Privacy Policy

1. Scope and roles

Employer account information. For information about employer users (for example account owners, HR managers and recruiters), Scrynova is the organization responsible for that information.

Candidate information. When a candidate applies to a job through Scrynova, the employer that posted the job decides why and how the candidate's information is used. The employer is the organization responsible for (the “controller” of) candidate information, and Scrynova processes it on the employer's behalf as a service provider (“processor”) under our Terms of Service and data processing commitments. Candidates should direct requests about an application to the employer first; we will assist employers in responding.

2. Information we collect

From employers

• Account and company details: company name, contact name, business email, phone number, country, province or state, website, address, logo and industry.
• Team member names, email addresses and roles.
• Billing details: billing name and email, subscription status and transaction records. Card details are collected and stored by our payment processor; Scrynova does not store full card numbers.
• Content you create: job postings, interview questions, evaluation criteria, notes, ratings and messages.
• Security and usage data: sign-in events, IP address, browser type, device information and actions recorded in audit logs.

From candidates

• Contact details: full name, email address, phone number, city, province or state and country.
• Professional information: resume, optional cover letter, optional LinkedIn profile URL and details extracted from the resume that the candidate reviews and confirms.
• Interview responses: video recordings, audio recordings, written answers and transcripts of recorded answers.
• Verification and consent records: email verification codes (stored only in hashed form), consent timestamps, the version of the notice accepted and the IP address at the time of consent.
• Submission location: the IP address and approximate location (city, region and country, derived from the IP address) of the device used to submit an interview, shown to the employer to help verify the submission and prevent fraud. It is never used to evaluate or score candidates.
• Accommodation requests the candidate chooses to provide.
• Technical information needed to deliver the interview, such as browser compatibility and connection checks. We do not use device-test results to evaluate candidates.

Candidates are never asked to create an account. We do not knowingly collect sensitive information such as health, religion, ethnicity or sexual orientation, and we ask employers not to request it.

3. How we use information

• To provide the platform: hosting job postings, delivering interviews, storing responses and presenting them to authorized employer users.
• To verify candidates' email addresses and prevent fraud and abuse.
• To generate transcripts and job-related screening summaries when the employer enables them (see section 4).
• To send service emails such as verification codes, application confirmations, interview reminders and messages from employers.
• To process subscriptions, invoices and payments.
• To secure, maintain, troubleshoot and improve the service, including aggregated, de-identified usage statistics.
• To comply with legal obligations and enforce our terms.

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use candidate interview content to train general-purpose artificial intelligence models.

4. Automated screening

Scrynova can analyze a candidate's resume, confirmed details, transcripts and written answers against the job's requirements and the employer's weighted evaluation criteria. It produces answer scores, an overall match percentage, a summary of strengths and missing requirements, and supporting excerpts. This processing may use third-party language-model and speech-to-text providers acting as our sub-processors.

• What is evaluated: job-related qualifications and the content of answers only.
• What is never evaluated: race, ethnicity, gender, age, disability, appearance, accent, voice characteristics, facial expressions, inferred emotions or any other protected characteristic. We do not perform facial analysis or emotion recognition.
• Human review: results are presented to employer staff as assessment aids. Scrynova does not reject candidates automatically, and employers are responsible for hiring decisions. Recruiters can review evidence, correct information, add their own assessment, flag evaluations and request re-evaluation.
• Notice and consent: before an interview starts, candidates are told that responses may be analyzed with automated tools, how the analysis is used, who can access responses and how long they are kept, and must give consent to proceed. Candidates may request an accommodation or an alternative process from the employer.

In Québec, candidates may be informed of the personal information used to render an evaluation, the principal factors that led to it, and may request that it be reviewed by a person. Where laws such as New York City Local Law 144 or the Illinois Artificial Intelligence Video Interview Act apply, employers are responsible for any required bias audits, notices and alternative selection processes; Scrynova provides consent capture, notice content, deletion tools and evaluation records to support those obligations.

5. Recordings and consent

Camera and microphone access is requested only when a candidate reaches a video or voice question and is used only to record answers. Recordings are stored privately and can be viewed only by authorized members of the employer's workspace through short-lived secure links. Candidates can review and, where the employer allows, retake recordings before submitting.

