1. Introduction

Interviewer.AI Pte. Ltd. (UEN 201837827Z) (“Interviewer.AI”, “we”, “us”, or “our”) operates an AI-powered video interviewing and candidate assessment platform at https://interviewer.ai (the “Platform”). Our Platform is used by organisations for recruitment, by educational institutions for admissions, and by individuals for interview skills development and practice.

We treat privacy as a fundamental right and are committed to the lawful, fair, and transparent processing of personal data across all the markets in which we operate. This Policy explains what personal data we collect, how we use it (including how our AI systems use it), how we protect it, how long we keep it, and what rights you have,regardless of where you are in the world.

We apply the strongest applicable privacy standard to all users as a matter of policy, not just legal minimum compliance. Where a market requires stricter protections than others, we apply those protections globally where doing so is practicable.

2. Scope — Who This Policy Covers

This Policy applies to all individuals who interact with our Platform:

• Job Candidates — individuals invited by an employer or organisation or have applied to a job posting directly or through a job board or a website  to complete an AI-powered video interview as part of a recruitment process.
• Employers and Organisations — companies, businesses, universities and HR teams who subscribe to the Platform to conduct candidate assessments. This includes customers who sign up directly online without speaking to our team.
• University and Admissions Applicants — individuals and university employees using the Platform as part of an educational institution’s admissions or assessment process.
• Students and Mock Interview Users — individuals and organizations using the Platform independently for interview practice, coaching, and skills development.

All of the above are treated as “users” under this Policy and are afforded the same core privacy protections, with user-type-specific provisions in Section 9.

3. Key Definitions

• Personal Data / Personal Information: any information relating to an identified or identifiable natural person, in any form. The precise definition varies by jurisdiction but all frameworks we operate under include this core concept.
• Sensitive / Special Category Data: data revealing racial or ethnic origin, political opinions, religious beliefs, health, sexual orientation, biometric characteristics, genetic data, or financial information. All jurisdictions we operate in apply heightened protections to this category of data.
• Data Controller / Data Fiduciary: the entity that determines the purposes and means of processing personal data. Interviewer.AI acts as controller for its own platform users; Employers and Institutions are controllers for their candidates’ data.
• Data Processor / Data Processor: an entity that processes personal data on behalf of a controller. Interviewer.AI acts as processor when processing candidate data on behalf of an Employer or Institution.
• AI System: our machine-learning and NLP-based system that generates scores, assessments, and insights from interview transcript and CV content.
• Transcript-Only Configuration: an AI assessment mode where only the text transcript of spoken responses is submitted to AI models. No facial, visual, emotion, or biometric analysis is performed.
• Candidate Portal: the self-service portal at https://hire.interviewer.ai/candidate where candidates can view, download, and delete their data at any time.

4. Data Controller and Processor Roles

4.1 When Interviewer.AI Acts as Data Controller

Interviewer.AI is the data controller when you visit our website, create and manage your own account (including self-serve sign-up without speaking to our team), contact us, or use the Platform as a student or independent mock interview user.

4.2 When Interviewer.AI Acts as Data Processor

When an Employer or educational Institution uses the Platform to invite candidates or applicants to complete interviews, Interviewer.AI processes candidate personal data as a data processor on behalf of that organisation. A data processing agreement is executed between us and all such organisations before any candidate data is processed. We process candidate data only on documented instructions and do not use it for any purpose beyond providing the contracted services.

Self-Serve Accounts: Customers who sign up online without speaking to our team automatically receive our standard Data Processing Agreement as part of the onboarding process. A data processing agreement is always in place before any candidate data is processed.

5. Contact Details and Privacy Team

For all privacy-related enquiries, data subject requests, or concerns, please contact us at:

Data Protection & Privacy Requests

• [email protected]

General Enquiries

• [email protected]

Registered Address
Interviewer.AI Pte. Ltd.
160 Robinson Road
#14-04 SBF Center
Singapore 068914

Candidate Self-Service Portal
https://hire.interviewer.ai/candidate

AI Explainability Portal
https://interviewer.ai/explainable-ai

6. Personal Data We Collect

We collect only the data necessary for the specified purpose. Categories vary by user type and deployment configuration.

