Privacy Policy

Scovai ("we", "us", "our") operates the Scovai talent intelligence platform. This Privacy Policy explains how we collect, use, store, and protect personal data when you use our services, visit our website, or interact with our platform as a recruiter, candidate, or visitor.

We are committed to protecting your privacy in compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR), the EU AI Act (Regulation (EU) 2024/1689), and applicable national data protection laws.

1. Data Controller

The data controller for personal data processed through the Scovai platform is:

OmniSage LLC (Scovai) — New Mexico Entity ID: 0008015447
1209 Mountain Road PL NE, Suite R, Albuquerque, NM 87110, USA
Email: privacy@scovai.com

OmniSage LLC is established outside the European Union. A representative in the Union under Article 27 GDPR has not yet been designated. Until one is, write to privacy@scovai.com, which is the single address for every data protection question, request or complaint; we answer it ourselves. We will name the representative here once appointed.

For tenant-specific processing (where organisations use Scovai to manage recruitment), the respective organisation acts as the data controller, and Scovai acts as a data processor on their behalf.

2. Data We Collect

2.1 Candidate Data

• Identity data: Name, email address, phone number, location
• CV and career data: Work experience, education, skills, certifications, languages, extracted via AI-powered CV parsing
• Assessment data: Technical assessment responses, psychometric evaluation results (Big Five personality traits, culture fit preferences, leadership style indicators)
• Interview data: AI interview transcripts, responses, and generated evaluation reports
• Scoring data: AI-generated scores across multiple dimensions (technical, experience, education, soft skills, potential) with explainability rationale
• Embedding data: 1536-dimensional vector representations of CV content used for semantic matching (not human-readable)
• Assessment integrity data: signals recorded while you take an assessment or a video interview, including a one-way hash of browser and device characteristics used to show whether a session continued on a different device. These signals are advisory, never a reason on their own to reject a candidate, and are deleted 365 days after the session. They are described in detail in our Cookie Policy.

2.2 Recruiter and Organisation Data

• Account data: Name, email, role, organisation name
• Configuration data: Scoring weight preferences, company culture profiles, AI feature settings
• Usage data: Platform activity, feature usage, analytics data

2.3 Website Visitor Data

• Technical data: IP address, browser type, device information. The IP address is also used server-side, on the home page, to guess your country so that prices and language default sensibly. The result is not stored against you.
• Usage data: Pages visited, time on site, referral source

2.4 Google User Data

When you choose to connect a Google account to a Digital Employee, we access only the Google services and permissions shown on Google's consent screen. Through Scovai's own Google consent screen, those permissions are:

• Gmail (gmail.modify): messages, threads, labels and drafts, and the ability to compose, send, organise and update email
• Google Drive, read (drive.readonly): this permission covers your whole Drive, so that a Digital Employee can find a document you refer to by name without you having to point at the folder first
• Google Drive, write (drive.file): limited to the files and folders you choose yourself in Google's own file picker. Google, not Scovai, enforces that boundary, so a Digital Employee cannot widen it
• Google account identity (userinfo.email): the email address of the connected account, which is the only human-readable name we can show you for the grant

Scovai's own consent screen does not request Google Calendar, Docs or Sheets permissions. Those services are reached, when you connect them, through one of the two routes below.

Connecting Google is optional. Scovai accesses this data only after your explicit OAuth consent and only when you or your authorised Digital Employee initiates a task that requires it.

A person can connect an account to a Digital Employee in four ways, and which one is used changes who holds the keys.

1. Directly to Google, through Scovai's own consent screen, for Gmail and Drive as described above. Scovai holds the refresh token, encrypted, and the Digital Employee receives short-lived access tokens.
2. Directly to Microsoft, through Scovai's own Microsoft consent screen, for Microsoft 365 mail (Outlook), Microsoft 365 Calendar and OneDrive / SharePoint. OneDrive and SharePoint access is narrowed to the folder you pick. Scovai holds the refresh token, encrypted, and the Digital Employee receives short-lived access tokens.
3. Through UNIPILE, a connection broker, for Gmail, Google Calendar, Outlook, Microsoft 365, WhatsApp, Telegram, Instagram and LinkedIn. The consent request on the provider's screen comes from UNIPILE, UNIPILE holds the tokens, and the Digital Employee holds a scoped broker key that lets it read and, if you enabled sending, send from the connected account. For LinkedIn that key reaches only Scovai, never LinkedIn: Scovai sends each request to UNIPILE itself, within daily limits, and every message, invitation or post waits for your approval. When you disconnect, the account is removed at UNIPILE shortly after.
4. Through Pipedream, a connected-app gateway, for apps such as Google Drive, Docs, Sheets and Meet. Pipedream holds the authorisation and carries out the request, so the request and its result pass through Pipedream.

