TRUST AND DATA
Trust, data handling, and responsible AI hiring
This describes how the product actually works today, not a formal legal document. It is not a substitute for your own counsel’s review, and it is not a privacy policy or terms of service, which have not yet been formally published (see /privacy and /terms).
What data is collected, and where it goes
Your account, your interview conversation, your generated report, and any document you upload (like a resume) are collected to run the assessment and produce your report. Uploaded documents are stored in a private storage bucket scoped to your account, never public, and text is extracted from them only to add context to your interview — the file itself is never rendered, served, or interpreted as anything but text to read.
Five systems your data passes through to make that happen:
Supabase
Your account, your assessment conversation, your report, and any uploaded documents are stored in Supabase Postgres and Storage.
Anthropic
Your conversation is sent to Anthropic’s Claude API to run the interview and generate your report.
Resend
Sends your account emails (confirmation, password reset, report-ready) and, if you join a waitlist, that follow-up.
Cloudflare
Verifies you’re human at registration (Turnstile) and sits in front of the domain for DNS and delivery.
Railway
Hosts the application itself, both the part you see and the backend that talks to the services above.
How long data is kept
There is no automatic deletion policy yet. Your conversation, report, and any uploaded documents are retained for as long as your account exists. We would rather say that plainly than imply a retention window that doesn’t exist.
Who can see a given report
- You
- Your own conversation, report, and development plan. Always.
- An evaluator, manager, or HR at your organization
- Only if your organization sponsored your assessment, or you accepted a manager's team invitation. You're told which applies before the interview begins.
- A manager on a self-serve team
- The reports of people who accept their invitation, and nobody else's. A trigger in the database enforces this: a self-serve team can never add an HR role, so the inviting manager is the only reader.
- HR at a provisioned organization
- Every member of that organization’s reports, the arrangement an organization explicitly signs up for, not a default.
How the rubric itself is built
One rubric, applied the same way every time. Every participant is scored against the same 16 competency dimensions, with evidence-based scoring and a stated confidence level on each score. Consistency is engineered in, not left to the interviewer’s mood or the candidate’s polish.
It informs the decision, it does not make it. Every report is built to support a human hiring, promotion, or development conversation, never to replace it. A person always makes the call.
Scored on what you did, not who you are. The rubric evaluates the decisions you describe, the tradeoffs you weighed, and the results that followed. It does not ask you to disclose protected characteristics, and the same rubric applies to everyone.
Where things honestly stand on regulation
If you’re bringing this into a hiring, promotion, or succession process, your legal team is likely thinking about frameworks like:
- New York City Local Law 144, which requires an annual bias audit for automated employment decision tools used in NYC-based hiring
- The EU AI Act, which classifies certain employment-related AI systems as high-risk and attaches obligations to them
- The Uniform Guidelines on Employee Selection Procedures and the four-fifths rule long used in U.S. employment law
Formal validation and an adverse-impact or bias audit are work we are actively doing, not work we claim to have finished. We are not making a compliance claim under any of the frameworks above until that work is done. We would rather tell you where we actually are than overstate it.
Questions your legal team should ask
We’d rather answer them directly than have this page try to anticipate every one.
Curious who built this and why? Read the founder’s answer.