6.1 Job Candidates

• Identity data: full name, email address, phone number (optional).
• Professional data: CV/resume, cover letter, employment history, qualifications, any other information specifically asked by the employer as part of the additional questions section
• Interview response data: video and audio recordings.
• Text transcript: the machine-generated text of spoken responses — the primary input to AI evaluation models.
• AI assessment outputs: scores, insights, and assessment reports generated from transcript and CV content.
• Technical data: IP address, session metadata, device type, browser information.
• Biometric-adjacent data (optional features only, where enabled and with explicit consent): facial expression and voice attributes. NOT processed in transcript-only or avatar-based configurations.

6.2 Employers and Organisations (including Self-Serve Accounts)

• Account registration data: name, email, company details, job title.
• Billing data: handled via PCI-DSS compliant payment processor. We do not store card details.
• Platform usage data: interview templates, candidate invitations, feature usage logs.
• Technical data: IP address, device identifiers, browser type.

6.3 University and Admissions Applicants

Identity and academic data, interview response data, transcripts, and AI assessment outputs — equivalent to job candidate data above. The institution is the data controller for admissions data.

6.4 Students and Mock Interview Users

• Account data: name and email address.
• Practice session data: video, audio, and transcripts of mock interview sessions.
• AI feedback data: scores, coaching recommendations, and progress metrics.

Student and mock interview data is never shared with employers, institutions, or any third party for recruitment or commercial purposes. It is used solely to provide the coaching service you have requested. You can delete your data at any time.

6.5 Data We Do Not Collect

We do not collect or process the following without a separate written agreement and legal review: biometric data for unique identification; facial geometry or facial recognition outputs; inferences about race, ethnic origin, political opinion, religious belief, disability, or sexual orientation from AI processing; government-issued identification numbers.

7. Purposes of Processing

We process personal data for the following purposes:

• Providing the Platform: delivering AI-powered interview and assessment services to all users.
• AI Evaluation: generating assessment reports, scores, and coaching feedback from interview transcripts and CV or resume content.
• Account and Subscription Management: managing accounts and subscriptions, including self-serve online sign-ups.
• Candidate Transparency: enabling candidates to access, download, and delete their AI assessment outputs via the candidate portal at https://hire.interviewer.ai/candidate.
• Customer Support: responding to support requests and queries.
• Platform Improvement: using anonymised, aggregated data to improve platform performance and AI model accuracy.
• AI Model Improvement (with separate explicit consent only): contributing anonymised data to AI model training.
• Security and Fraud Prevention: maintaining platform integrity and detecting misuse.
• Legal Compliance: meeting obligations under privacy and employment law across all jurisdictions we operate in.
• Marketing: sending service updates and promotional communications where you have consented or as otherwise permitted, with an easy opt-out always available.

8. Legal Bases for Processing and Regional Privacy Rights

Interviewer.AI processes personal data in accordance with applicable privacy and data protection laws in the jurisdictions where candidates, customers, and users are located. Depending on the country or region, we may rely on one or more lawful bases for processing personal data, including:

• Your consent;
• Performance of a contract or taking steps at your request before entering into a contract;
• Compliance with legal and regulatory obligations;
• Legitimate interests pursued by Interviewer.AI, our customers, or authorized third parties, provided such interests do not override your fundamental rights and freedoms;
• Other lawful grounds permitted by applicable law.

The lawful basis relied upon may vary depending on the processing activity, your location, and the organization conducting the recruitment process.

How Interviewer.AI Uses Your Information

As part of the recruitment and assessment process, Interviewer.AI may process personal data to:

• Facilitate and administer interviews and assessments;
• Record video, audio, text, and other candidate responses where enabled by the hiring organization;
• Generate interview transcripts and summaries;
• Produce AI-assisted assessments, recommendations, insights, and reports for authorized hiring teams;
• Verify candidate identity and help detect fraud, misuse, or security threats;
• Maintain platform security, audit logs, and compliance records;
• Improve platform performance, reliability, accessibility, and user experience where permitted by law;
• Comply with applicable legal, regulatory, and contractual obligations.

Our Role and the Role of the Hiring Organization

In most cases, the employer, recruiter, educational institution, or organization using Interviewer.AI determines why and how candidate information is processed and acts as the Data Controller (or equivalent legal role under applicable law).

Interviewer.AI generally acts as a Data Processor or service provider on behalf of that organization and processes personal data according to its instructions and applicable law.

In limited circumstances, Interviewer.AI may act as an independent Data Controller for activities such as platform security, fraud prevention, legal compliance, service administration, and responding to regulatory obligations.

