Privacy notice for candidates

Candidate privacy notice

This notice explains how the company that invited you and Fairly handle your information for this company's hiring assessment. The version and effective date appear with this notice. You can read published versions at Privacy notices, including after your assessment link stops working.

Who is responsible and how to contact us

the company that invited you decides why you are assessed, who reviews your evidence, the company's retention period, and the human hiring decision. Fairly provides the assessment service and processes hiring information for the company. Fairly also handles information needed to operate and secure the service and answer requests.

• Company privacy contact: the company's privacy contact, the address shown before you agree.
• Company grievance officer: the company's grievance officer, the address shown before you agree.
• Fairly is operated as a sole proprietorship by the individual named on our legal page, which gives the operator's postal address and grievance contact. Its operator handles Fairly's privacy requests and grievances at 08.soup.air@icloud.com.

The company details and period in this notice were copied when your invitation was issued. Ask the company contact or Fairly if those contact details no longer work.

What we hold and why

The company supplies your name and email address before sending or sharing your invitation. Ask it how it obtained them. Opening a link uses network and technical sign-in information before assessment consent, even though you do not create an account or password.

We handle:

• Your name, invited email, identity confirmation, roles applied for, invitation details, and link status, to give the right person access to the right assessment.
• The assessment and exact questions and answer ordering shown to you; answers you enter or paste; save history and receipts; start, deadline, interruption, recovery and submission records, to run, save, recover and evaluate your assessment.
• The notice version, company details shown, consent time, readiness checks and preparation checkpoints, to record your preparation and agreement. Practice answers are not submitted as hiring evidence.
• Objective results, reviewers' rubric scores and notes, integrity reviews, and human decisions and reasons, to help authorised company staff evaluate evidence.
• Help requests, optional messages, accommodation requests and withdrawal records, to provide support and handle your requests.
• Technical authentication, access and security information, including network addresses and browser information processed by our infrastructure, a separate access-address record of candidate link-opening requests, and counters derived from identifiers, to protect access, investigate incidents and limit abuse. The access record holds server times, outcome and a fixed reason, the observed address or an indication that it was unavailable, and internal browser-user, company and invitation identifiers when established. The app's operational monitoring records fixed categories, times, counts and durations rather than answer text or free-form error messages.

Keep help messages brief. Do not include diagnoses, medical records, financial credentials, identity documents, or identifiable patient or client information. Tell the company what adjustment you need without medical detail. If sensitive information is genuinely necessary, ask the company to explain a separate, restricted way to provide it before sending it. This assessment consent does not authorise unnecessary sensitive collection.

Monitoring during the assessment

The assessment records these events and their times:

• The assessment page becomes hidden, for example when you switch tabs.
• The assessment window loses focus, for example when you click another window.
• A copy action occurs. The monitoring records that it happened, not the copied contents.
• A paste action occurs. The monitoring records that it happened, not the pasted contents.
• An interruption is reported, such as going offline or hiding the page.
• Recovery is reported, such as coming online, restoring a hidden page, or returning to the assessment through recovery.
• If access to your ongoing attempt moves to a replacement browser session, the server records that the session was replaced. That can happen before you return to the answer screen.

Interruption and recovery can include a short reason such as offline, online, page hidden or page restored. Monitoring does not record clipboard contents, keystrokes, other pages you visit, fullscreen exits, camera or microphone recordings, or screen footage. Answers you enter or paste into answer fields are saved separately as assessment responses.

These signals can have ordinary explanations. A person reviews them in context; they do not prove misconduct and do not reduce capability scores. Objective questions are scored by fixed rules and subjective answers by people using rubrics. Fairly does not automatically hire or reject you.

Who receives information and where it goes

Authorised company administrators, recruiters and assigned reviewers see information allowed by their role. Fairly's operator can access information needed for support, administration, security and requests. The company can download evidence and data exports; these copies are its responsibility.

Supabase provides database and authentication services and Vercel hosts the application. The pilot's primary database and application functions are configured for Mumbai, India. This does not mean every provider log, support activity or copy remains in India.

An email delivery provider handles invitation and service messages. Invitation messages include your name, email address, company and role, deadline and personal access link. The email provider stores messages and delivery data in the United States. Its published standard email and log retention is 30 days; it also keeps recovery backups for seven days. Provider account, security and suppression records can have different lifetimes. Your and the company's mail providers also receive delivered messages. These copies do not disappear when Fairly deletes your assessment record.

