Vettasy
Start a pilot

Privacy Policy

Effective 25 September 2026Version 3

This policy describes the personal data Vettasy processes on vettasy.com, in the Vettasy desktop application and in employer workspaces, why it is processed, how long it is kept and which rights apply.

1Scope and roles

This policy applies to visitors of vettasy.com, to candidates invited to interviews held in Vettasy (“Candidates”) and to employees of organisations that hire with Vettasy (“Customers”). It does not apply to the websites or services of Customers, even when they link to Vettasy.

Vettasy acts in two roles. For interviews, the Customer that sends the invitation decides why and how interview data is used and is the controller. Vettasy processes that data on the Customer’s behalf as a processor, under the Data Processing Addendum. For the website, Customer accounts, billing, security and support, Vettasy is the controller.

Candidates should also read the privacy notice of the employer named in the invitation. The employer’s notice governs the employer’s own use of interview data. This policy governs what Vettasy does with it.

2Who is responsible

Vettasy LLC, a limited liability company registered in Delaware, USA, with its principal office at Unit 508, Level 5, Core F, Cyberport 3, 100 Cyberport Road, Hong Kong, is responsible for the processing described in this policy where it acts as controller. Questions and requests go to [email protected].

For interview data, the controller is the Customer named in the invitation email, on the invitation page and on the first screen of the app. Requests about interview data can be sent to the Customer directly or to [email protected], which forwards them to the Customer within five business days.

Vettasy has appointed representatives in the European Union under Article 27 of the GDPR and in the United Kingdom under Article 27 of the UK GDPR. Data subjects and supervisory authorities can reach them at [email protected]. Messages to this address go to the representatives directly.

3Data collected

Website visitors

  • Page views, referring sites, browser type, operating system and country, counted by Plausible Analytics without cookies and without storing IP addresses. Only aggregated figures are kept.
  • Server logs with the IP address, the requested page, the time and the browser identifier. They are used to detect abuse and are deleted after 14 days.
  • Messages sent to a Vettasy address, including their content and the sender’s address.

Candidates

  • Invitation details received from the Customer: name, email address, role, interview time and the invitation code.
  • Results of the camera and microphone check: device names, connection speed and whether screen capture is allowed for interview tools. The check itself records no audio or video.
  • Consent records: the time of each consent, the version of the consent text and the two separate choices, for the recording and for Verified Session.
  • Interview content: audio and video, the transcript, activity in the code pad and on the whiteboard, and the session chat.
  • Verified Session signals, collected only between the start and the end of the interview: windows hidden from screen capture, known AI copilot processes, virtual cameras and audio drivers, the presence of a second monitor, and the result of one liveness check at the start.
  • The session report, disputes about it and their outcome.
  • Written feedback that the Customer sends through Vettasy.

Customer users

  • Name, work email address, job title and role in the workspace.
  • Sign-in data, including single sign-on identifiers on Enterprise plans.
  • Interview plans, scorecards, notes, bookmarks and entries in the decision log.
  • An audit log of actions in the workspace, such as opening a recording or changing a retention setting.

Billing

Company name, billing address, tax identification number and the billing contact. Payments are handled by Stripe. Vettasy does not receive or store full card numbers.

Diagnostics

Crash reports from the app, sent through Sentry: the app and operating system version, the error and the state of the app at the time. Crash reports exclude audio, video, transcripts and chat.

4Data never collected

The app does not run outside the interview. It has no background process, no autostart and no scheduled tasks. It never collects:

  • Emotions, facial expressions or tone of voice.
  • Files on the computer.
  • Keystrokes outside the app.
  • Browser history.
  • The screen outside the app, or what is shown on a second monitor.
  • Anything before joining the interview or after leaving it.

Vettasy does not sell personal data, does not share it for cross-context behavioural advertising and does not build advertising profiles.

5How data is used

  • To run interviews: connecting participants, recording, transcription and live captions.
  • To give both sides the same session report, and the Candidate a copy of the recording, the transcript and the report.
  • To prepare AI drafts for interviewers: briefs, follow-up prompts, scorecards with quotes and timecodes, and feedback. Each draft is labelled and counts only after a person confirms it.
  • To review disputes about the session report.
  • To verify Customers before their first invitation: ownership of the domain and documents of the legal entity.
  • To bill Customers and keep accounting records.
  • To secure the service, investigate abuse and fix errors.
  • To answer support requests and send service messages, such as the recording link and reminders about the camera and microphone check.
  • To meet legal obligations.

Customer data is never used to train AI models, by Vettasy or by its providers.

Vettasy makes no decisions based solely on automated processing that have legal or similarly significant effects. The AI does not reject, rank or score Candidates on its own. Hiring decisions are made by people at the Customer and recorded in the decision log under their names.

6Legal bases

Where the GDPR or the UK GDPR applies, Vettasy relies on the following legal bases for the processing it controls. For interview data, the Customer determines the legal basis as controller.

PurposeLegal basis
Customer accounts, workspaces and supportPerformance of a contract, Article 6(1)(b)
Company verificationLegitimate interests in preventing fake employers, Article 6(1)(f)
Billing and accounting recordsLegal obligation, Article 6(1)(c)
Security, abuse prevention and server logsLegitimate interests in protecting the service, Article 6(1)(f)
Website analytics without cookiesLegitimate interests in understanding use of the website, Article 6(1)(f)
Review of disputesLegitimate interests in a fair review, Article 6(1)(f)
Crash reportsLegitimate interests in a working app, Article 6(1)(f)

The recording and Verified Session each require a separate consent on the consent screen before the interview starts. The Candidate can stop at that screen, and nothing is saved.