Regional Requirements and Rights

India

For individuals located in India, Interviewer.AI generally relies on consent as the primary legal basis for processing personal data in connection with AI-powered interviews, candidate assessments, video recordings, transcripts, profile creation, and related recruitment activities.

Consent must be:

• Freely given;
• Specific to the identified purpose;
• Informed and transparent;
• Unconditional;
• Unambiguous and provided through a clear affirmative action.

Consent obtained for one purpose does not automatically extend to unrelated purposes. For example, consent to participate in an AI-assisted interview does not constitute consent for marketing communications or unrelated processing activities.

Where required by law, Interviewer.AI will provide additional notices and obtain separate consent before processing personal data for materially different purposes.

You may withdraw your consent at any time. Withdrawal will not affect processing already performed before the withdrawal but may affect our ability, or the hiring organization’s ability, to provide certain services or complete recruitment-related assessments.

Vietnam and Indonesia

For individuals located in Vietnam and Indonesia, Interviewer.AI obtains explicit, purpose-specific consent before collecting, using, storing, analyzing, transferring, or otherwise processing personal data where required by applicable law.

Separate consent may be requested for different processing purposes, including:

• Conducting AI-assisted interviews;
• Recording video and audio responses;
• Generating interview transcripts;
• Producing candidate assessment reports;
• Sharing information with authorized employers and recruiters;
• Improving platform functionality and service quality where legally permitted.

Silence, inactivity, or failure to object does not constitute consent. Consent may be withdrawn at any time, subject to applicable legal requirements.

European Economic Area (EEA), United Kingdom and Switzerland

For individuals located in the European Economic Area, United Kingdom, and Switzerland, Interviewer.AI processes personal data in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR), UK GDPR, and related national legislation.

Where Interviewer.AI acts as a Data Controller, we may rely on one or more lawful bases, including:

• Performance of a contract;
• Compliance with legal obligations;
• Legitimate interests;
• Explicit consent where required by law.

Subject to applicable legal requirements, you may have the right to:

• Access your personal data;
• Correct inaccurate or incomplete information;
• Request deletion of your personal data;
• Restrict processing;
• Object to processing;
• Receive a portable copy of your personal data;
• Withdraw consent where consent is the legal basis;
• Request information regarding automated decision-making and profiling activities.

Singapore

For individuals located in Singapore, Interviewer.AI processes personal data in accordance with the Personal Data Protection Act 2012 (PDPA).

Where permitted by law, Interviewer.AI may rely on consent, deemed consent, contractual necessity, legitimate business purposes, or other lawful exceptions recognized under the PDPA.

You may request access to and correction of your personal data and may withdraw consent, subject to legal, contractual, and regulatory requirements.

Brazil

For individuals located in Brazil, Interviewer.AI processes personal data in accordance with the Lei Geral de Proteção de Dados (LGPD).

Depending on the circumstances, Interviewer.AI may rely on:

• Consent;
• Performance of a contract;
• Compliance with legal or regulatory obligations;
• Exercise of legal rights;
• Legitimate interests;
• Other lawful bases permitted under the LGPD.

You may have rights including confirmation of processing, access, correction, anonymization, deletion, portability, information regarding data sharing, and withdrawal of consent where consent is the applicable legal basis.

California and Other U.S. States

For residents of California and certain other U.S. states with applicable privacy laws, Interviewer.AI provides rights and disclosures relating to the use of automated decision-making technologies and personal information processing.

Where Interviewer.AI is used as part of employment, recruitment, promotion, workforce planning, or other significant decision-making activities, you may have the right, subject to applicable law, to:

• Receive information about the use of automated decision-making technologies;
• Understand the categories of information used during assessments;
• Request information about the role of AI in the evaluation process;
• Opt out of certain automated decision-making activities where required by law;
• Request human review or additional information where such rights are available.

Interviewer.AI is designed to support and augment human decision-making. Final hiring and employment decisions remain the responsibility of the employer, recruiter, educational institution, or organization using the platform.

Additional information regarding AI governance, explainability, model oversight, and candidate transparency is available in our AI Explainability documentation.

Other Jurisdictions

For individuals located in countries not specifically identified above, Interviewer.AI will process personal data in accordance with applicable local privacy and data protection laws and will honor any rights provided under those laws.