Other infrastructure support and security processing can occur outside India. Contact Fairly for provider and transfer details. Information may also be disclosed where required by law or to respond to a valid security incident or legal request. Fairly does not sell candidate information, use it for advertising, or use assessment answers to train AI models.

How long assessment records are kept

The retention period recorded on this invitation is a set number of days. The following rule determines the cleanup date for your whole candidate record with this company; the number alone is not a deadline measured from today.

1. For each attempt that has left the running state, count from the time its recorded state changed, including submission, withdrawal, being superseded by a restart, or being finished by the deadline process. If the deadline process finishes it late, count from that finishing time, not the original deadline.
2. For an attempt still marked as running that no longer blocks cleanup, count from that attempt's assessment deadline. This includes an unfinished attempt cut off by a cancelled or replaced link.
3. For every invitation never used for an attempt, count from the invitation deadline, even if the link was cancelled, replaced or expired. A link with only attempts superseded by a restart also counts as unused, including an unstarted retake.
4. For each of those endings, add the shorter of that invitation's recorded period and the company's current workspace period. If an older invitation has no recorded period, use the current workspace period. Increasing the workspace period does not increase an existing invitation's recorded limit; reducing it can bring cleanup forward.
5. Use the latest of all those calculated dates across all your roles and invitations with this company. If there are no such endings, count the current workspace period from creation of your candidate record. A hiring decision does not restart this clock.

Your record and assessment evidence across this company are deleted together. A later assessment or unused invitation can therefore keep an earlier role's evidence longer than that earlier invitation's period on its own. A usable unused active link whose deadline is still ahead blocks routine cleanup. An attempt still running on an active invitation, while its application remains assessment-in-progress and its candidate record active, also blocks cleanup, including while waiting for the deadline process to finish it. If the workspace has no retention period, routine cleanup skips it; the service requires a period before a new invitation can be issued.

Fairly's operator runs cleanup manually every Monday and completes a missed or failed run by Wednesday, including following up records that were busy or failed. A run includes eligible records due within the next seven days, so deletion can happen up to seven days before the calculated date. There is no automatic deletion at the exact date. A busy record, failed deletion or missed run can delay removal; the Monday/Wednesday timetable is the operator's commitment, not an automatic timer. An alert identifies records whose calculated deletion date is more than two days past. You can ask the privacy contact for your calculated date, a deletion request, or an explanation of a delay.

Deletion, other records and browser copies

A successful database deletion removes your candidate record across all roles in this company, invitations, access sessions and consent records, attempts, saved answers and save history, results, reviews, integrity events and resolutions, decisions, in-app help and withdrawal records, and associated email-outbox records. It ends assessment access and cannot be undone. A technical sign-in identity used only for your records is deleted too; one shared with another remaining candidate session stays while still needed there.

The audit trail remains, including actions, dates, actor identifiers, opaque record identifiers, counts and permitted metadata. The deletion command removes the typed reasons it targets; remaining identifiers may still be linkable to a person. Audit entries are kept for three years from each entry to document actions and handle possible claims, then removed by the daily cleanup. This is Fairly's retention policy, not a rule requiring every hiring record to be kept for three years.

Fairly keeps its separate access-address records in the Mumbai database, including successful and refused candidate link-opening requests that reach the service. Deleting your assessment or signing out does not delete these records. Some refusals and rate-limited requests are counted together by address, known browser user and UTC hour, with their count and first and last time. For an unusually large number of addresses from one IPv6 network, further refusals can be counted by the network prefix instead, without keeping each further address or user. A record becomes eligible for daily cleanup 180 days after the last request it contains; a counted record can therefore stay up to an hour longer than 180 days from its first request, plus the time until cleanup runs. A specific incident or legal preservation need can justify retaining a relevant extract longer, with the reason and end or review date recorded. The records contain no answers, clipboard contents, passwords or personal access links and are not used to score capability or decide misconduct. The operator uses an audited incident-access process; your own data may also be supplied through a verified privacy request.

Security counters and provider logs are separate from assessment evidence. Rate-limit windows last at most 24 hours; the daily cleanup removes counter rows once their window ended more than one day earlier. Supabase's database sign-in history becomes eligible for daily cleanup after 180 days; on the hosted pilot this is company sign-in and sign-out history, without network addresses, rather than a log of candidates' anonymous sign-ins. If the hosted service prevents deletion, the operator must arrange disposal and explain any delay. Live sign-in sessions and providers' own logs have separate lifetimes. Fairly's archive does not include failed password attempts sent directly to the authentication provider outside Fairly's pages; these appear only in the provider's short-lived logs. The legal requirement for rolling 180-day ICT logs does not mean all provider logs already meet it. These cleanup thresholds are not exact deletion instants.

