Privacy Policy

0. Privacy at a glance

• Who decides: The company you apply to decides how your application is used for its hiring. We (Eroforze Systems Private Limited, trading as Edgeryt) run the platform for them.
• What we collect: Your contact details, CV and answers. During a monitored test we also collect camera photos (about every 30 seconds), short clips around integrity issues, microphone signals, screen activity, your ID photo and an approximate city based on your IP address.
• Face and voice checks: We compare your face with your ID photo and check whether more than one face or voice is present. Some laws treat this as biometric data, so we ask for your separate consent first. If you say no, you can ask for a non-biometric check, and saying no will not count against you.
• AI: AI may suggest scores for written answers and flag possible integrity issues. A person at the hiring company reviews the results before any decision. You can ask for human-only grading.
• Optional talent profile: You can choose to let us keep your profile for 12 months to tell you about matching jobs and let you reuse your results. It is off unless you tick the box, and you can turn it off at any time.
• How long we keep data: Recordings and photos: the number of days shown before you start (7 by default, never more than 30). Biometric data: within 30 days. Application data: as the hiring company sets, up to 12 months after the job closes or a decision is made. Talent profile: 12 months after your last activity.
• Your rights: You can see, correct, delete or export your data, or withdraw consent, by emailing privacy@edgeryt.com or using "Manage my data" in any email.
• Where: Application data is stored in the United States (Virginia), and files and media in {{OWNER: R2 bucket jurisdiction}}. Transfers are protected as described in section 16.
• We never sell your data, use it for advertising, or train AI on your camera or voice data.

1. Introduction

This policy explains how Eroforze Systems Private Limited ("we", "us") collects, uses, shares and protects personal information in Edgeryt Hire, Edgeryt Assessment and Edgeryt Campus. If you do not want to be monitored in an assessment, you can decline to start, or ask the hiring company for an alternative arrangement.

2. Who we are

Eroforze Systems Private Limited, 180/2, Bharathi Nagar, Sirumugai Post, Mettupalayam, Coimbatore, Tamil Nadu – 641302, India. CIN U28249TZ2024PTC031297. Email: privacy@edgeryt.com.

• Data Protection Officer: {{OWNER: DPO name and email, or "not appointed"}}
• Grievance Officer (India): {{OWNER: name, designation}}, privacy@edgeryt.com
• EU representative: {{OWNER: name, address}}
• UK representative: {{OWNER: name, address}}

3. Scope

This policy covers:

• workspace users (admins, recruiters and interviewers);
• candidates who apply, book interviews or take assessments;
• visitors to our public pages.

We serve India, the UAE, Saudi Arabia, the United States, the United Kingdom, the EU/EEA, Singapore and South-East Asia. Where a hiring company shows its own privacy notice, that notice also applies.

4. Information we collect

• Identity and contact details: name, email and, optionally, phone.
• Account and security data: password hashes, 2FA status, sessions, sign-in IP and approximate location.
• Workspace content: jobs, forms, notes, stages and team roles.
• Application materials: answers, CVs and other uploaded files.
• Assessment data: answers, scores, integrity events, device and network metadata, and optional camera, microphone and screen media.
• Identity data: a face photo and, when enabled, a photo of a photo ID (government, college or employee ID).
• Biometric data: face geometry and voice characteristics, used only for identity and presence checks (see section 11A).
• Interview metadata, billing metadata, and support messages.

5. How we collect it

We collect information:

• from you (forms, uploads, consent choices and browser permissions);
• from the hiring company that invites or imports you;
• automatically from your browser or device;
• from connected meeting providers (Google, Microsoft, Zoom);
• from our payment processor.

6. How we use personal information

For the hiring company (we act as its processor): to run applications, assessments, interviews and emails; to score assessments and show integrity summaries; to run optional AI features; and to apply the retention, export and deletion settings the company chooses.

For our own purposes (we act as controller): to secure accounts and prevent abuse; to bill and support customers; and to comply with the law.

Only if you opt in (we act as controller):
(a) emailing you about job openings that match your profile;
(b) letting you reuse a completed, verified result in another employer's process, which you approve each time;
(c) pre-filling future applications.