Exercising Your Rights

Depending on your location and the applicable laws, you may have rights to:

• Access your personal data;
• Correct inaccurate personal data;
• Delete personal data;
• Restrict or object to certain processing activities;
• Withdraw consent;
• Request portability of personal data;
• Obtain information regarding automated decision-making and profiling;
• Submit a complaint to a relevant supervisory or regulatory authority.

Requests relating to recruitment decisions, assessment outcomes, or candidate records may need to be directed to the hiring organization acting as the Data Controller. 

9. User-Type Specific Provisions

9.1 Job Candidates

• The Employer that invited you is the data controller for your application data. Interviewer.AI is their data processor.
• AI assessments are decision-support tools only and do not make the final hiring decisions. The Employer makes all final hiring decisions. No candidate may be rejected solely on the basis of AI scores without human review by the Employer’s authorised personnel.
• Participation is voluntary. You may decline without this being the sole reason for disqualification.
• You can access, download, and permanently delete your AI assessment report, transcript, and personal data at any time via the candidate portal at https://hire.interviewer.ai/candidate. Deletion is immediate from the portal and propagated across all our systems within 30 days.

9.2 Employers and Organisations (including Self-Serve Accounts)

• You are the data controller for your candidates’ personal data. A data processing agreement is in place from sign-up.
• You must ensure candidates receive appropriate transparency notices before any AI-assisted interview.
• You must designate a human reviewer to review AI outputs before making any hiring decision. AI outputs must not be used as the sole basis for candidate rejection.
• You must mark candidate outcomes (Hired / Keep in View / Rejected) to trigger our automated deletion schedule.
• You may opt out of visual, audio, or facial analysis features through your company profile settings to support compliance with applicable privacy and AI regulations.
• You can opt out of Resume Scoring or WorkMap assessment at any time as well in your dashboard.
• You can select the parameters that you are using to evaluate from your Company profile, other than Communication Skills.

9.3 University and Admissions Applicants

• The educational institution is the data controller. Interviewer.AI is their data processor.
• AI assessments are decision-support tools only. Final admissions decisions are made by human reviewers.
• Where optional visual or audio AI features are enabled, explicit consent is obtained before your assessment.

9.4 Students and Mock Interview Users

• Interviewer.AI is the data controller for your practice and coaching data.
• Your data is never shared with employers or institutions for recruitment purposes without your explicit consent.
• You may delete your data at any time via account settings. Deletion is immediate and propagated across all our systems within 30 days.

10. How Our AI Works — Transparency Disclosure

Interviewer.AI uses artificial intelligence to evaluate interview responses. This section explains what our AI does, what data it uses, and what safeguards are in place. You have the right to a plain-language explanation of any AI-generated assessment that relates to you.

10.1 Interview Delivery Modes

Standard Video Interview

In standard mode, candidates record video responses. AI evaluation may include text transcript analysis and, where optional features have been agreed and consented to, visual and audio indicators. Explicit consent is obtained before any session involving optional visual or audio AI features.

Avatar-Based Interview

In avatar mode, a synthetic AI avatar presents interview questions. Video is recorded only for transcription. AI evaluates only the text transcript. Raw video and audio data are retained solely for audit, compliance, and platform integrity purposes in accordance with applicable legal and regulatory requirements. No visual analysis of the candidate is performed.

10.2 What the AI Evaluates

Active in all configurations: response relevance (NLP semantic similarity between answers and question intent); communication clarity (coherence, structure, vocabulary, grammar from transcript text); role knowledge (role-specific terminology and experience indicators); depth of response (substantiveness, examples, structured frameworks); resume/CV relevance (NLP cross-reference of transcript and CV against job description).

Optional only (requires separate legal review and explicit consent): visual professionalism, positive attitude (facial/audio), sociability (body language).

Not available on any configuration: emotion recognition in workplace or educational settings (prohibited under applicable AI regulations effective February 2025). Not performed: biometric categorisation to infer race, ethnic origin, political opinion, religious belief, sexual orientation, or disability; social scoring; subliminal manipulation.

10.3 Third-Party AI Providers

We use OpenAI (GPT models), Anthropic (Claude), and Google (Gemini) for NLP transcript evaluation. All receive text transcript content only — no raw video, audio, or direct personal identifiers. None of these providers use API data to train their general-purpose models. Transfers to USA-based providers are governed by EU Standard Contractual Clauses and equivalent contractual safeguards for other jurisdictions.

10.4 Human Oversight — Mandatory

All AI outputs are decision-support only. No candidate disposition action can be taken without a deliberate human action in the platform. Employer and Institution clients must designate a competent human reviewer to review AI outputs before any hiring or admissions decision is made.

