Data and privacy
What is recorded during an assessment, where it is stored, who can see it, and how long it is retained.
Data and privacy
This page describes what data QualifyCode handles for an assessment, who can see it, and how it is retained. It is written for the recruiter or hiring manager who needs to answer candidate questions and write a privacy notice.
What data is recorded
| Category | Examples | Where it is used |
|---|---|---|
| Account | Email, name, organization, role | Sign-in and workspace membership |
| Assessment | Configuration, problem set, schedule, email template | Running the assessment |
| Candidate list | Email, name | Sending invitations and reminders |
| Submission | Code, run results, integrity events, video | The integrity report and replay |
| Decision | Screening verdicts, notes, tags, shortlists | The screening workflow |
| Billing | Wallet balance, ledger entries, gateway receipts | Payments and billing |
Who can see what
| Audience | What they can see |
|---|---|
| Candidate | Their own invitation, briefing, and submission. They do not see other candidates' data. |
| Recruiter (own) | Their own assessments, candidates, results, notes, and shortlists. |
| Recruiter (others) | Nothing. Recruiters do not see other recruiters' assessments or candidates. |
| Admin | Everything in the workspace: every assessment, every candidate, the ledger, the bar, automation. |
| Workspace members with a share grant | The specific assessment (VIEW or EDIT) without joining the owner's hiring pipeline. |
| Support | Only with explicit user consent in a support session. |
Storage
The platform uses industry-standard storage for each kind of data:
- Video and large files are stored in secure object storage. Access is via short-lived, signed URLs that expire automatically.
- Structured data (assessments, candidates, results, decisions, billing records) is stored in encrypted databases with regular backups.
- Session state is held in transient cache storage and discarded when no longer needed.
Retention
| Data | Default retention |
|---|---|
| Account and profile | Until you delete your account |
| Assessment configuration | Until you delete the assessment |
| Candidate submissions and integrity events | Until you delete the assessment or the candidate's record |
| Video recordings | Until you delete the assessment or the candidate's record |
| Screening decisions and notes | Until you delete the candidate's record |
| Wallet ledger | Until you delete the workspace |
| Audit trail (decision events) | Until you delete the candidate's record |
Specific retention windows may be configured at the workspace level. Contact your admin for the current setting.
Subprocessors
The platform uses the following third-party processors:
| Processor | Purpose |
|---|---|
| Stripe / Razorpay | Payment processing |
| Authentication provider | Sign-in and account management |
| Code execution provider | Running candidate code against test cases during the assessment |
| Hosting provider | Hosting the application and storing data |
Each processor handles the data necessary for its purpose under its own privacy policy.
Candidate data rights
Candidates have the right to ask what data you hold about them and to request its deletion. The platform exposes the data through your dashboard so you can answer without a support request:
- What did this candidate submit? The candidate detail page on the assessment.
- What decision was recorded? The candidate's dossier.
- Delete the candidate's data. From the dossier or the assessment's candidate list, when permitted by your retention policy.
Write your privacy notice with this in mind
A clear privacy notice tells candidates (a) what is recorded, (b) why, (c) who can see it, and (d) how to ask for deletion. This page is enough to answer all four questions for the typical case.