Privacy Policy

For users located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we rely on the following legal bases under the GDPR:

• •Performance of a contract (Art. 6(1)(b)) — to provide the Service to recruiters and to allow candidates to complete an assessment they have agreed to take.
• •Legitimate interests (Art. 6(1)(f)) — to secure the Service against abuse, prevent fraud, and improve the product. We balance these interests against your rights and freedoms.
• •Consent (Art. 6(1)(a)) — for any optional processing that requires it. You can withdraw consent at any time.
• •Legal obligation (Art. 6(1)(c)) — to comply with applicable law (tax, accounting, security incident reporting).

We use the data we collect to:

• Provide, operate, and maintain the Service
• Generate AI-powered assessments and candidate evaluation reports
• Make assessment results available to the recruiter who created the assessment
• Send service-related communications (account verification, password reset, security notices)
• Detect, prevent, and mitigate abuse, fraud, and security incidents
• Improve the Service and fix technical issues
• Comply with legal obligations

We use a small set of trusted sub-processors to operate the Service. The providers below support the Service. Optional advertising on public pages is described separately in section 8 and requires your consent:

• •OpenAI (United States) — Generates assessment questions, conducts AI interviews, and produces evaluation reports. Personal data sent to OpenAI may include candidate names, CV content, intake information, and AI interview transcripts. Per OpenAI’s API terms, your data is not used to train their models. See OpenAI Privacy Policy.
• •Amazon Web Services — AWS S3 (Stockholm, Sweden, eu-north-1) — Stores candidate CVs and generated PDF reports. Files are stored within the European Economic Area (EEA). See AWS Privacy Notice.
• •Render (United States) — Hosts our backend application servers and database. See Render Privacy Policy.
• •Vercel (United States) — Hosts our public website and frontend application. See Vercel Privacy Policy.
• •Cloudflare (United States, GDPR-compliant) — Provides DDoS protection, web application firewall, and bot mitigation in front of our API. May process IP addresses and request metadata. See Cloudflare Privacy Policy.
• •Stripe (United States, PCI-DSS certified) — Processes payments when you purchase a candidate pack. Card details are handled entirely by Stripe; we never store them on our servers. See Stripe Privacy Policy.
• •Recruiter access: Candidate assessment data is accessible to the recruiter who created the assessment. Candidates are informed of this when they begin the assessment.
• •Legal requirements: We may disclose information if required by law, court order, or in response to a valid legal request.

Personal data may be transferred to and processed in countries outside the EEA, including the United States, where some of our sub-processors are based (OpenAI, Render, Vercel, Cloudflare). Where required, these transfers are covered by appropriate safeguards, including the European Commission’s Standard Contractual Clauses (SCCs) and, where applicable, the EU-U.S. Data Privacy Framework.

Candidate CVs and generated PDF reports are stored on AWS S3 in Stockholm, Sweden (eu-north-1), within the European Economic Area.

We apply industry-standard security measures, including:

• Encryption in transit (HTTPS/TLS 1.2+) and at rest
• One-way password hashing with a strong, salted algorithm
• Strict access controls, role-based permissions, and authentication
• DDoS protection, web application firewall, and rate limiting via Cloudflare
• Logging and monitoring of suspicious activity
• Regular review of dependencies and infrastructure

No method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security but we work hard to protect your data.

• •Recruiter accounts: Retained for as long as the account is active. You may request account deletion at any time. After deletion, residual backups are purged within 90 days.
• •Candidate data (CV, intake, scores, transcripts): Retained for the duration the recruiter requires it to make a hiring decision, typically up to 12 months from the assessment date. Candidates may request earlier deletion at any time.
• •Server and security logs: Retained for up to 90 days for security and abuse prevention.

We use essential cookies required for the Service to function:

• sid — your authenticated session (for recruiters)
• Cloudflare cookies (__cf_bm, cf_clearance) — bot mitigation and security

With your consent, we use the LinkedIn Insight Tag on selected public marketing pages to measure advertising and build audiences for relevant LinkedIn ads. LinkedIn may receive the page URL, referrer, IP address, device/browser information, timestamps and cookie identifiers. This processing is optional and based on your consent.

The tag is not loaded on account forms, checkout confirmations, recruiter dashboards, candidate invitations, assessments, CVs or reports. We do not send candidate answers, scores, CV content or report contents to LinkedIn. Unknown URL parameters also prevent the tag from loading.

With the same advertising consent, our server can send LinkedIn a confirmed account activation or paid purchase event, its time, an advertising identifier and, for purchases, the amount and currency. We do not send your email, name, payment details or candidate data through this conversion integration. The advertising identifier is stored locally for up to 30 days and deleted when consent is withdrawn. Without consent or an available advertising identifier, these conversion events are not sent. A technical delivery record containing an opaque event identifier and delivery status prevents duplicate counting.

You can accept or reject advertising in the banner and change your choice through Advertising choices in the footer. Rejecting does not prevent use of the Service. We remember your choice in local storage for up to 180 days and then ask again. Withdrawing consent stops future tag loading; it does not erase data already received by LinkedIn or third-party cookies that only LinkedIn can manage.

LinkedIn Ireland Unlimited Company and its affiliates, including in the United States, process advertising data under their own terms. See the LinkedIn Privacy Policy and Cookie Policy for retention, international transfers and available controls.

You can block or delete cookies at any time through your browser settings. Note that disabling essential cookies may prevent you from using parts of the Service (e.g. logging in).

Subject to applicable law, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate or incomplete data
• Erasure (“right to be forgotten”) — request deletion of your data
• Restriction — request that we limit the processing of your data
• Portability — receive your data in a structured, commonly used, machine-readable format
• Objection — object to processing based on our legitimate interests
• Withdraw consent — where processing is based on consent
• Lodge a complaint — with your local data protection authority (e.g. CNIL in France, AEPD in Spain, ICO in the UK)

To exercise any of these rights, contact us at support@ismns.com. We will respond within 30 days. Candidates: if the recruiter is the data controller for your data, we may direct your request to them; we will tell you if that is the case.

EU representative: ISMNS does not currently appoint an Article 27 GDPR representative in the EU. For all data protection requests originating from the EU/EEA, please contact us at support@ismns.com.

For recruiter account data, ISMNS acts as the data controller.

For candidate data processed on behalf of a recruiter, the recruiter is the data controller and ISMNS acts as data processor. Recruiters are responsible for informing candidates about the processing and obtaining any consent required under applicable law.

The Service is not intended for individuals under 16. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us and we will promptly delete it.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via email or through the Service. The “Last updated” date at the top of this page indicates when the policy was last revised.