10.5 AI Transparency and Explainability

Before any AI assessment begins, candidates are informed that AI-assisted technology is used, what data is collected and what the AI evaluates, that a human will review the output, and how to access their assessment report and request human review. Full AI scores and assessment reports are accessible via the candidate portal at https://hire.interviewer.ai/candidate at any time. Our Explainability Portal at https://interviewer.ai/explainable-ai provides plain-language descriptions of AI methodology and scoring.

10.6 AI Limitations and Bias Risks

• NLP models may carry residual associations between language patterns and protected characteristics. We mitigate this by separating demographic identifiers from transcript content, conducting periodic bias audits, and requiring human review for every hiring decision.
• Automated speech recognition accuracy may vary for non-native speakers or atypical speech patterns. Candidates can flag transcript errors via the candidate portal.
• AI scores are probabilistic decision-support inputs, not guaranteed indicators of job suitability.
• Candidates with accessibility needs may request an alternative assessment format by contacting [email protected] or the Employer directly.

11. Automated Decision-Making and Your Rights

Our Platform operates exclusively as a decision-support tool. It does not make hiring or admissions decisions autonomously. No candidate may be rejected solely on AI-generated outputs. Human review is mandatory for every disposition decision.

You have the right to request human review of any AI-assisted assessment, express your view, contest any decision, and receive an explanation of the AI scoring logic. These rights apply in all jurisdictions we serve.

Users in the United States (California): you have additional rights to opt out of automated decision-making technology that substantially replaces human decision-making for significant decisions including employment. To exercise this right, contact [email protected]. A human-review alternative will be made available.

Users in the United Kingdom: automated decision-making safeguards apply where decisions produce legal or similarly significant effects. You have the right to request human review, express your view, and challenge any automated assessment.

Users in Quebec (Canada): you will be notified when a decision is made based solely on automated processing of your personal information, before or at the time the decision is rendered.

12. Jurisdiction-Specific Requirements

The table below sets out the key privacy requirements and how we address them for each of our primary markets. Where requirements differ across jurisdictions, we apply the most protective approach as our baseline.

European Union & United Kingdom — Additional Notice: Customers operating in the EU/EEA or UK, or processing personal data of individuals located in the EU/EEA or UK, are required to contact Interviewer.AI to formalise a data processing agreement and, where required, a data protection impact assessment before using the platform in a production environment. Self-serve sign-up is available for evaluation and testing only. Production use involving EU/EEA or UK personal data must not commence until the required agreements are in place. Contact: [email protected] 

13. Data Sharing and Sub-Processors

We do not sell, rent, or trade your personal data to any third party. We share data only as follows:

• With the Employer or Institution that invited you, for the purpose of their recruitment or admissions assessment. That organisation is the data controller for your application data.
• With authorised sub-processors, all bound by data processing agreements. All sub-processors are contractually prohibited from using your data for their own purposes.

An up-to-date sub-processor list is available on request from [email protected]. We may also disclose data to law enforcement or regulatory authorities where required by applicable law.

14. International Data Transfers

14.1 Primary Data Residency — Singapore

Our primary data infrastructure is hosted on AWS in Singapore (ap-southeast-1). This is the default data residency for all platform and candidate data unless a specific regional configuration has been requested.

14.2 EU/EEA and UK Employer Accounts

For Employer or Institution clients where EU/EEA or UK data residency is required, candidate personal data is hosted exclusively within AWS eu-central-1 (Frankfurt). In this configuration, no routine transfer of candidate personal data to Singapore occurs for core service delivery.

14.3 Transfers to Third-Party AI Providers

Text transcript content is transmitted to OpenAI, Anthropic, and Google (all USA) for AI evaluation. These transfers are governed by EU Standard Contractual Clauses (EU 2021/914, Module Two) for EU/EEA/UK data, and by equivalent contractual protections for data governed by other frameworks. Direct identifiers are stripped from transcript content before transmission where possible.

