Privacy Notice

1. Who handles your information

Evidize LLC operates the U.S. Evidize website and platform. This notice covers website visits, demo bookings, accounts, applications, interviews and candidate device screening.

Evidize: we use information to run the service, manage accounts, provide support and protect access. We also process hiring information for customer organizations under our agreements with them.

The hiring organization: it chooses the job criteria and makes hiring decisions. It must provide any notice required for its own collection or hiring use. Ask the hiring contact for that notice and its data practices.

Contact: Evidize LLC’s mailing address is 418 Broadway STE N, Albany, ALBANY COUNTY, NY 12207 USA. The designated privacy email is privacy@evidize.com. You can also use the request form. You do not need an Evidize account to contact us about your information.

The state guide explains additional rights and notices. You can make a privacy or hiring-process request without accepting an employer's commercial contract.

2. What we collect and why

The information collected depends on the features used. The categories below identify the sources, purposes and factors that determine retention. Section 6 explains who receives information. Retention is determined for each category by its purpose, the applicable service settings, lawful customer instructions and any legal preservation duty.

Website visits

Information and source: your browser supplies an IP address, browser/device details, pages requested, request identifiers, times and errors. We can estimate city, region and country from your IP address without requesting GPS location. Use: display and localize pages, fix problems and protect the service. Retention: the relevant service-log period and any investigation.

Demo bookings

Information and source: when you use our Microsoft Bookings page, you provide your name, email, company name or website, appointment time and timezone. You may select a hiring challenge and describe what would make the demo useful. Use: arrange the appointment, prepare the demo and communicate with you about it. Recipients: Evidize and Microsoft, which operates Bookings and the connected scheduling and email services. Retention: the appointment and follow-up purpose, applicable communication schedules, requests and any legal preservation need. Do not submit candidate files or sensitive information in the optional demo fields.

Checks for automated submissions

Information and source: where Cloudflare Turnstile is enabled for applications or organization signup, your browser connects to Cloudflare and supplies security signals such as its IP address, browser headers, connection characteristics and the site being checked. Evidize sends a verification code and, when available, your IP address to Cloudflare for validation. Use: prevent automated abuse. Retention: verification, fraud or security needs, and the applicable service-provider and log schedules. Cloudflare processes information to provide the site-security service and also acts as a separate controller for improving its bot-detection service under its Turnstile privacy terms.

Accounts and subscriptions

Information and source: you, your organization and enabled sign-in services provide names, email addresses, organization and contact details, roles, permissions, sign-in records and subscription information. Use: manage accounts, access and the customer relationship. Retention: the account relationship, transactions, disputes, security needs and required business records.

Applications, interviews and assessments

Information and source: you and hiring users provide contact details, résumés, work and education history, skills, answers, professional links, interview times, meeting links, assessment materials, notes and scorecards. Enabled Microsoft 365 features can also supply interview transcript text, speaker labels and timings, as described in section 3. The service can produce extracted text, summaries, assessments of qualifications, scores, rankings, flags and decision reasons. Relevant AI inputs and outputs may form part of the hiring evidence. Use: manage applications, assess the disclosed job criteria, schedule interviews and support decisions. Retention: the hiring purpose, applicable record periods, later personnel actions, corrections, complaints and legal preservation needs.

Residence and assessment location

Information and source: you or the hiring organization provide your residence, job and office locations, and where you are taking an assessment. New York residents may be asked whether they live in New York City. Use: identify the rules for the particular activity. These are separate facts; an IP address or résumé alone does not determine legal coverage. Retention: the related hiring record and the need to explain which rules applied.

Device screening and security

Information and source: enabled checks collect running application names and identifiers, file locations and file-identification codes, computer user information, network addresses and service names, clipboard-event details, display count and layout, computer name, operating-system and app version, installation permissions, app health, times and check status. File locations, computer names and usernames can identify you. The service also creates security identifiers to detect duplicate or abusive submissions. Use: run the disclosed checks, protect meeting access and support authorized review. Retention: the session, any security investigation and applicable hiring-record periods. Section 4 explains what stays on your device.

Voluntary demographic and sensitive information

Information and source: optional demographic answers can include gender identity, race, ethnicity and veteran status. An accommodation request or material you submit may contain health or other sensitive information. Use: the stated voluntary reporting purpose, assistance and responding to requests. Demographic answers are stored separately from ordinary application records. Retention: the reporting or request purpose, required hiring records and any dispute or preservation need.

