Fairly's standard terms

Fairly standard terms for companies

Version: terms-r1

Effective date: 24 October 2026

1. Parties and acceptance

Fairly is operated by Nishmeet Arora, an individual trading as Fairly (sole proprietor). The operator's postal address and contact details are on our legal page. In these terms, "Fairly", "we" and "us" mean that operator. "Company" means the organisation identified by its legal name in the workspace settings. These terms govern that company's use of Fairly and each company user's use within their authorised role.

The person creating or arranging a workspace for a company must have authority to agree to these terms for it. Each team member must be authorised to use the workspace and must accept the terms for their own use. Accepting as a team member does not give you authority to bind the company, change its processing instructions or act beyond your assigned permission. If you lack the authority needed for an action, ask an authorised company administrator to take it.

A signed-in company user accepts by selecting the required acceptance checkbox and submitting the acceptance step. Fairly records the user, the exact terms version and the time, with an audit record. Each user accepts once per terms version, including when joining a team or returning with an existing account. An account registration, team invitation or link to these terms alone is not acceptance. These terms apply from acceptance, no earlier than their effective date.

The company must arrange authorised acceptance before using Fairly to process candidate information. Company-user acceptance is separate from the company-user privacy notice and from a candidate's agreement to the candidate notice. It does not supply consent on a candidate's behalf.

2. The pilot service

Fairly provides role-specific assessments, secure candidate invitations, accountless candidate attempts, response saving and recovery, objective scoring, human rubric review, integrity-signal review, evidence reports and human decision records. In Pilot-1, assessment authoring and publishing are assisted by Fairly's operator; some support and retention work is done manually through audited processes. Only the functions agreed for the pilot and available in the service are included.

The company chooses its role requirements, assessment content, reviewers and hiring decisions. It must check that assessments are relevant, accurate, properly licensed and appropriate for its candidates, provide reasonable accommodations, and review technical problems fairly. Fixed-rule scores and monitoring events support human review. They are not a prediction of job performance, a cheating verdict or an automatic hiring or rejection decision. The company must not present them as such.

No fees are charged for this pilot unless the company and Fairly agree otherwise in writing.

3. Accounts, access and permitted use

The company must give accurate workspace, legal-name, privacy-contact and grievance-contact details; choose and justify a candidate-retention period; keep those details current; and limit staff access to what their work requires. Administrators must promptly remove access that is no longer authorised. Each user must protect their account credentials and report suspected misuse promptly. Candidate access links are private access credentials and must be shared only with their intended recipients.

Use Fairly only for lawful, disclosed hiring assessments within the agreed pilot. Do not access another company's information, bypass access controls, share an account, interfere with attempts, introduce malicious content or use the service for undisclosed surveillance or discriminatory decisions. Do not put passwords, financial credentials, identity documents, identifiable patient or client information, or unnecessary health or other sensitive information into questions, answers, notes or support messages. Arrange any genuinely necessary sensitive collection separately with appropriate restrictions and legal safeguards.

The company is responsible for the lawful source of candidate contact details, the notices and permissions required before supplying them, the instructions it gives Fairly, and its staff's use of information and downloaded copies. It must resolve any required age, consent or guardian arrangements before inviting an affected candidate. Fairly remains responsible for its own service and processing obligations under these terms and applicable law.

4. Content and confidentiality

The company retains its rights in content it supplies; Fairly retains its rights in its software and service materials. Neither party acquires ownership of a person's information merely by handling it. The company grants Fairly only the permission needed to host, reproduce, display and process its content to provide and support the service under these terms. Fairly does not sell candidate information, use it for advertising, or use assessment answers to train AI models.

Each party must protect the other's non-public business information, assessment content, access credentials and personal information. Access must be limited to people who need it for an authorised purpose and who are bound by confidentiality duties. This does not prevent a person's lawful access to their own information, an authorised hiring review, or a disclosure required by law. Where legally permitted, the disclosing party will notify the other party of a compulsory disclosure and limit it to what is required. Confidentiality duties continue after access or the pilot ends.