14.4 Country-Specific Transfer Safeguards

• EU/EEA: Standard Contractual Clauses and, where applicable, EU-U.S. Data Privacy Framework. We no longer rely on the EU-U.S. Privacy Shield, which was invalidated by the Court of Justice of the EU.
• UK: UK International Data Transfer Agreements (IDTAs) or UK addenda to EU SCCs.
• Singapore: PDPA Transfer Limitation Obligation compliance — transfers only to organisations providing comparable protection.
• India: India’s framework operates on a blacklist approach — cross-border transfers are permitted unless restricted. We monitor the Government’s notification of any restricted countries or entities.
• Vietnam: cross-border transfers require a prior personal data protection impact assessment submitted to the relevant authority.
• Indonesia: cross-border transfers are subject to adequacy or contractual safeguard requirements under the applicable personal data protection framework.
• Australia: APP 8 cross-border transfer obligations — we take reasonable steps to ensure overseas recipients handle data consistently with the Australian Privacy Principles.
• Canada: transfers governed by PIPEDA’s accountability principle — recipients must provide comparable protection.

15. Data Retention

We retain personal data only for as long as is necessary for the purposes described in this Policy, or as required or permitted by applicable law, whichever is longer. When data is no longer required, it is securely deleted or irreversibly anonymised.

Data retention on our Platform operates on three independent tracks: candidate self-service deletion, organisation-controlled retention, and Interviewer.AI’s own baseline retention obligations, each described below.

15.1 Candidate Self-Service Data Deletion and Account Removal

Interviewer.AI provides candidates and students with self-service tools to manage and delete their personal data.

To access these controls, visit the Candidate Self-Service Portal:

https://hire.interviewer.ai/candidate

Option 1: Delete a Specific Interview

You may choose to delete data associated with an individual interview session. This will permanently remove:

• Video and audio recordings;
• Interview transcripts;
• AI-generated scores and assessments;
• Interview reports and related analytics.

Deleting an individual interview does not affect your Interviewer.AI account or other interview records. Your profile and account will remain active.

Option 2: Delete Your Account

You may permanently delete your Interviewer.AI account at any time.

Account deletion will remove:

• Your candidate profile;
• Account credentials;
• Interview history;
• Recordings and transcripts;
• Assessment reports and AI-generated outputs;
• Other personal data associated with your account, except where retention is required by law or legitimate regulatory obligations.

Account deletion is permanent and cannot be reversed once completed.

Deletion Timeline

Deletion requests initiated through the Candidate Self-Service Portal take effect immediately within the portal and Interviewer.AI production systems.

Interviewer.AI will propagate the deletion across its infrastructure, authorized service providers, sub-processors, backup systems, and disaster recovery environments within 30 calendar days, unless a longer retention period is required by applicable law.

Confirmation of Deletion

Upon request, Interviewer.AI can provide written confirmation that a deletion request has been completed.

Additional Rights

If you are unable to access the Candidate Self-Service Portal or wish to exercise additional privacy rights, you may contact Interviewer.AI’s Privacy Team at:

• [email protected]

Important — Employer and Institution as Data Controller: Where Interviewer.AI processes your data on behalf of an Employer or Institution as a data processor, a deletion request submitted directly to us will be forwarded to the relevant organisation for their review, as they are the data controller responsible for determining the lawful retention period. We will always notify you of this and of the outcome. If the organisation has a lawful basis to retain your data — such as an employment law obligation, audit requirement, or regulatory compliance need applicable in their jurisdiction — they may be entitled to retain it for that purpose even following a deletion request. In this case, we will communicate the reason to you.

15.2 Organisation-Controlled Retention

Where an Employer or educational Institution uses the Platform to conduct candidate or applicant assessments, they are the data controller for that assessment data and are responsible for determining how long candidate data is retained, in accordance with:

• Their own organisational data retention policy, which may specify different retention periods for successful candidates, unsuccessful candidates, and candidates retained in view for future roles;
• Applicable laws in their jurisdiction, including employment law, labour law, equal opportunities or anti-discrimination law, and sector-specific regulations. Retention obligations vary significantly by geography and industry;
• Audit and regulatory requirements imposed by industry regulators, government agencies, or internal governance frameworks.

Interviewer.AI will retain candidate data on behalf of the organisation for as long as instructed, or as required by applicable law, subject to our own baseline obligations in Section 15.3. Interviewer.AI does not proactively delete candidate data solely because no deletion instruction has been received — the absence of an instruction is not itself a trigger for deletion. Where no active instruction or applicable contractual retention period is in place, Interviewer.AI retains data for the minimum period necessary and subject to its own legal and audit obligations.

Employer Retention Requirements and Deletion Requests

In many jurisdictions, employers are required or permitted to retain recruitment and candidate assessment records for a specified period to satisfy legal, regulatory, audit, employment, equal opportunity, anti-discrimination, dispute resolution, or recordkeeping requirements.