A messaging account is different in kind from a mailbox: connecting one exposes the conversations of the people who write to that account, including group chats, not only the messages you wrote.

2.6 Meeting Recordings, Transcripts and Summaries

When a meeting or interview is recorded on the platform, we process the audio and video of the call, a transcript of what was said, a summary and the action items derived from it, the in-call chat, and the names and email addresses of participants and guests. Recording is on by default, and the organiser can switch it off. Guests from outside the organising company are asked to consent before it starts; the organising company's own personnel are notified, on the basis of the employment relationship, and that company is responsible for informing them and, where national law requires it, their representatives.

The audio is transcribed by OpenAI and the transcript text is summarised by Anthropic, with OpenRouter as a fallback. A Digital Employee of the organising company may be asked to follow up on the meeting, in which case the transcript and summary are filed into that Digital Employee's reading material. Recordings are deleted after the periods set out in section 6; transcripts, summaries and action items are kept until the organising company deletes the meeting.

After a meeting, the organiser can send a debrief to the people who were invited. That debrief can include the full transcript, and it goes to every invitee the organiser selects, including guests from outside the organising company. The organiser chooses the recipients; we do not filter the content per recipient.

3. How We Use Your Data

We process personal data for the following purposes:

• Service delivery: To provide CV parsing, AI scoring, assessments, interview facilitation, and candidate-position matching
• AI-powered analysis: To generate scores, psychometric profiles, interview evaluations, and shortlist rankings using machine learning models
• Platform improvement: To improve the accuracy and fairness of our scoring and matching, optimise user experience, and develop new features. This is done with aggregated and statistical data. We do not use candidate data, and we do not use the content a Digital Employee handles, to train or fine-tune AI models.
• Compliance: To maintain audit trails, enable human review of AI decisions, and monitor for algorithmic bias
• Communication: To send notifications, assessment invitations, interview links, and service updates
• Google-connected agent tasks: To carry out the Gmail, Drive, Docs, Sheets, and Calendar actions you explicitly request from a connected Digital Employee

4. Legal Bases for Processing

5. Automated Decision-Making and Profiling

Scovai uses AI to score candidates, generate psychometric profiles, and produce interview evaluations. In accordance with GDPR Article 22 and the EU AI Act:

• Transparency: Every AI-generated score includes an Explainable AI (XAI) rationale in plain language, explaining why the score was assigned
• Human oversight: No fully automated hiring decisions are made. AI outputs serve as recommendations: human recruiters make final decisions
• Right to contest: Candidates can request human review of any AI-generated assessment or score
• Bias monitoring: Our analytics module analyses AI scoring patterns and funnel progression across gender and age range, surfacing statistical anomalies where a group's outcomes deviate from the overall distribution

6. Data Retention

• Candidate data: Retained for the duration of the recruitment process plus 12 months, unless consent is given for talent pool retention. A nightly job deletes the application and the records derived from it — its assessments, interviews, scores and integrity records — 12 months after the application was decided. Your profile is not part of that deletion: it belongs to you, not to the employer, and other applications keep their own clocks.
• Talent pool data: Retained until consent is withdrawn, and in any case no longer than 24 months from last activity, after which the same nightly job deletes the entry.
• Account data: Retained for the duration of the service agreement plus 12 months, deleted on request and through our data governance process.
• Audit logs: Error and critical logs retained for 365 days; informational logs for 30 days; warning logs for 90 days. Each row is written to a compressed archive file before it is deleted from the live system; those archive files are kept until an administrator removes them.
• Digital Employee records: A Digital Employee's working memory, conversation transcripts, approval records and mailbox are kept for as long as it is assigned, and are then handled as described under release below. Activity and incident records on the platform are kept for the life of the workspace.
• Releasing a Digital Employee: When a Tenant releases a Digital Employee, its seat records are kept and any accounts connected to it stay connected until the Tenant disconnects them. Thirty days later, or three days later if it was never charged, we instruct its runtime to delete its working memory and conversation transcripts and we then destroy its virtual machine. Its mailbox is disabled and the messages in it are kept until deletion is requested. Conversation content in Scovai Workspace is retained by that service until the Tenant requests deletion. Backups of the platform database are overwritten within seven days.
• Interview and meeting recordings: Interview recordings are deleted 90 days after the interview and live meeting recordings 180 days after the meeting. Transcripts, summaries and action items are kept until the Tenant deletes the interview or the meeting.
• Scovai Workspace conversations: Messages exchanged in Scovai Workspace are stored by that service, in readable form and with a search index, for as long as the workspace exists. Scovai has no mechanism to delete that content on its own; it is deleted on the Tenant's request.
• Disconnected connectors: When a connector is disconnected we delete the stored token and call the provider's revocation endpoint where it offers one; that call is best-effort and can fail. The record of the connection itself, including its encrypted envelope, is retained until the workspace is deleted.
• Digital Employee telemetry: Operational reports a Digital Employee runtime sends us — heartbeats, readiness checks and summaries of the work it reports — are kept with the activity records for the life of the workspace.
• Assessment integrity records: Deleted automatically 365 days after the session, unless a record is subject to a legal hold.
• AI model training data: We do not use individual candidate data, or the content a Digital Employee handles, to train or fine-tune AI models
• Google OAuth credentials: The refresh token is encrypted at rest and retained only while the connector remains active. Disconnecting the connector deletes Scovai's stored refresh token and asks Google's token-revocation endpoint to revoke it; as with every connector, that revocation call is best-effort and can fail, and the record of the connection is retained as described under Disconnected connectors above
• Google content: The connector does not create a central copy of Gmail, Drive, Docs, Sheets, or Calendar content. Temporary operational caches, if required to complete a task, are held only for as long as the task needs them. Outputs that you intentionally ask an Agent to create or save remain subject to the normal account or service retention periods until you delete them

