Privacy Policy
How we use your personal data, and the choices you have
Effective Date: July 6th, 2026
About This Notice
If you are interviewing through Exterview, you are trusting us with information about yourself, and we take that responsibility seriously. Exterview AI helps organizations conduct interviews, evaluate candidates, and produce structured hiring assessments across our products, including EX Voice, EX Avatar, EX Code, EX Panel, and EX Rank.
This notice explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over your information. Capitalized terms are defined in Section 2.
Interview Content
Exterview Inc., a Delaware corporation, is responsible for the personal data described in this notice for candidates and users located in the United States, the European Economic Area, the United Kingdom, and Switzerland. Exterview Solutions Private Limited is responsible for personal data of individuals located in India and, under India's Digital Personal Data Protection Act, 2023, acts as the Data Fiduciary. In this notice, “Exterview,” “we,” and “us” refer to the entity responsible for your region.
Our role
Exterview plays two roles depending on the data involved. For our own website, account, marketing, and technical data, we act as the Controller (or Data Fiduciary) and determine how that data is used. For candidate interview content and assessments, we act as a Processor on behalf of the Hiring Organization, which is the Controller of that data and determines the purposes of processing. Where you wish to exercise rights over interview or assessment data, we will direct your request to, or support it with, the relevant Hiring Organization. Region-specific rights are set out in Section 14.
Definitions
The following terms have the meanings given below wherever they appear in this notice.
Controller: The entity that determines the purposes and means of processing personal data. Equivalent to “Data Fiduciary” under the DPDP Act.
Processor: An entity that processes personal data on behalf of, and on the documented instructions of, a Controller. Equivalent to “Data Processor” under the DPDP Act.
Sub-Processor: A third party engaged by a Processor to assist in processing personal data.
Data Principal / Data Subject: The individual to whom personal data relates — “Data Principal” under the DPDP Act and “Data Subject” under the GDPR.
Personal Data: Any information relating to an identified or identifiable individual.
Hiring Organization: The organization that uses Exterview to conduct interviews and assessments and that acts as Controller of the resulting candidate data.
Information We Collect
Depending on how you use Exterview, we may collect the following categories of information.
Information You Provide
CVs and resumes
Profile information
Application details
Responses submitted during interviews
Interview Content
Interview recordings
Transcripts
Uploaded documents
Responses generated throughout the interview process
Technical Information
IP address, browser type, and device information
Domain information, cookies, and usage analytics
Similar technical identifiers collected automatically when you use our website or platform
Assessment Information
AI-generated scores
Competency evaluations
Interview reports
Structured assessments and qualification records
Purposes and Lawful Bases
We process personal data to:
Conduct interviews and candidate assessments
Produce evaluation reports for Hiring Organizations
Operate and improve our platform
Secure our systems and detect misuse
Meet legal and regulatory obligations, and support customer service and platform administration
The lawful basis we rely on depends on where you are located, because different privacy laws recognize different bases. We set the applicable basis out in Section 14. In summary: in the European Economic Area and the United Kingdom we rely on performance of a contract, your consent, our legitimate interests, or compliance with a legal obligation; in India we rely on your consent under Section 6 of the DPDP Act or on the “certain legitimate uses” recognized under Section 7, and we do not rely on “legitimate interests,” which is not a lawful basis under the DPDP Act.
AI-Assisted Assessments
Some Exterview products use AI models to help assess, score, and rank candidates. Whenever automated assessment is involved: AI supports, not replaces, human decision-making, and human oversight is built into the platform. You may request an explanation of how an assessment was produced, and you may request a human review of an automated outcome. Our goal is transparent, explainable, and accountable AI-assisted hiring.
AI supports, rather than replaces, human decision-making. A qualified person reviews assessment outputs before any decision that has a legal or similarly significant effect on you is acted upon, so you are not subject to a decision based solely on automated processing within the meaning of Article 22 of the GDPR or the equivalent protections under the DPDP Act.
You may request an explanation of how an assessment was produced, request a human review of an automated outcome, and object to automated processing. Where the EU AI Act applies, we meet the applicable transparency obligations, including telling you when you are interacting with an AI system.
