Privacy Policy

1. Who is responsible – our two roles

• Candidates: For data about you when you take an interview, the employer (our customer) who invited you is the data controller. Skillscanner is a data processor and processes the data only on the customer's instructions and under the data processing agreement with the customer.
• Recruiters and customers: Skillscanner is the controller for user accounts, billing and customer communication.
• Website visitors and demo requests: Skillscanner is the controller.

Contact: Skillscanner AS (org. no. 832 379 972), hello@skillscanner.ai.

2. Data about candidates

When you take an interview, we process on behalf of the employer:

• your name and email address from sign-in
• the CV you upload and the text extracted from it
• voice recordings of your answers and transcripts of them (both the original speech-to-text version and the AI-corrected one)
• the AI-generated assessment (summary, a 0–100 competency score per requirement, strengths and weaknesses, and an overall "job fit score")
• the recruiter's own notes and score, and any feedback you give about the interview
• confirmation that you have read the privacy information (version, time and language)
• technical logs (access and event logs)

The purpose is to help the employer assess your application for the position. The employer determines the legal basis; normally it is legitimate interest and assessing applicants before a possible employment contract (GDPR art. 6(1)(f) and (b)). The processing is not based on consent. We do not use candidate data for our own purposes, and it is not used to train AI models.

3. AI, automated decisions and the EU AI Act

Skillscanner uses AI to transcribe answers, correct transcripts and produce an assessment of how your answers and CV match the requirements the employer has set for the position. The assessment does not cover personality or "cultural fit".

• The assessment is advisory. Skillscanner does not reject candidates or make decisions. A person at the employer reviews the assessment and makes every decision, so no decision is based solely on automated processing (GDPR art. 22).
• Recruiters see the assessment labelled "AI-generated · advisory", with a note that it must not be the sole basis for decisions.
• You can ask the employer for a human to review your application again, and you can express your point of view and contest the assessment.
• AI systems used for recruitment and evaluating candidates are high-risk under the EU AI Act (Annex III point 4). Skillscanner is the provider of the system and the employer is the deployer. Each assessment is logged with the model, prompt version and a checksum of its input so that it can be traced.

4. Data about recruiters, customers and visitors

Here Skillscanner is the controller:

• User account: name, email, organisation and sign-in data (via Clerk) – to provide the service (contract, art. 6(1)(b)).
• Billing: invoicing and payment details (via Stripe) – contract and bookkeeping obligations (art. 6(1)(b) and (c)).
• Security and operations: audit log of actions in the dashboard and error logs – legitimate interest in a secure and stable service (art. 6(1)(f)).
• Demo and trial interview: name, work email, company, role and the answers in the trial interview – to show you the product and follow up your request (legitimate interest / pre-contract steps).
• Website statistics: Google Analytics, only if you accept in the banner (consent, art. 6(1)(a)). See cookies.

5. Recipients and subprocessors

We never sell personal data, and we do not share it for marketing or advertising.

Candidate data is shared only with the employer that owns the interview and – on the employer's instruction – with the employer's applicant tracking system (for example Teamtailor). The employer can turn off sending scores to its ATS.

We use subprocessors for hosting, storage, AI, sign-in, email and billing. See the full list of subprocessors.

6. Transfers outside the EU/EEA

The database and CV parsing run on our own server in Norway (encrypted disk), and AI assessments are produced in Microsoft Azure OpenAI in Sweden (EU). Some services involve transfers to the USA:

• OpenAI – speech-to-text and reading your name from your CV (only the start of the CV is sent)
• Clerk – sign-in for candidates and recruiters
• Mailtrap – sending email, such as interview invitations
• ngrok – the tunnel that traffic to the service passes through
• other providers as shown in the subprocessor list

The transfers rely on the EU Standard Contractual Clauses (SCC), and the EU–US Data Privacy Framework where the provider is certified.

7. How long we keep data

• Candidate data (application, CV, recordings, transcripts, assessments and feedback): erased 180 days after the last activity, unless the employer has chosen a different period (between 30 and 1095 days).
• Candidate data in interviews the employer has deleted: erased 30 days after the interview was deleted.
• The employer can export or permanently erase a single candidate's data at any time.
• When a candidate's data is erased, only an anonymous log of the AI runs (model, prompt version and time) is kept for 12 months, for traceability.
• Demo requests: erased after 90 days.
• Audit log: 12 months. Website error logs: 90 days.
• Recruiter user accounts: as long as the account is active. Accounting records are kept as long as bookkeeping law requires.

8. Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interest. If you have given consent (for example to statistics), you can withdraw it at any time.

• Candidates: contact the employer, who is the controller. Requests that reach us are forwarded to the employer, and we help the employer respond.
• Others: contact us at hello@skillscanner.ai.

You can complain to the Norwegian Data Protection Authority, Datatilsynet (www.datatilsynet.no).

9. Cookies

We only use strictly necessary cookies for sign-in and language choice. Google Analytics is used only on the public pages, only after consent, and never on candidates' interview pages or in the recruiter dashboard. See cookies.

10. Security

We protect the data with encrypted transport (HTTPS; encryption ends at the tunnel provider ngrok, which forwards the traffic encrypted to the server), disk encryption on the server, access control where each customer only sees its own interviews, and an audit log. When Skillscanner staff access customer data (for example for support), it is logged. In the event of a personal data breach we notify the customer without undue delay, and Datatilsynet within 72 hours where we are the controller.

11. Changes

We update this policy when the processing changes. If the information given to candidates changes materially, it gets a new version number and candidates see the new version before their next interview.

12. Contact

Skillscanner AS (org. no. 832 379 972), Schives gate 12C, 0259 Oslo, email hello@skillscanner.ai.