5. Data-processing terms

This section forms part of the agreement between the company and Fairly. It governs candidate information processed for the company and takes priority over a conflicting general service provision on that subject. It does not reduce protections promised to individuals in the applicable privacy notice or remove either party's legal responsibilities.

5.1 Roles, information and purposes

The company decides the purposes of candidate-data processing; Fairly acts as its processor on documented instructions. The company decides whom to assess, the hiring purpose, assessment and rubric content, authorised recipients, its retention settings and the human decision. Fairly does not decide whether a candidate should be hired or rejected.

The people concerned are the company's candidates and, where connected to their assessments, company reviewers, administrators and support contacts. Processing covers:

• Candidate names, email addresses, role relationships, invitations, link and access-session records.
• Assessment and question versions and shown answer ordering, responses, save history, timing, interruption, recovery and submission records.
• Privacy-notice and consent records, disclosed integrity events and their human review, scores, rubric reviews, notes, decisions and reasons.
• Candidate help, accommodation and withdrawal requests, service-message delivery records and necessary technical access information.

The operations are collecting, recording, storing, retrieving, transmitting, organising, scoring under fixed rules, displaying for human review, exporting and deleting that information to deliver the company's hiring assessment, recovery, support and request handling. Processing lasts while needed for those purposes under the retention and exit rules below; keeping an account open does not extend candidate retention indefinitely.

Fairly separately handles the limited account, service administration, security, legal-compliance and request information needed for its own responsibilities, as explained in the notices at Privacy notices. That separate role does not permit repurposing candidate answers for unrelated use or retaining the whole assessment record as a security log.

5.2 Instructions and company responsibilities

The documented instructions are these terms, the company's authorised choices and actions in the service, and additional lawful written instructions agreed with Fairly. The company authorises the processing and subprocessors described here only for the stated purposes. An ordinary reviewer's action is not authority to change the company's retention or other administrative instructions.

The company must ensure its instructions, notices, candidate sourcing, disclosures and any required consent are lawful and consistent, including for overseas processing. The candidate notice linked to an invitation explains the processing and retention rule applying to that invitation. The company must not treat acceptance of these terms as permission for undisclosed monitoring or unrelated use.

Fairly will process candidate information only on those instructions unless law requires otherwise. If Fairly considers an instruction unlawful, it will promptly tell the company and pause the affected processing while the issue is resolved. If a law requires other processing, Fairly will explain the requirement before acting unless legally prohibited. Any exception must be limited to the information and purpose the law requires.

5.3 Confidentiality and security

Fairly will ensure that anyone it permits to handle company candidate information has a need for access, is bound by confidentiality and follows the applicable instructions. Operator access is limited to support, administration, security and requests and must use the authorised, audited processes.

Fairly will maintain reasonable technical and organisational safeguards appropriate to the information and risks, supported by documented security procedures. These include encrypted transport and managed encrypted storage; server-enforced company and role isolation; signed, scoped, expiring and revocable candidate links; protected credentials; rate limits; audit records for sensitive actions; and procedures for access review, incidents, export and deletion. No certification is claimed by these terms. Fairly will also require appropriate safeguards from its subprocessors and will not knowingly reduce the agreed level of protection during processing.

5.4 Subprocessors and overseas processing

The company authorises Fairly to use service providers in these categories, including their necessary infrastructure providers, subject to the protections in this section:

Fairly will maintain and make available on reasonable request the actual provider identities, functions, relevant locations and retention details. It will engage subprocessors under written processing and confidentiality obligations that protect the information consistently with these terms, require appropriate security and assistance, and limit use to the permitted service purposes. Fairly remains responsible to the company for the processing it entrusts to them. Company and candidate mailbox providers, and copies independently retained by the company or a recipient, are not thereby under Fairly's control.

Fairly will give the company's administrator advance notice of a material addition or replacement, including a material change in processing location, and a reasonable opportunity to object on data-protection grounds before affected information is transferred. It will work with the company to resolve an objection; if no suitable solution is available, the company may stop the affected use and arrange return and deletion. Where an urgent security or legal need prevents advance notice, Fairly will notify the company as soon as legally and practically possible and limit the change to what is necessary.