7. Data Sharing

We do not sell personal data. Data may be shared with:

• Employer organisations: Candidate data is shared with the recruiting organisation that the candidate applied to or was matched with
• AI providers: AI tasks of the platform (CV parsing, scoring, assessments, interviews, voice, and embeddings) are processed by named sub-processors, Anthropic (Claude API) and OpenAI, under data-processing agreements, routed through a centrally configured and audited gateway. API data under these agreements is not used to train provider models. A Digital Employee in the European region uses those same providers. A Digital Employee in the Middle East region does not use that gateway: it calls its language model provider, Zhipu AI, directly, with Sakana AI as the fallback (see Section 11)
• Hosting providers: The platform, its database and uploaded files are hosted within the European Economic Area, in France. A Digital Employee runs in the processing region its customer chooses, as stated in Section 11: in the European region it runs in France and its language model is called at Anthropic, OpenAI or a provider routed through OpenRouter; in the Middle East region it runs in the United Arab Emirates and its language model is called in the People's Republic of China, with a fallback in Japan. Connected apps reached through Pipedream are processed in the United States in either region

7.1 Google API Services and Limited Use

Scovai's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

Google user data is used only to provide or improve the user-facing connector functionality that you request. Where a task requires language-model processing, the minimum necessary content may be transmitted to our AI service providers, solely as service providers acting on Scovai's instructions and solely to complete that task. For platform features those providers are Anthropic, OpenAI, or providers routed through OpenRouter, under data-processing agreements with no-training terms. For a Digital Employee the provider depends on its processing region: in the European region it is one of those same providers; in the Middle East region it is Zhipu AI, called directly at an endpoint in the People's Republic of China, with Sakana AI in Japan as a fallback. In either region the content the Digital Employee is working on at that moment is sent to the model as context. If you connect a Google account to a Digital Employee, Google content you ask it to work on reaches that provider. Connected apps reached through Pipedream pass the request and its result through Pipedream in the United States. All of these are listed, with their locations, in Section 11.

We do not sell Google user data, use it for advertising, use it to determine creditworthiness or lending eligibility, use it for surveillance, or use it to train or fine-tune general-purpose or personalised AI models. Humans do not read Google user data except with your affirmative agreement for support or security purposes, when necessary to investigate abuse, or where required by law.

You may disconnect a Google connector from Scovai at any time. You may also review or revoke Scovai's access directly from your Google Account permissions.

8. Communication Channels

Scovai communicates with you via email (always) and WhatsApp (opt-in). WhatsApp notifications are strictly transactional: interview reminders, booking confirmations, and urgent recruiter messages. We do not use WhatsApp for marketing. When you verify your number, Meta Platforms (WhatsApp) processes it under Meta's Data Processing Agreement. You can revoke WhatsApp notifications at any time in Settings; we keep the number for audit until you delete your account.