Where an employer uses Interviewer.AI as part of its recruitment process, the employer typically acts as the Data Controller and determines the applicable retention period for candidate information.

As a result, Interviewer.AI may not be able to delete certain candidate data immediately if:

• The employer has instructed Interviewer.AI to retain the data;
• The employer has a legal or regulatory obligation to retain recruitment records;
• The employer has a legitimate legal basis to retain the information for audit, compliance, dispute resolution, or defense of legal claims;
• Applicable law permits or requires retention for a specified period.

Candidates may submit deletion requests directly to Interviewer.AI at any time. Upon receiving such a request, Interviewer.AI will review the request and, where appropriate, coordinate with the employer responsible for the recruitment process.

If the employer has a valid legal basis requiring continued retention of some or all of the requested information, Interviewer.AI may be unable to complete the deletion request immediately. In such circumstances, Interviewer.AI will inform the candidate of:

• The categories of information that cannot be deleted;
• The reason for the continued retention;
• The applicable legal, regulatory, or contractual basis for retention, where permitted by law;
• The anticipated retention period, if known.

Once the applicable retention period expires, or the legal basis for retention no longer applies, the relevant data will be deleted in accordance with the employer’s instructions and Interviewer.AI’s data retention and deletion procedures.

Nothing in this section limits any privacy rights available to candidates under applicable data protection laws. Interviewer.AI will evaluate all deletion requests in accordance with applicable legal requirements and the respective roles of Interviewer.AI and the employer as controller or processor of the personal data.

15.3 Default and Baseline Retention Periods

Where no specific retention instruction has been received from an organisation, or where Interviewer.AI is the data controller, the following indicative periods apply as a guide. Actual retention is determined by applicable law, any instructions from the Employer or Institution as data controller, and Interviewer.AI’s own legal, audit, tax, and regulatory obligations.

Interviewer.AI may retain certain categories of data for up to 7 years — or longer where required by applicable law — for audit, legal, tax, and regulatory compliance purposes, including records of contractual relationships, financial transactions, and service delivery. This 7-year baseline applies to Interviewer.AI’s own compliance records and does not restrict organisations from setting shorter or longer retention periods for candidate assessment data in accordance with their own legal obligations.

Data Retention for Candidates in the European Economic Area (EEA) and United Kingdom

For recruitment processes conducted by employers, recruiters, universities, or institutions located in the European Economic Area (EEA) or the United Kingdom, retention periods for candidate assessment data are typically determined by the applicable agreement between Interviewer.AI and the organization acting as the Data Controller.

These retention periods are established in accordance with applicable data protection laws, including the GDPR and UK GDPR, and are designed to comply with the principle of storage limitation, which requires personal data to be retained only for as long as necessary for the purposes for which it was collected.

As a result, retention periods may vary between organizations depending on:

• The nature of the recruitment or assessment process;
• Applicable legal, regulatory, and recordkeeping obligations;
• The organization’s documented retention policies;
• Any legal basis requiring continued retention of recruitment records.

Where Interviewer.AI processes personal data on behalf of an employer or institution, Interviewer.AI will retain and delete candidate data in accordance with the instructions of that organization and the applicable data processing agreement governing the relationship.

Candidates may exercise their privacy rights at any time by contacting either the hiring organization responsible for the recruitment process or Interviewer.AI’s Privacy Team. Where Interviewer.AI receives a request relating to data controlled by an employer or institution, we may refer the request to the relevant organization or assist them in responding as required by applicable law.

For questions regarding retention periods applicable to a specific recruitment process, please contact:

• [email protected]

15.4 Requesting Deletion

• Candidates and students (Interviewer.AI as data controller, e.g. mock interview users): visit https://hire.interviewer.ai/candidate to delete individual interview data or your entire account at any time, regardless of jurisdiction.
• Candidates (Employer or Institution as data controller): submit your request via the candidate portal or email [email protected]. We will forward your request to the relevant organisation for review against their applicable legal obligations. Where deletion is permissible, it will be completed within 30 days of authorisation. We will always communicate the outcome and the reason if a deletion request cannot be fully actioned.
• Organisations: contact [email protected] to instruct deletion of specific candidate records or all data held under your account. Confirmation will be provided within 30 days, subject to any applicable legal retention obligations.
• All users: for any deletion-related query, email [email protected]. We will respond within 30 days and confirm the outcome in writing on request, including the reason if a request cannot be fully actioned.