Overseas transfers must have the permissions, contractual protection and other safeguards required by applicable law, including the required level of protection for sensitive information. A Mumbai primary region or a reference to foreign transfer clauses alone does not establish those safeguards. Company acceptance does not replace a candidate's required notice or consent. Fairly will not instruct providers to use candidate answers for AI training or unrelated advertising and will maintain service settings consistent with those restrictions.

The email provider's published standard email and log retention is 30 days, with recovery backups kept for seven days; account, security and suppression records can have different lifetimes. Other infrastructure or support copies may also have separate lifetimes. Fairly will explain the applicable limits and seek deletion from providers where required, rather than promise that deleting the live assessment erases every external copy.

5.5 Incidents

Each party must promptly tell the other about a suspected compromise affecting the service or company information. Fairly will notify the company's designated contact without undue delay after becoming aware of a personal-data incident affecting its information. It will send the available facts promptly rather than wait for a complete investigation, and provide updates covering the affected information and people, likely consequences, containment, remedial steps and a contact for coordination as those facts become available.

Fairly will investigate, contain and remedy incidents within its responsibility, preserve necessary evidence securely and assist the company with its own notifications and response. Each party remains responsible for reports the law requires of it. Where CERT-In's six-hour reporting requirement applies, neither an ongoing investigation nor notification to the other party postpones that deadline. The company cannot require Fairly to withhold a legally required report. Fairly's CERT-In point of contact is identified on the legal page.

5.6 Requests and assistance

The company leads responses concerning its hiring purposes and decisions. Fairly will promptly route candidate requests to the company where appropriate and assist with access, correction, export, deletion, complaints and withdrawal of consent, as well as reasonable information needed for the company's security or privacy assessments. Fairly may also respond directly where required by law or concerning its own processing; company approval is not a condition for exercising a legal right.

Requests may be made through the published contacts without an active account or working invitation. Fairly will verify them with the minimum necessary information, acknowledge them within seven days and complete them within 30 days of receipt. Privacy grievances will be addressed as soon as possible and within one month of receipt, or 30 days if sooner. The company must cooperate promptly enough to meet applicable deadlines. Fairly will explain any lawful refusal or specific preservation requirement, rather than treat a request as completed merely because it was forwarded.

Withdrawing from hiring is different from withdrawing consent. For a verified consent withdrawal, the parties must stop further consent-based use and coordinate access restriction and deletion, subject only to processing that remains lawfully necessary. Fairly forwards a candidate request on receipt, reminds an unresponsive company at day seven and, if a verified withdrawal or deletion request is still unanswered or has no lawful instruction, applies its processing restriction by day 14. These are escalation limits and do not create a grace period for continued consent-based use. While restricted, no new link, reviewer assignment, review, objective scoring, integrity resolution or hiring decision other than Withdrawn or Not progressing is allowed for that candidate in the workspace. Existing evidence can still be read, exported or deleted. Restriction is not deletion; only Fairly's operator can lift it with a documented lawful reason. The company must cooperate to provide a reasoned outcome by day 30; its silence alone does not justify retention or refusal. Corrections must be recorded without silently rewriting historical answers or reviews; preserving history does not justify ignoring an inaccurate record. Exports must be checked for other people's information and shared securely.

5.7 Retention, return and deletion

The company must choose a necessary, justified candidate-retention period and instruct disposal of its downloaded reports, exports, printouts and correspondence. The full calculation in the candidate's versioned notice governs routine cleanup: it considers all that person's roles, invitations and attempts with the company, the invitation's recorded limit and the company's current setting. A later invitation may extend the whole company record's life under that rule; a hiring decision alone does not restart it. Increasing a workspace setting does not increase an older invitation's recorded limit.

Fairly will run the manual retention cleanup every Monday and complete a missed or failed run by Wednesday, investigate failures and follow up records that could not be deleted. This is a manual process, not deletion at an exact instant. A run also takes eligible records due within the next seven days. The notice explains when active invitations or attempts prevent routine cleanup. These limits do not prevent a separately verified deletion request from being handled.

