Privacy policy

1. Who is responsible for your data

Emploify AB, company registration number 559444-8291, Drottninggatan 97, 113 60 Stockholm, Sweden. You can reach us at support@emploify.se.

Who the controller is depends on why you use Emploify:

• When you take a simulation as part of a recruitment, the employer you are applying to is the controller. The employer decides why your data is processed and how long it is kept. Emploify is a processor and handles the data on the employer’s behalf, under our agreement with that employer.
• When you try the demo at app.emploify.se/prova, have an employer account or contact us, Emploify is the controller.

If the employer uses an applicant tracking system, such as Jobylon, we receive data from it and send the result back to it on the employer’s instructions. How the applicant tracking system then processes the data is decided by the employer and the system’s provider, and is not covered by this policy.

2. What data we process

If you take a simulation as part of a recruitment

• Contact details: name and email address, from the employer or the applicant tracking system.
• What you provide in your application: your CV and other files you upload, and your answers to any screening questions.
• The simulation: a video and audio recording, a transcript of the conversation and when it took place.
• The scoring: a score per criterion, the quotes each score is based on, a summary, the feedback to you and which AI model produced the scoring.
• Technical data: for example IP address, browser and logs of what happened in the service.

If you try the demo: your email address, your consent and the same simulation data as above. The demo sends no result to any employer.

If you use Emploify as an employer: name, email address, company, role, and data about sign-in and use.

If you visit emploify.se: technical data in our server logs, such as IP address, browser and which page you visited. The website uses no cookies for tracking or marketing.

We do not ask for sensitive personal data, such as data about health, ethnicity or religion. We do not analyse faces, voices or emotions, and we do not use biometric data to identify anyone.

3. Why we process the data, and on what legal basis

4. AI and automated decisions

• In the simulation you talk with an AI playing a role, and AI scores what you say. You are told this before the simulation starts, as the EU AI Act requires (Article 50).
• The AI scores only the transcript of the conversation. It does not analyse voice, tone, facial expressions or emotions, and draws no conclusions about personality. Emotion recognition in the workplace is prohibited under the AI Act (Article 5(1)(f)).
• Emploify makes no hiring decisions, and no decisions based solely on automated processing within the meaning of GDPR Article 22. The scoring is input, and a person at the employer makes the decision. You can ask the employer to have a person review your result.
• Every result names the AI model that produced it, so it can be traced afterwards.

5. Who receives the data

• The employer you apply to receives the result, the evidence and the recording in Emploify, but only if you choose to send your result.
• The employer’s applicant tracking system, if the employer uses one, receives the result and a link to the report.
• Our sub-processors process data on our behalf, under agreements with us:

• Authorities, where the law requires it.

We never sell personal data.

6. Transfers outside the EU and EEA

Two parts of the service process data in the United States. Everything else Google and Brevo do for us stays in the EU.

OpenAI runs the AI conversation, the transcript and the scoring. OpenAI is not certified under the EU-US Data Privacy Framework, so the transfer rests on the European Commission’s standard contractual clauses in OpenAI’s data processing agreement. Under OpenAI’s terms, data sent through their API is not used to train their models. OpenAI keeps what is sent through the API for up to 30 days so it can detect misuse, and deletes it after that.

Google Identity Platform handles sign-in, which means your email address, your password in hashed form rather than as readable text, and when you signed in. That transfer rests on the standard contractual clauses in Google’s Cloud Data Processing Addendum.

7. How long we keep the data

• Data from a recruitment is kept while the job you applied for is active at the employer, and is deleted 30 days after the employer closes or archives it. The employer can ask us to delete it sooner.
• Your CV and other files you upload are deleted automatically 30 days after upload.
• A result you do not send is kept only temporarily, so you can read the feedback, and is deleted if you leave without sending it.
• Data from the demo, meaning the recording, the transcript and the scoring, is deleted 30 days after you take it.
• A record that a demo was requested, meaning the email address and the date, is kept as a business record so we can see how the demo is used over time. You can ask us to delete it.
• Employer accounts are kept for as long as the agreement lasts, and invoicing records for as long as bookkeeping law requires.
• Logs are kept for 30 days. Logs of scoring and deletion are kept for 180 days, so that a result can be traced.
• Backups: a weekly backup of the database is kept for 98 days, and a rolling seven-day window lets us restore the database to an earlier point. A backup already taken is not changed when something is deleted, so data can remain in one until it ages out. Backups are only ever used to restore the service.

9. Security

Data is sent encrypted and stored with providers in the EU, except as described in section 6. Only people who need the data for their work can access it, and access is logged.

10. Changes

We update this policy when the service changes. The date at the top shows when it last changed. We tell the people affected about significant changes.

11. Contact

Emploify AB, Drottninggatan 97, 113 60 Stockholm, Sweden. support@emploify.se.