Deletion Rights Vary by Jurisdiction and Role: The right to deletion is not absolute in all jurisdictions. Where an Employer or Institution holds a lawful basis to retain candidate data — such as a statutory employment record-keeping obligation, an anti-discrimination compliance requirement, a regulatory audit obligation, or a legitimate business interest recognised under applicable law — that lawful basis takes precedence over a deletion request for the duration of that obligation. This applies particularly in markets such as India, Indonesia, and Vietnam. Interviewer.AI will always be transparent about the reason when a deletion request cannot be fully actioned, and will delete the data as soon as the lawful basis for retention no longer applies.

Legal Hold Notice: In some circumstances, Interviewer.AI or the relevant Employer / Institution may be required by law to retain data beyond the periods described above — for example, where data is subject to a litigation hold, regulatory investigation, court order, or statutory retention obligation. Where a legal hold applies, we will retain only the minimum data necessary and will notify affected individuals where legally permitted. Once the legal hold is lifted, data will be deleted in accordance with this Policy.

16. Data Security

• Encryption in transit: TLS 1.3 for all data between users, the Platform, and sub-processors.
• Encryption at rest: AES-256 for all data stored in AWS S3 and RDS.
• Access control: role-based access control (RBAC); multi-factor authentication (MFA) mandatory for all administrative access.
• Network security: VPC isolation; AWS GuardDuty threat detection; AWS WAF.
• Vulnerability management: Dynamic Application Security Testing (DAST) and penetration testing conducted annually by independent security experts.
• ISO/IEC 27001:2022 certified information security management system.
• Data minimisation in AI pipeline: raw video/audio deleted within 24 hours; demographic identifiers separated from transcript content before AI model evaluation.
• Privacy by Design embedded in our product development processes.

16.1 Data Breach Notification

We will notify relevant supervisory authorities and affected individuals of notifiable data breaches within the timeframes required by applicable law — 72 hours in most jurisdictions; 48 hours notification to our Controller Organisation clients to enable their own notifications. Where we act as data processor, we notify the relevant Controller Organisation without undue delay after discovering a confirmed breach.

17. Your Privacy Rights

We honour the following rights for all users, regardless of location. The precise scope of each right may vary by jurisdiction, but we apply a consistent, rights-respecting approach globally:

To exercise any of these rights, contact us at [email protected] or use the candidate portal at https://hire.interviewer.ai/candidate. We respond within 30 calendar days in all jurisdictions (extendable with prior notice for complex requests). There is no charge for exercising your rights unless requests are manifestly unfounded or excessive.

18. Cookies and Tracking Technologies

• Strictly Necessary Cookies: essential for website and platform functionality. Cannot be disabled without impairing functionality. Legal basis: legitimate interests or equivalent.
• Analytics Cookies: used to understand how visitors interact with our website. All data is anonymised before processing. Legal basis: consent. Opt out via our Cookie Preference Centre.
• Marketing and Advertising Cookies: used to measure marketing effectiveness, including via LinkedIn Insight Tag. Legal basis: consent. Activated only where you have given explicit consent via our cookie banner.

We use HubSpot for marketing and CRM purposes and LinkedIn Insight Tag to measure campaign performance. Marketing cookies are activated only following your consent. You can update your preferences at any time via our Cookie Preference Centre. Full Cookie Policy: https://interviewer.ai/cookie-policy.

19. Children and Minors

Our Platform is not directed to children  under 16 where local law requires. We do not knowingly collect personal data from children without appropriate parental or guardian consent. For users aged 13 to 17 (or under 21 where local law sets a higher threshold), parental or guardian consent will be sought where we have reason to believe a user may not fully understand the implications of giving consent. Student and minor user data is subject to heightened access controls and is never shared for recruitment or commercial purposes. If you believe we have inadvertently collected data from a child without appropriate consent, please contact [email protected] immediately.

21. Changes to This Policy

We review and update this Privacy Policy whenever required to reflect changes in applicable law, our data processing practices, or our AI system capabilities. Continued use of the Platform after the effective date of an update constitutes acceptance of the revised Policy.

Interviewer.AI Pte. Ltd. (UEN 201837827Z)

160 Robinson Road, #14-04, SBF Center, Singapore 068914

= Last Updated:: 1 May 2026