Communications and request records

Information and source: you, hiring users and delivery services provide messages, recipient and delivery details, request references and outcomes. We record notices shown, document versions, reviews, responses, exports and other service actions. Use: communicate, provide support, handle requests and document what happened. Retention: resolution and appeals, delivery problems, and applicable communication and recordkeeping periods.

Cookies and browser storage

Information and source: your browser stores sign-in details, the organization selected, preferences and unfinished forms, which may include candidate or interview information. Microsoft sign-in can also store account details and codes that keep you signed in. Use: keep sessions working and save preferences or drafts. Retention: the item's expiry, the session, completion of the form or clearing of browser storage. Some drafts remain after sign-out.

3. Microsoft 365, Outlook and communications

Microsoft Entra provides sign-in information. Your organization authorizes the connections and functions it enables; Microsoft's permission screen shows the requested access. Organization settings, connected accounts and Microsoft tenant policies determine which functions can operate. Availability of a feature does not mean every organization has connected it.

The Outlook add-in can read the open message or appointment, including attendees, time, location and body, to identify the candidate and meeting link. It sends selected candidate and meeting details to Evidize, rather than the full message body as interview content. A connected Microsoft Graph account can also supply profile information.

When enabled, Evidize can prepare, read and edit interview-related email drafts and personal calendar holds in the connected user's mailbox. This includes the selected recipients, subject, message body, appointment times and item identifiers. Users review and send drafts or invitations in Outlook. For an explicitly linked interview invitation, background checks can read its time and cancellation status and synchronize the corresponding interview and internal meeting. Disconnecting the connection does not delete existing hiring records or items already saved in Outlook.

Enabled Teams meeting setup can create an internal organizer-owned calendar meeting, obtain its joining link and request transcription settings. An organizer can also select automatic recording where the organization allows it; Microsoft tenant policies may restrict these options. The hiring organization must provide any notices and obtain any permissions required for recording or transcription. This notice does not supply those permissions. Microsoft handles any resulting recording and transcript under the organization's Microsoft settings and arrangements.

For an authorized, linked Teams interview, enabled transcript import retrieves the transcript text, speaker labels, timings and meeting or transcript identifiers from Microsoft Graph. Evidize stores the source transcript and parsed text for authorized reading, downloads, exports and review. Enabled AI analysis can use that text with job criteria and interview questions to produce cited summaries and assessment evidence. Speaker labels can be wrong; authorized users can review attribution. This transcript integration retrieves text, rather than the Teams audio or video recording. These hiring records follow the purposes and retention criteria in sections 2 and 7. Disconnection stops the connection but does not by itself erase previously imported information or the Microsoft-held source.

Email delivery and organization email connections are separate from sign-in. An email inquiry is sent only when you choose to send it. Our demo booking link opens Microsoft Bookings; loading that page also connects your browser to Microsoft's delivery, sign-in and diagnostic services. The booking information described in section 2 is used to arrange your demo. Microsoft's own processing is explained in its Privacy Statement.

4. What device screening checks

Your session notice lists the enabled checks before screening. The device app currently offered is for Windows; available checks depend on the release, installation permissions and session settings.

Clipboard: the Windows app reads clipboard text on your device to calculate its length. It may also read copied file names for that calculation. Uploaded events contain the type, length, timing and event details, not the clipboard text or copied file names.

Displays and network: checks report the number and arrangement of displays, not screenshots. Network checks report connection and service-name information, not communication contents or actual upload/download totals.

The app may keep information on your device while retrying uploads. Its cleanup removes confirmed uploads and limits remaining items by age and size when the app runs. The default retry-queue limit is seven days; this does not erase copies already on the server, exported copies or all diagnostic files. Cleanup may wait until a stopped app runs again.

A signal is not proof of misconduct. For access problems or an accommodation, use the session's assistance option or contact the hiring organization. Reading this notice is not permission for recording, biometric identification or every device check. Any required permission is requested for the specific activity.

5. AI analysis and hiring decisions

Evidize can analyze résumés, summarize applications, assess disclosed job criteria and produce scores, rankings and security signals. Some results use AI; others use fixed rules. Approved analysis and ranking can run automatically. A temporary meeting-access check is separate from a hiring decision.