7AI processing

AI features process interview content only to produce outputs for the Customer’s interviewers and for the Candidate’s copy. The providers are:

  • Transcription runs on the participants’ computers. Audio is not sent to a transcription provider.
  • Scorecard drafts, briefs, follow-up prompts, highlights and feedback drafts use Anthropic’s Claude models through Amazon Bedrock in the Frankfurt region.
  • Caption translation uses DeepL.
  • The synthesized voice for the optional voice translation uses OpenAI.

Each provider processes the data under a contract that forbids training on it and limits retention to what the request needs. Prompts and outputs on Amazon Bedrock are not stored.

AI output is labelled in the app. The synthesized voice is marked as AI-generated in machine-readable form, as Article 50 of the EU AI Act requires. Details are in the AI Notice.

8Sharing

  • With the Customer that sent the invitation: the recording, the transcript, the session report, scorecards and feedback, according to the roles set in the Customer’s workspace.
  • With subprocessors that host, transmit or process data for Vettasy. The current list with purposes and regions is on the Trust page and in the DPA.
  • With authorities, when the law requires it. Vettasy reviews each request, discloses only what is required and informs the Customer unless the law forbids it.
  • With a buyer or successor in a merger or acquisition, under the same protections as this policy and with notice to Customers.

Vettasy staff open a recording only to review a dispute or at the Customer’s written request for support. Each access is logged.

9International transfers

Interview data is stored in Germany, in Hetzner data centers in Nuremberg and Falkenstein. Enterprise Customers can choose a US region instead, hosted on AWS.

Some subprocessors are based in the United States, for example for billing, single sign-on and email. Transfers outside the EEA and the UK rely on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914, with the UK Addendum where UK data is involved.

The Vettasy team works from its principal office in Hong Kong. Remote access by staff for support or dispute review is covered by the same clauses, and the data stays stored in Germany.

10Retention

DataKept for
Recordings and transcriptsThe period set by the Customer for the role, from 7 to 90 days. 90 days by default.
Session reportsThe same period as the recording.
Consent recordsThe retention period of the recording, then 12 months to demonstrate consent.
DisputesUntil the dispute is closed, then 12 months.
Candidate’s copyUntil the retention period of the original recording ends.
Customer account dataThe subscription term, then 30 days after notice of termination.
Billing records7 years, as tax law requires.
Server logs14 days.
Crash reports90 days.

Deletion on request takes up to 30 days and includes backups, unless a dispute is open or the law requires the data to be kept. Backups are encrypted and rotate within 30 days.

11Rights

Depending on where a person lives, the law gives the following rights:

  • Access to personal data and a copy of it.
  • Correction of inaccurate data.
  • Deletion.
  • Restriction of processing and objection to it.
  • Receipt of data in a portable format.
  • Withdrawal of consent at any time, without affecting processing before the withdrawal.
  • A complaint to a data protection authority.

Requests go to [email protected]. Vettasy answers within one month and may ask for information to confirm identity. For interview data, Vettasy forwards the request to the Customer as controller and helps the Customer answer it. Withdrawing consent to the recording after the interview is handled as a deletion request.

California and other US states

Residents of California and other US states with privacy laws have the right to know what personal information is collected, to delete and correct it, and to opt out of its sale or sharing. Vettasy does not sell or share personal information as those laws define the terms and does not use sensitive personal information to infer characteristics. Requests go to the same address. Vettasy does not discriminate against anyone for exercising these rights.

Hong Kong

The Personal Data (Privacy) Ordinance (Cap. 486) gives the right to request access to personal data and its correction. Vettasy answers data access and correction requests within 40 days, as the Ordinance requires. Requests go to [email protected]. Complaints can be made to the Office of the Privacy Commissioner for Personal Data, Hong Kong.

12Disputes about the session report

The Candidate can dispute any line of the session report within 14 days of the interview, with an explanation. A person at Vettasy reviews the dispute and may open the recording and the raw signal data for that purpose. Each access is logged.

The outcome is added to the report that both sides see. While the review is open, the signal under review cannot be used as grounds for a decision.

13Security

Data is encrypted at rest with AES-256 and in transit with TLS 1.3. Access by Vettasy staff requires single sign-on with a second factor, is limited to the people who need it and is logged. The Windows and macOS builds are code-signed and run without administrator rights.

An independent penetration test is scheduled for Q4 2026, and a SOC 2 Type II report is expected in Q3 2027. The current state is on the Trust page.

If a personal data breach affects Customer data, Vettasy notifies the Customer without undue delay and no later than 48 hours after confirming it. Where Vettasy is the controller, it notifies the competent authority within 72 hours where the law requires.

14Children

Vettasy is not intended for anyone under 16. Customers that interview Candidates under 18 are responsible for any additional consent the law requires.

15Changes to this policy

Material changes are announced on this page and by email to Customers at least 30 days before they take effect. The version number and the effective date at the top of the page change with every update. Previous versions are available on request.

16Contact

Questions about this policy and requests about personal data go to [email protected]. Security issues go to [email protected].

Complaints can also be lodged with the data protection authority in the country of residence or work.