Privacy Policy — IntervAI AI-Powered Hiring Platform

Version: 3.0 — June 2025
Owner: Team IntervAI
Last updated: 21.06.2025

1. Introduction

IntervAI ("we", "our", or "us") respects your privacy and is committed to protecting personal data in compliance with the General Data Protection Regulation (EU Regulation 2016/679 — GDPR), UK GDPR, and other applicable data protection laws. This Privacy Policy explains how we collect, use, process, share, and protect personal data when you use our AI-powered hiring platform.

This policy applies to our digital platform at Intervai — AI-powered Interview Platform, used to support AI-powered recruitment services and match candidates with potential employers (recruiters).

2. Data Controller

Company Name: IntervAI (Startup Phase)
Legal Status: Operating in MVP stage, not yet legally incorporated. This notice will be updated upon legal incorporation.
Contact Email: hello@intervai.net
Website: https://www.intervai.net
Address: [To be updated upon legal formation]

3. Categories of Personal Data We Process

A. Candidate Identity and Contact Details

Full name
Email address
Phone number
Profile photo (optional)
IP address
Postal address (optional)
LinkedIn or other social links (optional)

B. Application and Background Information

CV / resume (upload and extracted data)
Employment history
Education background
Certificates and qualifications
Language proficiency
Work authorization status
References

C. Motivation and Interaction

Cover letter or motivation answers
Desired role and salary expectations
Availability / start date
Recorded interview answers (text/audio)
Avatar-enabled or video-based self-presentations (optional)
Interaction logs (saved jobs, search preferences, feedback provided)

D. Technical and Analytical Data

Device type and browser
Date and time of access
Geolocation data (approximate)
Platform activity logs

E. Recruiter User Data

Name, email address, company name
Usage logs (login, activity, audit logs)

4. Purpose and Legal Basis for Processing

We process your data for the following purposes:

Purpose	Legal Basis
To enable creation of candidate profiles	Consent
To match candidate profiles with recruiter requirements	Consent, Legitimate Interest
To facilitate AI-powered interviews	Consent, Legitimate Interest
To analyze performance and suggest improvements to candidates	Consent
To forward application details to recruiters	Consent
To improve product functionality (anonymized)	Legitimate Interest
To comply with legal obligations (e.g., tax, law enforcement)	Legal Obligation
Recruiter account management and platform operation	Contract Performance, Legitimate Interest
Security monitoring and audit logs for recruiter accounts	Legitimate Interest
Communication with recruiters (service updates, notifications)	Contract Performance

5. How We Collect Your Data

We collect personal data:

Directly from you when you register, upload your CV, answer interview questions, or interact with the platform.
Indirectly via technical means such as cookies or analytics tools.
From third-party integrations (e.g., when you import data from LinkedIn).

6. Automated Processing and Profiling

Our platform may use AI tools to:

Evaluate interview answers
Provide feedback on speaking patterns, tone, clarity
Suggest strengths and improvement areas
Generate AI-based evaluation scores (skills, soft skills, fit)

These processes constitute AI-based profiling. AI-based profiling is used to provide recruiters with advisory evaluation scores to assist in screening and candidate assessment. These scores are supportive only and do not replace human decision-making.

The results are advisory only and do not constitute automated decision-making with legal or similarly significant effects. Final hiring decisions are always made by human recruiters.

7. Right to Object to Profiling

Candidates have the right to object to AI-based profiling at any time. However, because AI-based evaluation is an essential part of the IntervAI interview process, objecting to profiling means you will not be able to participate in the AI interview. To exercise this right, please contact hello@intervai.net prior to participating in the AI interview.

Consent Requirement: Participation in the AI interview requires AI-based evaluation. If you do not wish to be evaluated by AI, you may choose not to participate. By participating, you acknowledge that AI-based profiling may be used to support your evaluation. The process is advisory only — final hiring decisions are made by human recruiters.

8. Data Sharing and Third Parties

We may share your personal data with:

A. Employers / Recruiters

Only for positions you explicitly apply for. Recruiters receive your full profile as submitted. Once shared, they become independent controllers of your data.