When an AI feature is enabled and authorized for the activity, Microsoft Azure AI Foundry can receive relevant résumé text, job criteria, interview or assessment material, imported transcript text and instructions. Evidize stores relevant inputs, outputs and evidence needed to explain or review the hiring analysis. The model service can also process information for safety and abuse detection under its applicable terms; this is separate from Evidize training models. Our AI requests disable saved response history; this does not eliminate Microsoft's permitted safety or abuse handling, associated retention or review. See Microsoft's model data-handling description.

AI results can be inaccurate, incomplete or biased. The hiring organization makes its hiring decisions and handles any review required for that process. Evidize remains responsible for its own conduct and any duties arising from its actual developer, processor, employer-agent or reporting-company role. The employer's notice explains its decision process and any applicable access, opt-out or appeal rights.

Evidize does not use candidate data to train or fine-tune models, build candidate profiles across customers, sell information or support advertising. Current AI analysis uses supplier models through Microsoft Azure/Foundry. Planned training on general recruiting materials is separate future work; its sources, licensing and applicable disclosures must be reviewed before activation. The Data Agreement limits service evaluation and improvement to its stated purposes and the applicable law when incorporated into a customer agreement. Publication of a supporting edition does not amend an existing customer contract. The AI service’s actual model, processing features and supplier terms must be checked before it is enabled; a hosting region or the word “AI” does not establish training or retention practices.

6. Who receives information and website tracking

Information is available as needed for the stated purpose to:

• The hiring organization's authorized recruiters, hiring managers and administrators.
• Evidize staff handling operations, support, security and requests.
• Hosting, storage and AI providers, and enabled sign-in, email and communication providers.
• Cloudflare Turnstile where enabled for application or organization-signup checks.
• Professional advisers or authorities where disclosure is legally permitted or required.

Microsoft Corporation: Evidize uses Microsoft Azure for hosting, its database and file storage. Azure AI services can process assessment inputs when enabled. Microsoft Entra, Outlook, Teams and enabled Microsoft Graph connections support sign-in, communications and transcript processing as described in section 3. Applicable Microsoft service terms govern those services; organization-enabled connections may also be covered by the organization’s own agreement with Microsoft.

Cloudflare: where Turnstile is enabled, Cloudflare receives the verification information described in section 2. Its bot-detection improvement role is separate from the processing it performs for site security.

The Azure hosting, database and file-storage resources reviewed are configured in Central US. Recovery copies, network delivery, service operations and supplier access can have different locations. This is a U.S. hiring service, not a promise that all processing or every copy stays in the United States. The hiring organization controls copies it downloads.

Supplier use is subject to the applicable service arrangements. A supplier may have separate purposes where described here, such as Cloudflare's bot-detection improvement. Contact us for information relevant to your request.

Website and Outlook tracking

The marketing site records interaction details in your browser, such as the page, selected feature or plan and where you clicked. It does not automatically send them to an analytics provider, load advertising software or install a third-party tracker that follows you across websites. Ordinary page requests still reach our hosting service.

In Outlook, a separately enabled monitoring provider can receive client-selection and interview-creation or error events, including the client identifier and which part of the workflow produced the event.

Do Not Track: our website does not change its behavior in response to this browser setting. Do Not Track is different from legally recognized opt-out signals such as Global Privacy Control.

Reading or acknowledging this notice does not exercise a privacy choice. Contact privacy@evidize.com about an applicable choice involving information Evidize handles for its own purposes. Employer-controlled choices are handled with the hiring organization.

7. Keeping, deleting and protecting information

We use the category-specific criteria in section 2 with the applicable schedules and legal duties. Records may need to be kept after an application ends because of a later personnel action, request, complaint or legal preservation requirement.

Deletion requests are subject to applicable rights and exceptions. Required records may be retained, including a limited record of the request and response. Supplier, backup, device and customer copies are handled separately; submitting a request does not erase all copies immediately.

Organization permissions and service security controls restrict access to information. The Data Agreement explains return or deletion of information processed for a customer and the limits on retaining it after services end.