6. How information is shared

• With the employer: candidate information is available only to the workspace of the employer the candidate applied to. Employers cannot see other employers' data.
• With service providers: cloud hosting, storage, email delivery, payment processing, transcription and language-model providers, under contracts that require confidentiality, security and use only to provide services to us.
• Support access: Scrynova staff access a workspace only to provide support, investigate security issues or as required by law, with access logged.
• Legal and safety: when required by law, or to protect rights, safety and the integrity of the service.
• Business transfers: in connection with a merger, acquisition or sale of assets, subject to equivalent protections.

7. International data transfers

Scrynova serves employers and candidates worldwide. Scrynova and its service providers may store and process information in Canada, the United States and other countries. Information processed outside your province, state or country may be accessible to authorities under the laws of that jurisdiction. Where required (for example under Québec Law 25), we assess the protection afforded before transferring information and use contractual safeguards.

For personal data subject to the EU General Data Protection Regulation (GDPR) or the UK GDPR, transfers outside the European Economic Area or the United Kingdom rely on adequacy decisions where available (including the European Commission's adequacy decision for Canada for commercial organizations subject to PIPEDA, and the EU–U.S. Data Privacy Framework where applicable), or on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with supplementary measures where appropriate. You may request a copy of the relevant safeguards by contacting privacy@scrynova.com.

8. Retention

Employers configure how long candidate information and recordings are kept. By default, candidate applications are retained for 365 days and recordings for 180 days, after which they are securely deleted unless a legal hold applies. Deleting an application removes the associated recordings, transcripts and derived screening data. Employer account data is retained while the account is active and for a limited period after cancellation (90 days by default) to allow reactivation or export, then deleted or de-identified, except where we must keep records (such as invoices) for legal or tax purposes.

9. Your privacy rights

Depending on where you live, you may have the right to access, correct, delete or obtain a copy of your personal information, to withdraw consent, to object to or limit certain processing, to be informed about automated decision-making, and to not be discriminated against for exercising your rights. Residents of California, Colorado, Connecticut, Virginia, Texas and other U.S. states with comprehensive privacy laws may have additional rights; we honour Global Privacy Control signals where required.

European Economic Area, United Kingdom and Switzerland

For candidate data, the employer is the controller and Scrynova acts as its processor under a data processing agreement; for employer account, billing and website data, Scrynova is the controller. Where Scrynova is controller, we rely on these lawful bases: performance of a contract (providing the Service and billing), legitimate interests (securing and improving the Service, preventing fraud, and communicating with business users — balanced against your rights), legal obligation (tax, accounting and regulatory requirements) and consent where we ask for it (which you may withdraw at any time). Employers determine the lawful basis for processing candidate data, and recordings and automated screening require the candidate's explicit, informed consent before an interview begins.

You have the right to access, rectify, erase, restrict or object to processing of your personal data, to data portability, to withdraw consent, and not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects — Scrynova never makes hiring decisions automatically, and human review is always available. You may also lodge a complaint with your local data protection supervisory authority. We respond to requests within one month, extendable where permitted by law.

Other countries

Where other national privacy laws apply (for example in Australia, Brazil, India, Japan, Singapore or South Africa), we provide the rights and protections those laws require. Contact privacy@scrynova.com and we will help you exercise them.

• Candidates: contact the employer you applied to. If you can't reach them, email privacy@scrynova.com with the job title, company and your application reference, and we will forward and assist with your request.
• Employer users: manage most information in your workspace settings or contact privacy@scrynova.com.

We will verify requests before acting and respond within the time required by law. You may also contact the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, or your state attorney general or privacy regulator.

10. Security

We protect information with HTTPS encryption in transit, encryption at rest provided by our infrastructure, secure password hashing, optional multi-factor authentication, role-based access control, strict tenant isolation, signed media URLs, upload validation and malware scanning, rate limiting, audit logging and regular backups. No system is perfectly secure; we will notify affected organizations and individuals of breaches as required by law, including PIPEDA breach reporting obligations.

11. Children

Scrynova is intended for businesses and job applicants of legal working age. We do not knowingly collect information from children under 13 (or the minimum age in your jurisdiction).

12. Changes to this policy

We may update this policy from time to time. We will post the updated version with a new “last updated” date and notify employer account owners of material changes.

13. Contact us

Our Privacy Officer can be reached at privacy@scrynova.com. For general questions, contact support@scrynova.com.

This document is provided as a working draft and will be reviewed by legal counsel before commercial launch.