9. Data Security

We implement appropriate technical and organisational measures including:

• AES-256 encryption of API keys and sensitive credentials at rest: GCM for Digital Employee credentials, CBC for AI provider keys, connected-inbox tokens and contract-signing tokens. We do not claim encryption of the database or of uploaded files at rest beyond this.
• Argon2 password hashing
• JWT-based authentication with access and refresh tokens
• TLS encryption for all data in transit
• Role-based access control (RBAC) with tenant isolation
• Comprehensive audit logging of all platform actions

Backups. The platform database is dumped once a night and the dumps are kept for seven days, on the same infrastructure that runs the platform. They are not separately encrypted and there is no copy in a second location. Uploaded files and Digital Employee virtual machines are not included in that dump. One practical consequence worth stating: when we delete personal data at your request, copies of it can persist in those dumps for up to seven days, after which they are overwritten.

10. Your Rights

Under the GDPR, you have the right to:

• Access your personal data (Art. 15)
• Rectify inaccurate data (Art. 16)
• Erase your data ("right to be forgotten") (Art. 17)
• Restrict processing (Art. 18)
• Data portability: receive your data in a structured, machine-readable format (Art. 20)
• Object to processing, including profiling (Art. 21)
• Not be subject to solely automated decisions with legal effect (Art. 22)
• Withdraw consent at any time without affecting the lawfulness of prior processing (Art. 7(3))

To exercise any of these rights, contact us at privacy@scovai.com. We will respond within 30 days.

10A. If a Digital Employee Handled Your Data

If you are not a Scovai user and an organisation's Digital Employee emailed you, messaged you, recorded a meeting with you, or handled a document that names you, that organisation is the controller of your data and Scovai is its processor. We do not decide what it does with your data and we cannot delete it on our own authority.

Write to privacy@scovai.com. We will forward your request to the organisation, tell you that we have done so, and support its response — including locating what we hold on its behalf so that it can give you access or delete it. If you do not know which organisation it is, tell us the email address or the meeting it concerns and we will identify it.

11. International Transfers

Candidate personal data is stored within the European Economic Area, on servers provided by Contabo GmbH in France. For specific AI-powered features, data is processed by sub-processors under data-processing agreements: Anthropic (Claude API: CV parsing, candidate–position scoring, assessment and interview analysis, identity-document verification) and OpenAI (speech-to-text for interviews and recorded meetings, text-to-speech for voice interviews, text embeddings, routed through a centrally configured and audited gateway). API-based processing under these agreements is not used to train provider models. The audited gateway (OpenRouter) may route specific auxiliary AI tasks to additional vetted model providers under the same no-training and data-processing-agreement constraints. Accounts that a person links to a Digital Employee (Gmail, Google Calendar, Outlook, Microsoft 365, WhatsApp, Telegram, Instagram and LinkedIn) may be connected through UNIPILE, a connection broker, under a data-processing agreement. Where a provider processes data outside the EEA, in a country not covered by a European Commission adequacy decision, the transfer is to be covered by the Standard Contractual Clauses; Scovai is completing their execution, and the related transfer impact assessments, with each such provider, as set out in the Data Processing Agreement. The current sub-processor list is available on request; material changes are notified in advance.

Digital Employees. A Digital Employee runs in a virtual machine in the processing region its customer chooses; Scovai offers two. In the European region, the virtual machine runs on servers provided by Contabo GmbH in France, within the European Economic Area, and the language model is Anthropic, OpenAI or a provider routed through OpenRouter, under data-processing agreements with no-training terms: the same providers that serve the platform's own AI features. In the Middle East region, the virtual machine runs on servers owned and operated by OmniSage LLC in the data centre at 2704 Fortune Executive Tower, Cluster T, Jumeirah Lakes Towers (JLT), Dubai, United Arab Emirates, outside the European Economic Area, and the language model is Zhipu AI (GLM), called directly at an endpoint in the People's Republic of China, with Sakana AI in Japan as the fallback. In either region the virtual machine holds the Digital Employee's working memory, transcripts, shared files and mailbox, and the material it is working on at that moment is sent to its language model as context for the reply. Digital Employees hired before the European region opened run in the Middle East region; a customer who prefers the European region for them can ask at privacy@scovai.com. Apps a person connects to a Digital Employee, such as Google Drive, Docs, Sheets and Meet, are authorised and carried out through Pipedream, Inc. in the United States, in either region. The platform itself, its database and uploaded files are hosted by Contabo GmbH in France; the scovai.com website is delivered through Cloudflare; transactional email leaves through the GPlugin mail relay. Transfers outside the EEA are addressed in the Data Processing Agreement.

12. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email to registered users and posted on this page with an updated "Last updated" date.

13. Contact

For privacy enquiries, data protection requests, or complaints:

Email: privacy@scovai.com

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU or EEA Member State of your habitual residence, your place of work, or the place of the alleged infringement (GDPR Article 77).