De-identified statistics: we use aggregated data that cannot identify you to improve question quality and to test our tools for bias.

We do not use your data for any other purpose without asking you again. We do not sell your data, use it for advertising, or train AI on your camera or voice data.

7. Legal bases (GDPR / UK GDPR and similar laws)

• Contract: to provide the service to our customers and to you.
• Legitimate interests: security, integrity of the service, support, and de-identified quality and bias testing.
• Consent: for camera, microphone and screen monitoring; for biometric checks (explicit consent under GDPR Art. 9(2)(a) and as "sensitive" data under the KSA and UAE laws); and for the optional talent profile. You can withdraw consent as easily as you gave it. Withdrawing does not affect processing that already happened. Refusing biometric checks lets you ask for an alternative check, and refusing will not by itself count against you.
• Legal obligation: retention required by tax and company law, and lawful requests.

For hiring decisions, the hiring company sets its own lawful basis.

8. Candidate and assessment data

The hiring company decides why candidate data is collected for hiring and how long it is kept, up to the limits in section 18. Before an assessment starts, you see exactly what it will collect. Monitoring stops when you submit. See also the Candidate Assessment Terms.

9. Recruiter and employer account data

We keep the name, email, role, preferences, branding assets and sign-in logs of workspace members. Removing a member ends their access.

10. CVs and application data

Files are kept in object storage. We parse CVs to extract skills and experience and to calculate a match score with the job. The score is used for sorting and display. It does not make decisions, and recruiters can ignore it.

11. Assessment, proctoring and interview data

Depending on how the assessment is set up, we collect:

• answers, uploaded files, timestamps and scores;
• browser, device and screen size;
• IP address, internet provider and approximate city;
• integrity events (leaving fullscreen, switching tabs, copy/paste, extra displays);
• camera, microphone and screen monitoring after browser permission, including a photo about every 30 seconds when the camera is required, short clips around integrity issues, and continuous screen recording only while you work outside the browser on a file question;
• identity photos and, when enabled, an ID photo;
• signs that automation tools are controlling the browser.

For interviews we store scheduling metadata and join links. Meeting-provider tokens are encrypted and deleted when the integration is disconnected.

11A. Biometric information (Illinois BIPA, GDPR Art. 9, and similar laws)

We use face geometry and voice characteristics only to check identity and presence during your assessment. Face and voice comparisons run on your device. ID photos and camera photos are uploaded so reviewers can see them.

We ask for your separate written (electronic) consent first. We do not sell, lease, trade or otherwise profit from biometric data. We share it only with the hiring company and the processors in our Subprocessor List.

Destruction schedule: we permanently destroy biometric data and identity photos within 30 days after your assessment, or sooner when the purpose ends. In every case this happens no later than 3 years after your last interaction with us.

12. AI and automated decision-making

Optional AI may generate questions or suggest grades for written answers. Proctoring checks run mostly on your device. We do not infer emotions or personality. AI grades and integrity bands help human reviewers; the hiring company makes every hiring decision. You can request human-only grading. Details are in the AI & Automated Decision-Making Notice.

13. Cookies

We use only essential cookies and first-party browser storage, and no advertising or analytics cookies. See the Cookie Policy.

14. Sharing

We share personal information:

• with the hiring workspace, according to each member's role;
• with service providers (section 15);
• with meeting providers the workspace connects;
• with another employer, only when you approve sharing a talent-profile result;
• when the law requires it, or to protect safety and the service.

We do not sell or "share" personal information (in the CCPA sense).

15. Subprocessors

A current list is published at /legal/subprocessors. Categories include:

• Convex, Inc. — Application database and serverless backend
• Cloudflare, Inc. (R2) — Object storage for files and assessment media
• Resend — Transactional email delivery
• Razorpay — Subscription billing and payment processing

Optional and gated providers (AI, sandbox, Zoom, etc.) process data only when enabled for the deployment or workspace.

