Privacy Policy

1. Who we are and who this policy covers

Evalynq Talent is operated under the Evalynq brand ("Evalynq", "we", "us", or "our"). This policy covers visitors to our website and people who create or use a job-seeker, recruiter, reviewer, or administrator account. It also explains how we handle information about candidates and applicants whose data is submitted to or generated through the service.

Our current contact for privacy questions and requests is support@evalynq.com. Evalynq has not yet published a registered legal entity name or registered address. We will update this notice when those details are available.

2. When we act as controller or processor

The role we perform depends on the activity. We determine how to use information needed to create and secure accounts, operate the talent marketplace, maintain platform records, and administer our service. For a particular recruitment or assessment, the organization that creates the job, invites candidates, or decides how to use results may determine the purposes and means of processing and act as a controller; Evalynq may process that information for the organization under its instructions. The organization’s own candidate notice or agreement may provide additional details.

If you are applying for a job or responding to an organization’s assessment, contact that organization about its hiring decisions and recruitment-specific data. You may also contact us, and we will help route your request where appropriate.

3. Information we handle

Depending on how you use the service, we may handle the following categories:

• Account and authentication information: name, email address, account role, password hash, email-verification state, session records, and account security events. We do not store passwords in readable form.
• Professional profile information: work and education history, skills, languages, locations and geographic experience, professional links, credentials, availability, deployment preferences, and information you choose to include in your profile or CV.
• CV and application information: CV files, information extracted from a CV into a draft profile, job applications, application answers, profile snapshots, screening responses, and application-stage history. CV extraction creates a draft for you to review; it does not automatically publish the extracted details to your profile.
• Assessment information: assessment selections, answers, uploaded work, timestamps, scores, reviewer feedback, results, badges, and retake or submission records.
• Assessment integrity signals: when configured, browser events such as tab visibility, window focus, fullscreen state, screen-share start/stop, and clipboard or context-menu events; event timestamps; and hashed device or IP indicators. Screen sharing is captured only by the candidate browser's native picker. Evalynq does not receive, transmit, or store screen video. The application does not capture webcam video or use AI proctoring.
• Recruiter and organization information: recruiter account details, organization identity and verification information, memberships and invitations, job postings, candidate searches and shortlists, access requests, candidate responses, consent records, and billing or transaction references.
• Communications and operational records: support messages, transactional email events, notifications, audit-log entries, rate-limit records, API or webhook configuration and delivery status, and service diagnostic information.
• Technical information: IP address as received by our service for security and rate-limiting, browser or device request information, and server or hosting logs maintained by our infrastructure providers.

4. CV import and assessment processing

When you request CV import, the service reads the CV you uploaded, extracts text, and prepares a structured draft of profile details. You can review, edit, select, or reject draft information before it is added to your profile. The extraction runs within the service; it is not used to train a general-purpose AI model.

Assessment answers may be automatically scored where an assessment uses objective scoring rules. Practical submissions may be reviewed by human reviewers. Integrity signals are indicators for authorized review and are not, by themselves, a finding that a candidate cheated or is unsuitable. Organizations remain responsible for their hiring and eligibility decisions.

5. How we use information

• Create and administer accounts, verify email addresses, authenticate users, and provide requested platform features.
• Build and maintain job-seeker profiles, perform CV import at your request, run assessments, save submissions, arrange human review, issue results and badges, and support applications.
• Let recruiters and organizations create jobs, search or shortlist talent, handle applications, request access, and manage candidate consent and organization membership.
• Protect the service, prevent abuse, enforce role and access boundaries, investigate incidents, and maintain audit and operational records.
• Send necessary service communications, such as account verification, password recovery, invitations, application updates, and notifications.
• Process payments or verify transactions when a paid service is used, and meet applicable legal, accounting, and record-keeping obligations.
• Measure public-site usage with Google Analytics only if the production analytics feature is configured and you have opted in. Account pages and personal information are excluded from analytics events.

6. Legal grounds

Where applicable law requires a legal basis, the basis depends on the activity and may include providing a service you requested or an organization contracted for; your consent for a specific optional disclosure or optional analytics; legitimate interests in platform security, service integrity, and prevention of abuse; and compliance with a legal obligation. Where an organization controls a recruitment activity, that organization is responsible for identifying and communicating its legal basis for that activity.

You can withdraw consent for optional processing at any time. Withdrawal does not make prior processing unlawful and does not undo a disclosure already made to a recipient.