During use and when the service ends, the company may request a return of its candidate information in the service's available machine-readable export format, followed by deletion, or instruct deletion without a return. Fairly will coordinate secure return with an authorised administrator and complete the requested deletion within the request period above, or sooner where law requires. On termination it will arrange any requested return and delete the company's remaining candidate information within 30 days, subject to specific lawful preservation requirements. No instruction to retain indefinitely is implied if the company does not request a return. Removing a team member or suspending workspace access is not itself termination or deletion.

A successful candidate deletion covers the candidate's record and assessment evidence across every role in that company, including invitations, responses, results, reviews, integrity records, decisions and linked in-app help and withdrawal records. It cannot be undone. A technical sign-in identity still needed for another remaining candidate session is not deleted while needed there. Fairly will confirm the deletion outcome and explain any failures or residual information.

Minimal audit, account, security and legal records are separate from assessment evidence. Audit entries are kept for three years from each entry to document actions and handle possible claims, then removed by daily cleanup. This is Fairly's policy, not a statutory requirement to retain every hiring record for three years. Fairly's access-address log is in the Mumbai database: sign-in attempts through its pages, every new company Auth session including successful direct-API sign-ins, and candidate link-opening requests that reach the service. It keeps times, fixed event and outcome codes, the observed address and its source or an unavailable indication, and verified internal identifiers where established. Some refusals and rate-limited attempts are counted by host and known subject per UTC hour; unusually many hosts from one IPv6 network can produce counted prefix-only overflow records. Successful sign-ins and proven candidate link outcomes retain their individual records. A through-app sign-in can have both a client-address application event and a server-address Auth-session event; the two sources are distinguished.

These access records survive sign-out, account disposal and candidate deletion. They become eligible for daily cleanup 180 days from their last event; an hourly row can therefore remain up to an hour longer from its first event, plus the cleanup interval. They contain no passwords, emails, tokens, request bodies or answers. The operator's incident read is audited, and verified requests can supply a person's own account-linked rows. A specific incident or legal preservation need permits a relevant extract to be kept longer, with its reason and end or review date recorded. Required ICT security logs must be preserved for a rolling 180 days; this does not authorise retaining all assessment evidence. Failed password attempts made directly against Supabase Auth outside Fairly's pages create no session and are not in Fairly's archive; they appear only in Supabase's short-lived platform logs. No claim of complete 180-day coverage of those failures is made. A rate limit is not a substitute for required retention.

Supabase's database sign-in history is separately eligible for daily cleanup after 180 days; on the hosted pilot this holds company sign-ins and sign-outs without addresses. A provider permission failure requires operator disposal and an explanation of any delay. Live sessions and providers' own logs have separate lifetimes. Rate-limit counters are removed by daily cleanup once their window ended more than one day earlier.

After a staff member's last membership ends, Fairly disposes of the sign-in and profile details on a verified request or through the operator's Monday due-list run once 180 days have passed. Accounts that never joined a workspace become due 180 days after creation or their last sign-in, whichever is later; a usable open team invitation postpones routine disposal. An account still needed in another workspace is not disposed of. When a company's use ends, Fairly ends its suspended workspace's memberships so this clock starts; suspending access alone is not closure.

Disposal replaces the email with a random undeliverable placeholder, removes the password, phone, identities, sessions, refresh tokens and available per-user authentication and recovery records, bans sign-in and deactivates the profile as "Former member". Team invitations are minimised and open ones closed. Waiting completion messages are cancelled; messages already being sent are reported and followed up after the sending lease. Auth log entries are cleared of name and email where provider permissions allow; otherwise their 180-day cleanup and any delay must be explained. Previously issued access tokens can remain valid until expiry, but the disposed account has no authorised workspace access.

