Privacy Policy

RelyOnAI LLP(“we”, “our”, “us”) is a registered limited liability partnership and the data controller for personal data processed through the IQMela™ platform. We are also a data processor on behalf of client organisations (“Controllers”) that use IQMela™ to manage their hiring workflows.

IQMela™ is a product and intellectual property of RelyOnAI LLP. All data processing activities described in this policy are carried out by RelyOnAI LLPoperating the IQMela™ platform.

Data protection contact: privacy@iqmela.com

We collect different data depending on your role:

Candidates

• Identity data: Name, email address (from resume or interview invitation)
• Resume data: Work history, education, skills, contact information, and any other content in uploaded CV files
• Video and audio: Live interview recordings, including asynchronous sessions with AI avatars (only with explicit consent)
• Transcription data: Diarised text transcripts of interview sessions, processed by AI models
• Behavioural signals: Eye gaze zone, head posture, speaking pace, silence gaps — computed locally or via our AI sub-processors
• Engagement scores: Confidence and engagement estimates derived from facial expression blendshapes (approximate probabilistic metrics, not psychological assessments)
• Browser signals: Tab visibility changes, fullscreen status, keyboard event patterns — used for interview integrity and proctoring
• Consent records: Timestamp, version of consent given (including specific consent for AI processing), and IP address

Interviewers & Organisation Users

• Identity data: Name, email, organisation membership
• Interview notes: Private notes taken during sessions
• Feedback and scores: Submitted candidate evaluations and hiring decisions
• Usage data: Platform actions, timestamps, feature usage patterns

All Users

• Technical data: IP address, browser type, operating system, session identifiers
• Cookie data: Essential session cookies only (see our Cookie Policy)

• Interview recordings: Automatically deleted 90 days after session end
• Transcriptions & signal reports: 12 months, then permanently deleted from Vercel Blob
• Resume data: Retained while the hiring process is active; deleted upon written request or account closure + 30 days
• Behavioural signal buffers (raw): Not retained — raw signals are summarised to aggregate scores only
• Consent records: Retained for 7 years (legal compliance requirement)
• Account data: Retained for 30 days after account closure, then permanently deleted
• Aggregated, anonymised platform metrics: Retained indefinitely (contains no personal data)

We share personal data with the following trusted sub-processors under binding data processing agreements. All sub-processors are contractually prohibited from using your data for any purpose other than delivering their services to RelyOnAI LLP (operating the IQMela™ platform).

We transfer personal data to third-party sub-processors located primarily in the United States. All such transfers are carried out under appropriate contractual safeguards and data processing agreements consistent with India's Digital Personal Data Protection Act 2023 (DPDP Act) and the Information Technology Act 2000. We ensure sub-processors provide an equivalent level of protection by contract.

Under India's Digital Personal Data Protection Act 2023 (DPDP Act) and the Information Technology Act 2000 (as amended), you have the following rights regarding your personal data:

• Right of Access: Request a copy of all personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data (“right to be forgotten”)
• Right to Restriction: Request limitation of processing in certain circumstances
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time (this does not affect the lawfulness of processing before withdrawal)
• Right to Lodge a Complaint: With your national data protection authority

To exercise any of these rights, email privacy@iqmela.com. We will respond within 30 days. We may need to verify your identity before processing requests.

We implement industry-standard security measures including:

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for data at rest (via sub-processor infrastructure)
• Role-based access control (RBAC) limiting data access to authorised users only
• Non-guessable UUID-based paths for blob storage (recordings, transcripts, reports)
• Automatic recording deletion after 90 days
• Audit logging of all access to sensitive interview data

In the event of a personal data breach that is likely to result in harm to data principals, we will notify the Data Protection Board of India and affected individuals within the timeframes required by the Digital Personal Data Protection Act 2023 and the Information Technology Act 2000.

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, contact us immediately at privacy@iqmela.com and we will delete it.

We may update this Privacy Policy periodically. Material changes will be notified via email and in-platform notification. Continued use after the effective date constitutes acceptance of the updated policy. The current version and effective date are always displayed at the top of this document.

For privacy questions, data subject requests, or complaints:

• Email: privacy@iqmela.com
• Legal: legal@iqmela.com