Operational counts and error categories are eligible for daily cleanup after 30 days, completed alert-email records after 30 days, and closed alerts after 90 days once their closure has been notified. Unresolved alerts and pending alert messages can remain longer. Scheduled-job history is eligible after seven days. These are cleanup thresholds, not exact deletion times.

The pilot policy is that Fairly keeps no scheduled database backups or recovery dumps of its own. A database failure can therefore lose assessment records. This policy does not remove email-provider backups, provider security or infrastructure copies, downloaded reports, exports, correspondence or messages in mailboxes. Deleting the live database record does not erase those copies; the privacy contact must coordinate with their holders.

Fairly deletes its external working copies and support notes after handling the request. A minimal request register records when a request arrived, what was asked, acknowledgement, action and closure; its entry is deleted one year after closure. A specific lawful preservation requirement can justify an explained exception. Company-held copies remain the company's responsibility.

Your browser uses essential sign-in cookies and storage for access and recovery. Candidate sign-in cookies last up to 24 hours after each write or refresh. Local answer copies, queued saves and receipts are kept in browser storage to protect work during disconnection. Completion and withdrawal try to clear relevant answers; those paths also sweep local attempts whose newest record is over 14 days old. This is not a 14-day deletion timer: an abandoned browser or failed cleanup can leave copies longer. Preparation and confirmation markers also use tab storage. Server deletion cannot remotely wipe an offline browser. After finishing, clear this site's data on a shared device; clearing it during an attempt can destroy unsent answers.

Saying no, withdrawing consent and making requests

You can leave the consent box unchecked and close the page. The assessment cannot start or continue through consent without agreement. Contact the company about an alternative or accommodation; an alternative is not guaranteed. Refusing consent does not erase invitation information already supplied by the company or necessary access and security records.

At any time, write to the company privacy contact above to withdraw consent, stop further consent-based use, request deletion, review or correct inaccurate information, or request a copy of your data. You can also contact Fairly, including after a link expires. Use your invited email where possible; we may ask for minimal information to verify the request. Do not send your personal access link or password.

Withdrawing from hiring or leaving an assessment is different from withdrawing consent or asking for deletion. Say explicitly which action you want. Deletion removes evidence for every role with this company and can prevent it continuing the assessment. Earlier lawful processing is not undone. Fixed historical answers and reviews are not silently rewritten; we will explain how a correction can be recorded. An export is prepared on request, checked for other people's information and sent securely; it is not a permanent download link or a promise of answer keys and every provider record.

If the company has not acted or supplied a lawful instruction on a verified consent-withdrawal or deletion request, Fairly forwards it on receipt, reminds the company at day seven and applies its processing restriction by day 14. This is an escalation limit, not permission to continue consent-based use after a verified withdrawal. The restriction cancels open assessment links and stops new invitations, reviews, scoring, integrity resolution and further hiring decisions other than closing the application as Withdrawn or Not progressing. Existing evidence remains readable and can be exported or deleted; restriction itself is not deletion. Fairly can lift it only with a documented lawful reason, such as your asking to continue. By day 30 you receive a reasoned outcome; forwarding the request or company silence is not completion or a lawful reason to retain information.

Fairly's operator handles requests at the email above, acknowledges them within seven days and completes them within 30 days. Fairly helps the company fulfil candidate requests. Privacy grievances are addressed as soon as possible and within one month of receipt, or 30 days if sooner. If a specific law requires a record to remain, we will explain its category, reason and required period; this does not permit indefinite retention of all assessment evidence.

What your consent means

By selecting the consent control, I agree that the company that invited you, Fairly and the service providers described above may collect, save, use and share my assessment information for this company's hiring assessment, recovery and support, scoring and human review, and the disclosed monitoring, using the retention rule in this notice. I understand that the email delivery described above involves storage in the United States. I can refuse, withdraw consent or request deletion through the contacts above.

This agreement covers this assessment service. It is not permission for advertising, AI training, unnecessary medical information, or automatic hiring decisions. Necessary invitation, access and security processing described above can occur before the assessment consent step or remain subject to legal retention after withdrawal.