Minimal internal account references, dates, membership and invitation history and work attribution remain where necessary to explain historical work; they are not all automatically purged or irreversibly anonymous. Candidate-linked reviews and decisions go with their candidate record. Current users' terms acceptances remain as contractual evidence; after disposal, each acceptance is eligible for daily cleanup three years from acceptance, including immediate eligibility for an already older acceptance. Disposal does not reset that clock. Workspace contact settings must be replaced by the company when a contact leaves; historical candidate notice snapshots are preserved until their candidate record is deleted. Other copies and relevant free-text records need separate handling. Fairly must explain the category, necessary purpose and disposal rule for residual information and remove or redact it when that purpose ends. A specific legal preservation requirement must be identified and limited, with deletion when it expires. Account disposal must not be described as complete erasure.

Fairly deletes external working copies and support notes after handling the request, retaining a minimal request register for one year after closure, subject to a specific explained lawful preservation requirement. Operational counts and errors and completed alert-email records are eligible for daily cleanup after 30 days; closed alerts after 90 days once closure has been notified; scheduled-job history after seven days. Pending messages and unresolved alerts can remain longer. These daily cleanup thresholds are not exact deletion instants.

Fairly keeps no scheduled database backups or recovery dumps of its own in this pilot. A database failure can lose assessment records. This does not remove provider recovery or security copies, delivered email, company exports, correspondence or browser copies. Fairly will address copies under its control and pursue required provider disposal; the company must address its own copies and recipients. Server deletion cannot remotely wipe an offline browser. Neither party may describe a live-record deletion as erasing all such copies.

5.8 Information and reasonable audit

Fairly will provide information reasonably needed to demonstrate compliance with this section, including relevant processing, provider, security, request and deletion records, with secrets and other people's information protected. A reasonable audit request should state its scope and purpose. The parties will ordinarily use documents and explanations first and agree proportionate further inspection by the company or a suitably qualified independent reviewer bound by confidentiality if needed to verify compliance.

Reasonable notice, access safeguards and timing may protect other tenants, candidates and service availability, but must not be used to defeat a necessary compliance review. An audit does not give direct access to another company's records or unrestricted production credentials. Intrusive technical testing requires separately agreed safe scope. These arrangements do not restrict a regulator's lawful powers or urgent incident cooperation.

6. Service care and limits

Fairly will provide the service with reasonable care, protect the agreed access and scoring boundaries, and address reported defects and recovery problems. The service is designed to save responses and recover from refreshes and temporary connection loss, but an interrupted connection, unavailable provider or database failure can still affect an assessment. The no-backup policy above is a material pilot limit. Report problems promptly so the company and Fairly can arrange a fair recovery response.

No uninterrupted availability, recovery from every failure, hiring outcome or scientific validation is promised. These limits do not excuse a breach of the confidentiality, security, processing or request duties above. Each party remains responsible under applicable law for loss caused by its own breach, negligence or unlawful acts. Nothing in these terms excludes liability or a remedy that cannot lawfully be excluded, or limits an individual's statutory rights.

7. Ending use, suspension and new versions

The company may end its pilot use by contacting Fairly through the legal page. Fairly may end the pilot on reasonable written notice, allowing time for a safe handover and return or deletion. It may restrict company access promptly where reasonably necessary for security, law or a material breach, explaining the reason and recovery route where lawful. Fairly will minimise disruption to ongoing candidate attempts. Pausing company access does not itself delete records or stop already invited candidates from finishing.

Return, deletion, confidentiality, incident cooperation, legal preservation and accrued responsibilities continue as necessary after use ends. An expired account, suspended workspace or refusal of new terms does not remove the email route for data requests or return and deletion.

Fairly may issue a new terms version with its own effective date. A loaded version is not rewritten. Each signed-in company user must accept the then-current effective version before entering the workspace; a later version asks again. Publishing a new version does not retrospectively change recorded acceptance, candidate consent or historical assessment content. If the company does not agree, it may stop using the service and contact Fairly to arrange its exit and data handling.

8. Contacts, law and disputes

Use the operator and grievance contacts on the legal page for service, privacy, security or contractual concerns. The parties will try to resolve a concern promptly and in good faith, without delaying a statutory deadline or preventing urgent relief.

Indian law governs these terms. Disputes are subject to the competent courts in India having jurisdiction under applicable law. A mandatory statutory forum remains available. If a provision cannot lawfully be enforced, the remaining provisions continue to apply so far as possible.