We do not use candidate data to train or fine-tune our own models or any third-party large language models. Our AI Sub-Processors operate under contractual terms that restrict retention and prohibit training on our data, and our AI governance is aligned to ISO/IEC 42001 and the NIST AI Risk Management Framework.
Sub-Processors and Third-Party Services
We use Sub-Processors to provide our services. Each is engaged under a written agreement that includes confidentiality and data-protection obligations, and each processes personal data only on our documented instructions.
Our current Sub-Processors, including the processing purpose and hosting region of each, are available only on request. We update this list when a Sub-Processor is added or removed and, where a Hiring Organization has contracted for advance notice, we provide it before onboarding a new Sub-Processor.
Third-Party Services and Integrations
Exterview works with several third-party services and integrations that support how our platform is used. These fall into two groups, and they are treated differently under privacy law:
Integrations connected by the Hiring Organization. A Hiring Organization may connect Exterview to its own systems, such as its applicant tracking system, calendar, or single sign-on provider. Where the Hiring Organization enables such an integration, it does so as the Controller of its own systems, and that integration is governed by the Hiring Organization's own agreements and privacy notices.
A current list of our third-party services and integrations, with the purpose and region of each, is available only on request.
Data Storage and International Transfers
Our services are hosted on Microsoft Azure across data centers located in the United States, the European Union, and India
We store your information in the region most appropriate to your location whenever possible
If personal data must be transferred internationally, we use lawful cross-border transfer mechanisms designed to keep your information protected, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum where applicable.
Data Retention
We retain personal data only for as long as necessary to deliver our services
We retain data to fulfill the purposes described in this notice
We retain data to meet legal or regulatory requirements
Once retention periods expire, data is securely deleted or permanently anonymized
Security of Your Information
We protect personal data using technical and organizational measures, including encryption in transit and at rest, role-based access control, multi-factor authentication, audit logging, vulnerability management, and regular security testing. Because candidate data is our most sensitive information, we apply our highest safeguards to it.
We are building our control environment to the SOC 2 (Trust Services Criteria) and ISO/IEC 27001:2022 standards and have commenced a SOC 2 Type II examination.
Data Breach Notification
If a personal data breach occurs, we will act promptly to investigate and contain it, and we will notify affected individuals, our customers, and the relevant regulators where required by applicable law. This includes notification under Articles 33–34 of the GDPR, under Section 8(6) of the DPDP Act and the applicable DPDP Rules, and under applicable US state breach-notification laws. Where we act on behalf of a Hiring Organization, we will notify that organization without undue delay so it can meet its own obligations.
Your Privacy Rights
Subject to your location and applicable law, you have the following rights. Section 14 explains how these apply in India, the EU/EEA and UK, and the United States, including California.
Access your data: Request a copy of the personal data we hold and understand how it is used.
Correct or delete your data: Ask us to correct inaccurate or incomplete information, or request deletion unless we are legally required to retain it.
Limit, object, or receive your data: Restrict or object to certain types of processing, or obtain your information in a portable, machine-readable format.
Ask about AI: Request an explanation of AI-assisted assessments, request human review, and object to automated processing.
Withdraw consent: Where we process based on your consent, withdraw it at any time.
Raise a grievance or nominate someone: Submit a grievance or, where the law allows, nominate someone to act on your behalf.
Region-Specific Rights
The following sections set out rights that apply based on where you are located. Where more than one framework applies to you, we honor the rights available to you under each.
India: Digital Personal Data Protection Act, 2023
This section applies if you are located in India. Exterview Solutions Private Limited is the Data Fiduciary. Where we process your personal data based on consent, that consent is free, specific, informed, unconditional, and unambiguous, and given through a clear affirmative action. We otherwise rely only on the “certain legitimate uses” recognized under Section 7 of the DPDP Act. We do not rely on “legitimate interests,” as it is not a lawful basis under the DPDP Act.
As a Data Principal, you have the following rights:
Right to access information about the personal data we process (Section 11).
Right to correction, completion, updating, and erasure of your personal data (Section 12).
Right of grievance redressal (Section 13).
Right to nominate another individual to exercise your rights in the event of your death or incapacity (Section 14).
Right to withdraw consent at any time, where processing is based on your consent (Section 6).