7. How information is shared

• With the organization receiving an application when you apply to one of its jobs, including the information and files you submit for that application.
• With authorized recruiters only as allowed by the service’s visibility and access controls. Candidate contact details and CV access are restricted and may require a separate candidate consent and an active organization access grant.
• With assessment authors, assigned reviewers, and authorized administrators to deliver, score, review, support, and secure an assessment. Public badge or verification pages show only the information presented on that share page; a share link may be accessible to anyone who receives it.
• With service providers that support hosting, database operations, private file storage, transactional email, payment processing, security, or analytics. Their access is limited to providing their services, subject to their terms and our configuration.
• With an organization or endpoint you choose to connect through an integration, API, or webhook, based on that organization’s configuration and your interaction with the service.
• When required by law or valid legal process, or when necessary to protect people, enforce agreements, investigate misuse, or protect the service. We do not sell personal information for money or use candidate information for third-party advertising.

8. Candidate visibility and consent

A candidate’s discoverability depends on profile eligibility and visibility settings. Search and roster views may show limited or redacted information. We use access controls to restrict direct contact details and original CVs. When the service asks for consent to share that information with a recruiter, the request identifies the organization and context; access is limited to the approved scope and may end if the consent or access grant expires or is revoked.

When you submit an application, the information you choose to submit is provided to the organization recruiting for that role. When you publish or share a badge or verification link, treat the information shown on that page as shareable by anyone who receives the link.

9. Service providers and international transfers

The service is configured to use hosting and database infrastructure, S3-compatible private file storage, and an SMTP email provider. Organization payments are handled internally as a wallet funded by manually-reviewed bank-transfer receipts — no third-party payment processor is used. Google Analytics is used only when enabled for the production site and after opt-in. Recruiter-configured integrations may send information to the endpoints selected by that recruiter. The specific providers and data locations can vary with deployment configuration.

Some providers may process information outside your country. Where cross-border transfer rules apply, we will use a transfer mechanism and safeguards required by applicable law. Contact support@evalynq.com to request information about providers or transfer safeguards relevant to your account or organization.

10. Retention

We keep information for as long as needed to provide the service, maintain an account or organization relationship, preserve assessment and application records, protect service integrity, resolve disputes, and meet legal or accounting requirements. Retention depends on the data type, the organization’s instructions, applicable assessment arrangements, and legal obligations. Replacing or removing a CV can deactivate or delete its stored file while related records may remain for audit or application-history purposes.

There is not a single retention period that applies to every record. If you request deletion, we will review the request and delete or restrict information where required and technically appropriate; we may retain information that must be kept for legal, security, dispute-resolution, or contractual reasons. Contact us if you need the retention basis for a specific record.

11. Security

We use safeguards implemented in the service that include password hashing, database-backed sessions, role-based authorization, private file storage, short-lived signed download links, access logging for sensitive file operations, and rate limiting. No online service can guarantee perfect security. Please use a unique password, protect your account, and notify us promptly if you suspect unauthorized access.

12. Your choices and privacy rights

Depending on the law that applies to you, you may have rights to be informed, access or receive a copy of information, correct inaccurate information, request deletion, object to or restrict certain processing, withdraw consent, or complain to a data protection authority. Rights and exceptions vary by jurisdiction and by whether Evalynq or an organization controls the relevant processing.

You can update many profile details in your account and manage optional analytics preferences using the privacy choices control on the website. For other requests, email support@evalynq.com with the subject “Privacy request” and tell us which account or processing activity is involved. We may ask for information needed to verify your identity. If an organization is the controller for a recruitment record, we may refer your request to that organization and assist it in responding.

In Kenya, you may also contact the Office of the Data Protection Commissioner. If the GDPR applies to a processing activity, you may have additional rights under that law, including the right to complain to a supervisory authority.

Official information: Kenya ODPC data-subject rights · EU General Data Protection Regulation.

13. Cookies, local storage, and analytics

We use an essential first-party, HTTP-only session cookie to keep you signed in. It expires after up to 30 days, is configured as Secure in production, and uses SameSite protection. The website also stores your optional analytics choice in browser local storage until you change it. If Google Analytics is enabled in production, its script is loaded only after you opt in; you can later change your choice using “Privacy choices.” If the analytics configuration is absent, analytics remains disabled.

Your browser may also create ordinary technical storage required by the platform or its hosting provider. You can control cookies and local storage through your browser, though blocking the session cookie prevents sign-in from working.

14. Children

The service is designed for working-age job seekers and organization staff, and is not directed to children. Do not create an account if you are not legally able to enter into the relevant agreement in your location. If you believe a child’s information has been submitted to the service, contact us so we can review it.

15. Updates and contact

We may revise this policy as the service or applicable requirements change. We will update the date below and provide additional notice for material changes where appropriate. The updated policy applies from its stated effective date.

Privacy contact: support@evalynq.com. Please do not email passwords, authentication links, or sensitive identity documents unless we specifically request them through a secure process.