Records and recovery copies

• Application and assessment records: the record-specific period follows the permitted hiring purpose, lawful customer instructions and any duties applying to Evidize. A default storage setting is not a guarantee of deletion after one year.
• Messages and requests: account-security, recruiting, delivery and privacy-request records have different schedules. A request record can be kept separately from the information whose deletion was requested.
• Diagnostic logs: the reviewed Azure log settings use 30- or 90-day periods depending on the log table. Restricted hiring evidence and preserved incident records have separate rules.
• Recovery copies: the reviewed Azure configuration provides a one-day SQL point-in-time recovery window and seven-day soft deletion for storage objects or containers. A recovery window is not an exact physical-erasure age for every backup. These settings do not set the deletion date for an active application, an export, another supplier’s copy or the whole account.

Deletion accounts for stored copies and preservation duties. We explain any lawful limitation when responding to a request. Restricted recovery copies follow the applicable replacement or expiry process; deletion instructions must be reapplied if a copy is restored.

For requests about Evidize's own processing, limited request correspondence normally remains for two years after closure or the latest substantive update. After that period, personal case content is eligible for minimization while a limited record of the action remains. Open obligations, legal holds and any longer applicable requirement can extend that period. This does not extend the retention of the underlying application or other information requested for deletion.

8. California information categories

The categories below describe information used by the service. Sections 2–6 explain the sources, purposes and recipients for each activity. The information actually collected depends on the services used and material submitted.

• Identifiers: names, email and network addresses, account and session identifiers.
• Personal records: contact details and employment or education history supplied in applications, account records or support requests.
• Protected classifications: voluntary demographic responses such as race, gender identity and veteran status where those questions are offered.
• Commercial information: subscription and service-credit transaction records.
• Internet or other electronic network activity: page requests, account activity and the device/network screening events described above.
• Geolocation data: declared job, residence and assessment locations and approximate location derived from an IP address. This is distinct from precise GPS location.
• Professional or employment-related information: qualifications, work history, application responses, interview transcript text and hiring assessments.
• Inferences: assessments, summaries, scores and rankings derived from submitted information and configured criteria.
• Sensitive personal information: account access credentials and voluntarily provided race, ethnicity or health/accommodation information where applicable. This list does not authorize collecting additional sensitive information or introducing biometric identification.

Files and free-text messages can contain other information chosen by the sender. Do not include unnecessary identity documents, medical records or other sensitive details. The applicable request process does not require creating a customer account.

9. Your requests and choices

Your rights depend on the state, activity and organization. They can include access or a copy, correction, deletion, an explanation, review, an accommodation or an opt-out from particular uses. Many consumer-privacy laws exclude employment information; separate employment protections still apply. The state guide explains the differences.

Where the California Consumer Privacy Act (CCPA) applies, you can request the categories and specific pieces of information collected, their sources, purposes for collection, sale or sharing, and recipient categories. You can request correction and deletion, subject to exceptions, without unlawful retaliation. If a business sells or shares your information, you can opt out. For covered uses of sensitive information, you can limit its use and disclosure. Automated-decision rights have separate effective dates and exceptions.

Make a request: use the request form or email privacy@evidize.com. Identify the hiring organization if known. The form accepts access, correction, deletion, explanation, accommodation, decision review and privacy appeal requests. An authorized representative should explain their authority.

Appeal: where an appeal right applies, choose “Appeal a privacy request response”, identify the earlier request and explain what you want reconsidered. A denied appeal must include any further complaint instructions required by the applicable state law.

Other choices: the form's automated-decision opt-out option does not submit a sale, sharing or targeted-advertising opt-out, or a request to limit sensitive-information use. Use the specific method in the responsible organization's notice for those choices.

After submission: the form confirms receipt and provides a reference. The responsible team may need to verify identity or authority and coordinate with the hiring organization. Do not send identity documents unless requested through the verified process. If receipt is not confirmed, retry or contact the hiring organization or the published Evidize privacy contact.

The hiring organization handles questions about its criteria, decisions and accommodations. Where Evidize processes information on its behalf, we assist as required by law and lawful instructions, or explain why a request must be directed to the responsible organization. Evidize handles requests relating to its own covered processing. Covered consumer reports have separate reporting-agency access and dispute duties; a product label does not decide that role. A response limiting a request should explain the applicable reason.

10. Updates and company details

The Privacy Notice page shows the version and date, with earlier notices in the version history. Where the CCPA applies, the policy must be updated at least once every 12 months. We can send informational updates by email without asking for acceptance. Any legally required advance notice or new permission must precede a changed activity; an email or revised notice does not retroactively authorize a broader use.