To withdraw consent, contact our Data Protection Officer at dpo@exterview.ai. Withdrawal does not affect processing carried out beforehand. After withdrawal, we will stop the relevant processing unless the law requires otherwise, and some features that depend on your consent may no longer be available.
Grievance Officer (India: DPDP Act, Section 13). Grievances are handled by our Grievance Officer at dpo@exterview.ai, who will respond within the timeframe required under the DPDP Act and the applicable DPDP Rules. You also have the right to complain to the Data Protection Board of India.
European Union / EEA and United Kingdom : GDPR
This section applies if you are located in the European Economic Area, the United Kingdom, or Switzerland. We process your personal data on one or more of the following bases: performance of a contract, your consent, our legitimate interests, or compliance with a legal obligation. Where we rely on legitimate interests, we balance them against your rights and freedoms.
You have the following rights under the GDPR and UK GDPR (Articles 13–22):
Access: Request confirmation of processing and a copy of your personal data.
Rectification: Have inaccurate or incomplete personal data corrected.
Erasure: Request deletion of your personal data in the circumstances the law allows.
Restriction: Ask us to restrict further processing.
Portability: Receive your personal data in a machine-readable format.
Objection: Object to processing based on legitimate interests, and to direct marketing.
Rights related to automated decision-making: Not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects (Article 22).
For international transfers out of the EEA, UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision where one applies, and we carry out transfer impact assessments where required. You may lodge a complaint with your local EU Data Protection Authority or, in the UK, the Information Commissioner's Office.
United States: State Privacy Laws
This section applies if you are a resident of a US state with a comprehensive consumer privacy law. Subject to your state's law, you generally have the right to confirm whether we process your personal information and access a portable copy, correct inaccurate personal information, delete personal information, opt out of the sale of personal information and of targeted advertising and certain profiling, limit the use of sensitive personal information, and appeal a refusal to act on your request. We do not sell your personal information or share it for cross-context behavioral advertising, and we honor recognized universal opt-out signals such as the Global Privacy Control.
California: CCPA, as amended by the CPRA
This section applies if you are a California resident. Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, you have the right to know what personal information we collect and how we use and disclose it, the right to delete and to correct your personal information, the right to opt out of the sale or sharing of personal information (we do not sell or share), the right to limit the use and disclosure of sensitive personal information, the right to non-discrimination for exercising your rights, the right to appeal a refusal to act, and the right to use an authorized agent. We will respond to verifiable requests within the timeframe the CCPA requires. You may also contact the California Privacy Protection Agency.
Exercising Your Rights
To exercise any privacy right, contact us using the details in Section 18 or use our online Contact form.
To protect your information, we may ask you to verify your identity before processing your request.
We will acknowledge your request promptly, respond within the time required by applicable law, and tell you if additional time is needed for complex requests.
Exercising your privacy rights is generally free of charge.
Complaints
If you believe we have not handled your information appropriately, please contact us first so we can investigate and resolve the issue. You also have the right to lodge a complaint with the appropriate regulator, including the Data Protection Board of India (DPDP Act), your local EU Data Protection Authority, or the California Privacy Protection Agency (where applicable).
Updates
If you believe we have not handled your information appropriately, please contact us first so we can investigate and resolve the issue. You also have the right to lodge a complaint with the appropriate regulator, including the Data Protection Board of India, your local EU Data Protection Authority, the UK Information Commissioner's Office, or the California Privacy Protection Agency, as applicable to you.
Updates to This Notice
We may update this Privacy Notice as our services, technology, or legal obligations evolve. When material changes are made, we will update the version and effective date shown in the Document Control block and notify users where appropriate.
Contact
If you have questions about this Privacy Notice or how your personal data is handled, please contact us.
Email: privacy@exterview.ai
Entities: Exterview Inc. (Delaware, USA) · Exterview Solutions Private Limited (India)
Data Protection Officer: Anusha Surapaneni, CCO (Interim DPO)
Grievance Officer (India): Anusha Surapaneni, Chief Compliance Officer — dpo@exterview.ai
Postal Address: 16192 Coastal Highway, Lewes, Delaware 19958, USA
We welcome your questions and treat every privacy enquiry seriously.