16. International transfers

We are an Indian company. The database is in the United States (Virginia), and files and media are stored in {{OWNER: R2 bucket jurisdiction}}. Our safeguards:

• EEA/Switzerland: EU Standard Contractual Clauses (2021/914).
• UK: the ICO International Data Transfer Addendum.
• Saudi Arabia: SDAIA Standard Contractual Clauses plus a transfer risk assessment.
• UAE: contract terms binding recipients to the PDPL, or your express consent where no other basis applies.
• Singapore: contracts giving protection comparable to the PDPA.
• India: transfers are allowed except to countries the government restricts.

Copies of these safeguards are available from privacy@edgeryt.com.

17. Security

Encryption in transit, access controls, encrypted integration tokens, rate limiting, and file storage kept separate from database records. No system is completely secure. See the Trust Center.

If a breach affects you, we tell the hiring company without undue delay and within 48 hours. Where we are the controller, we tell regulators and affected people within the deadlines the law sets (for example 72 hours under GDPR and the DPDP Rules).

18. Retention

Backups roll off within 35 days.

19. Your rights

Depending on where you live, you can access, correct, delete, export or restrict your data, object to processing, withdraw consent, and (in India) nominate someone to act for you.

• Email privacy@edgeryt.com or use "Manage my data".
• For hiring decisions, contact the hiring company. We will pass your request on within 2 business days.
• Response times: 30 days under GDPR, UK GDPR, PDPA and KSA PDPL; 45 days under CCPA; within the time the DPDP Rules require in India.

You may complain to:

• the Data Protection Board of India;
• your EU supervisory authority or the UK ICO;
• SDAIA (Saudi Arabia);
• the UAE Data Office;
• Singapore's PDPC.

20. EEA and UK

You have the rights of access, rectification, erasure, restriction, portability and objection. You can also obtain human intervention in, give your view on, and contest solely automated decisions. A DPIA summary is available on request.

21. California (CCPA/CPRA)

• What we collect: identifiers, professional information, internet activity, audio/visual data, approximate geolocation, and inferences (scores).
• Sensitive personal information: government ID and biometric data, used only to verify identity and only for purposes permitted under Cal. Code Regs. §7027(m).
• Retention: see section 18.
• Your rights: to know, delete and correct your data, and to opt out of sale or sharing (we do neither). From 1 January 2027 you can also opt out of automated decision-making technology used in hiring decisions, or appeal to a human reviewer, and access information about how it was used.
• Authorised agents may make requests for you. We will not retaliate against you for exercising your rights.

22. Other US states

Residents of other states with privacy laws have similar rights; contact us. Illinois candidates: see section 11A and the AI Notice.

22A. Regional terms

• India: Notices are in English and, on request, in any Eighth Schedule language; currently available: {{OWNER: translated languages}}. Every email has a link to withdraw consent.
• UAE and Saudi Arabia: Biometric data is sensitive data and needs your explicit consent. An Arabic version of this notice is available on request.
• Singapore: Contact our DPO at privacy@edgeryt.com. We do not send marketing messages to Singapore numbers on the Do Not Call registry.

23. Children

The service is for adult candidates. Under-18s (or the higher age set by local law) can only take part with verifiable parental consent. Otherwise we block them.

24. Candidates added by employers

Employers that import or invite candidates must have a lawful basis and give candidates any required notices.

25. Controller and processor roles

• Employer: controller (Data Fiduciary under the DPDP Act) for its own hiring.
• Edgeryt: processor for that hiring. Edgeryt is an independent controller for (i) account, security and billing data and (ii) the optional talent profile and the reuse purposes in section 6, which happen only with your separate consent.
• You: data subject (Data Principal under the DPDP Act).

26. DPA

Business customers can review the DPA at /legal/dpa and request a signed copy from privacy@edgeryt.com.

27. Third-party services

Integrations are also governed by the provider's own terms. We store only encrypted tokens and metadata, and delete them when you disconnect.

28. Changes

We will tell you about material changes by email or in the product at least 14 days in advance. We will ask for new consent before using your data for any new purpose.

29. Contact

privacy@edgeryt.com. We aim to reply within one business day, Monday to Friday.

Eroforze Systems Private Limited
180/2, Bharathi Nagar, Sirumugai Post, Mettupalayam, Coimbatore, Tamil Nadu – 641302, India

Email: privacy@edgeryt.com