we record product-usage events for their logged-in session, to understand and improve how the product is used.
Strictly necessary cookies for authentication and session management are used on both, and are not optional.
Marketing website. On verahire.ai we use Google Analytics, Google Tag Manager and PostHog to see how the site is used, and Meta and LinkedIn tags to measure our ads. In the EU/EEA, the UK, Switzerland and Brazil they load only after you accept cookies. Elsewhere they load by default and you can opt out from the cookie banner or the Cookie settings link in the footer; a browser sending Global Privacy Control is treated as an opt-out.
12. Text messaging (SMS)
If you give us your mobile number when you apply for a job, we may send you text messages about your application - for example interview invitations, reminders, and messages from the employer's recruiter about your application. Message frequency varies with your application. Message and data rates may apply. You can reply STOP at any time to stop receiving them, or HELP for help.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. All other categories of data are subject to the sharing described in this policy.
13. Children's Data
Our service is intended for professional recruitment and is not directed to individuals under 18 (or under 16 where a lower age of digital consent applies). We do not knowingly collect personal data from children. If you believe a minor has provided us with personal data, contact privacy@verahire.ai and we will delete it.
14. Your Choices
You may choose to:
- Participate in the automated interview
- Request an alternative interview format
- Opt out of voice-derived expression analysis
- Withdraw extended retention consent
- Request deletion at any time
Withdrawing consent will not affect your application.
15. Website Visitors, Free Trials and Demos
This section applies when you visit our website or ask us for a free trial or demo, for example on our free-trial page.
What we collect
- Your work email, company name, how many people you hire a month and, if you choose to give it, your phone number
- The job description you write and the screening criteria you keep
- Resumes you choose to upload
- Technical and attribution data: your country (from your IP address), browser type, the page you came from and the ad or campaign that brought you, where cookies allow it
Resumes you upload
Upload only resumes you are allowed to share with us. We use them only to set up your account and show you how VeraHire ranks them. They are stored privately, and you can ask us to delete them at any time. If we set up your account with them, from then on they are held in your account under our customer terms.
How we use it
- To set up your account and send you your login
- To contact you about your trial, demo or account, by email and, if you added your number, on WhatsApp
- To measure and improve our website and ads
We rely on your consent for the resumes you upload, for WhatsApp messages and, where required, for cookies; and on our legitimate interest in responding to and following up on a business request. You can withdraw consent or object at any time.
If you add your phone number, we may send you WhatsApp messages about your account, such as your login. Reply STOP at any time to stop them. We do not share your number with third parties for their marketing.
Who we share it with
- Vercel — website hosting, private file storage and AI Gateway
- OpenAI — reading the job description to suggest screening criteria
- n8n — workflow automation that routes your request
- Attio — our customer relationship management (CRM) system
- Slack — internal notifications to our team
- Google, PostHog, Meta and LinkedIn — analytics and ad measurement, under the cookie choices described in Section 11
Under California law, using Meta and LinkedIn tags to measure ads can count as “sharing” for cross-context behavioral advertising. You can opt out from Cookie settings or with Global Privacy Control. We do not sell your personal data.
How long we keep it
Resumes: only as long as we need them to set up your account, or until you ask us to delete them. Your contact details and request: for as long as we have a business relationship with you, or until you ask us to delete them.
Your rights in Section 6 apply to this data too. Email privacy@verahire.ai to use them.
16. How to Contact Us
For questions, concerns, or rights requests, email privacy@verahire.ai. You may also contact your local data protection authority.