B. Sub-Processors / Vendors

We use third-party providers for hosting, AI processing, analytics, communications, and infrastructure. These include:

Vendor	Purpose	Data Location
AWS	Hosting, data storage	EU region
Azure	Speech Recognition (SR)	EU region
OpenAI	LLM processing (resume parsing, AI interviewer)	US (SCC applied)
SendGrid (Twilio)	Email delivery	US (SCC applied)

All processors operate under GDPR-compliant terms. International data transfers are protected by Standard Contractual Clauses (SCCs).

9. International Transfers

Certain processors used by IntervAI (such as OpenAI and SendGrid) may process data outside the EEA, including the United States. These transfers are protected by Standard Contractual Clauses (SCCs) to ensure adequate protection of personal data. Where possible, EU-based data centers are selected (e.g., AWS, Azure).

10. Data Security Measures

We employ the following safeguards:

HTTPS/TLS encryption
Role-based access control
Server-side encryption of stored data
Regular backups and audit logs
Pseudonymization where applicable
Secure data centers in EU regions where possible

Further details are provided in our Security Measures document.

11. Data Retention and Deletion

Candidate Data

Active profiles are retained for up to 12 months.
You can delete your profile at any time by contacting hello@intervai.net.
Recruiters may delete data once the hiring process ends.
Some data may be retained anonymously for analytical purposes.
We may retain records as required by law (e.g., tax, legal defense).

Recruiter Data

Recruiter account data is retained during the business relationship and deleted within 12 months after account closure. Related audit logs are retained for 6 months for security and compliance purposes.

12. Your Rights

As a data subject, you have the following rights:

Right of Access
Right to Rectification
Right to Erasure
Right to Restrict Processing
Right to Data Portability
Right to Object, including objection to profiling
Right to Withdraw Consent
Right to Lodge a Complaint with a supervisory authority

To exercise these rights, contact hello@intervai.net. Requests will be handled within 1 month.

Supervisory Authority in Austria:
Datenschutzbehörde (DSB)
Barichgasse 40-42, 1030 Wien
Email: dsb@dsb.gv.at
Website: https://www.dsb.gv.at/

13. Recruiter Personal Data Handling

Data Collected

We collect and process the following personal data from recruiter users:

Name and email address
Company name and role
Account credentials (hashed)
Usage logs (login times, activity, feature usage)
Audit logs (security events, data access records)
Communication records (support requests, notifications)

Purposes and Legal Basis

We process recruiter data for:

Account Management: Creating and maintaining recruiter accounts, authentication, and access control — Legal Basis: Contract Performance
Platform Operation: Enabling platform features, managing job postings, and candidate communications — Legal Basis: Contract Performance
Security: Monitoring for unauthorized access, fraud prevention, and system integrity — Legal Basis: Legitimate Interest
Analytics: Understanding platform usage to improve services (aggregated/anonymized) — Legal Basis: Legitimate Interest
Communication: Service updates, technical notifications, and support responses — Legal Basis: Contract Performance

Data Retention

Sub-Processors

Recruiter data may be processed by the same third-party vendors listed in Section 8.B (AWS for hosting, SendGrid for email communications, etc.). All processors operate under GDPR-compliant Data Processing Agreements (DPAs). International transfers to the US are protected by Standard Contractual Clauses (SCCs).

Your Rights

Recruiter users have the same GDPR rights as candidates, including: access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. To exercise these rights, contact hello@intervai.net. Requests will be handled within 1 month. Note that exercising certain rights (e.g., erasure) may result in account closure and inability to use the platform.

14. Cookies and Analytics

Essential Cookies (Consent not required)

Session management and authentication
Security features and CSRF protection
User preferences

Retention: Session or 30 days max

Analytics Cookies (Requires consent)

Google Analytics: Traffic analysis, user behavior
Google Tag Manager: Tag and event management

Retention: 26 months (Google default)
Data processor: Google LLC (US) - covered by DPA

You can use our platform with essential cookies only. Analytics cookies help us improve the service but are optional.

15. Changes to This Policy

We may update this Privacy Policy as our platform evolves or legal requirements change. Major changes will be communicated via email or in-app notification. The latest version is always available at https://www.intervai.net.

16. Contact

Team IntervAI
Email: hello@intervai.net

Disclaimer: IntervAI is currently in its MVP and pre-legal-incorporation phase. This Privacy Policy is effective from the date of publication and subject to formalization upon legal registration of the entity.
End of Document — Version 3.0 — June 2025