1. Who we are
Tracy AI Interviewer is an AI interviewer made by Qode. It runs two-way video interviews for organisations, follows up on the answers, and gives the organisation a recording, a transcript and a written assessment. We are committed to protecting personal data and to processing it lawfully, fairly and transparently.
This Privacy Policy explains how Olik Pte Ltd, Company Registration Number: 202103692E ("Qode", "we", "us") collects, uses, discloses, transfers and protects personal data when you use the Tracy AI Interviewer websites, applications and services, including its connectors for AI assistants (the "Services").
1.1 Our compliance
We design and operate the Services in compliance with applicable data protection, privacy and artificial intelligence laws, including the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the EU Artificial Intelligence Act, Vietnam's Law on Personal Data Protection and Decree 13/2023/ND-CP, Vietnam's Law on Artificial Intelligence, and Singapore's Personal Data Protection Act. Our information security programme is independently examined against the AICPA SOC 2 Type II standard.
1.2 Our role: controller or processor
Our role depends on the context:
- Controller. We act as controller for personal data of website visitors, prospective customers, and account holders, and for data we use to improve and secure the Services.
- Processor / service provider. We act as processor on behalf of our customers (employers, recruiting teams and other organisations that run interviews) for interviewee data that customers upload, import or collect through interviews within their hiring and interview workflows. That processing is governed by our Data Processing Agreement and the customer's own privacy notice.
1.3 Contact and accountability
- Data protection and privacy enquiries: hello@tracyinterview.ai
2. Scope
This Policy covers: (a) Users as individuals who create accounts or use the Services on behalf of a customer; (b) Interviewees as candidates and other individuals who are invited to, or take, an interview through the Services; (c) Website visitors; and (d) Business contacts of prospective and existing customers and vendors.
Where our customer is the controller of interviewee data, the customer's privacy notice applies in addition to this Policy, and interviewees should direct requests concerning that data to the relevant customer; we will assist the customer in responding as required by law and our Data Processing Agreement.
3. Personal data we collect
| Category | Examples |
|---|---|
| Identity and contact data | Name, email address, phone number, employer, job title, postal address, professional profile links. |
| Interviewee professional data | CVs/resumes, work history, portfolio links, answers given in the interview, assessment and screening outputs. |
| Interview recordings and signals | Audio and video of both sides of the interview, a transcript with timestamps, and integrity signals captured during the interview (for example the face in frame, where the interviewee is looking, response timing, tab changes, leaving fullscreen and an external screen). Interviewees are told about the recording before the interview starts. |
| Account and transaction data | Login credentials, credit purchases and billing details, support requests, communication history. |
| Usage and device data | Interview setup and invitation activity, log data, IP address, browser and device identifiers, approximate location derived from IP, cookie data. |
| AI interaction data | Inputs and outputs exchanged with Tracy and other AI features, and related logs kept for quality, safety and audit purposes. |
3.1 Sources of personal data
- Directly from you (account registration, uploads, communications, and the interviews you take or run through the Services).
- From our customers, when they upload or import interviewee information into the Services, such as a job description, a CV or an invitation list.
- From tools you connect, such as an AI assistant or an applicant tracking system linked through its own connector, when you ask them to share data with the Services.
- Automatically, through cookies and similar technologies when you use the Services.
3.2 Sensitive data
The Services are not designed to collect sensitive or special category data (e.g. health, racial or ethnic origin, religious beliefs, trade union membership). We instruct customers not to upload such data unless they have a lawful basis. Where sensitive personal data is nonetheless processed, we apply the heightened protections required by applicable law, including specific notification to the data subject where required.
4. Purposes of processing and legal bases
We process personal data on the legal bases recognised by applicable law, including your consent, performance of a contract, compliance with legal obligations, and our legitimate interests (balanced against your rights, with the ability to object). For individuals in Vietnam, we rely primarily on your consent unless another statutory ground applies.
| Purpose | Data categories and basis |
|---|---|
| Providing the Services: setting up and running interviews, follow-up questions, transcripts, assessments and integrity signals | Identity, interviewee professional, interview recording, account and AI interaction data: contract performance. |
| Operating and improving AI features, including Tracy | Usage, AI interaction and interviewee professional data: legitimate interests; consent where required. |
| Communications: interview invitations, reminders, service updates, notifications, responses to enquiries | Identity and account data: contract performance; legitimate interests. |
| Marketing (with opt-in / opt-out as required by local law) | Identity and usage data: consent; legitimate interests for business contacts where permitted. |
| Security, fraud prevention, abuse detection, audit logging | Usage, device and account data: legitimate interests; legal obligation. |
| Compliance with law, regulators and courts; establishing or defending legal claims | As relevant: legal obligation; legitimate interests. |
| Analytics and product improvement | Usage and device data (aggregated or pseudonymised where possible): legitimate interests; consent for non-essential cookies. |
We do not sell personal data, and we do not process personal data for purposes incompatible with those described above without informing you and, where required, obtaining your consent.
5. Artificial intelligence and automated decision-making
5.1 Transparency: you are interacting with AI
Tracy is an artificial intelligence system. Whenever you interact with Tracy or another automated conversational feature, we identify it clearly as AI. AI-generated content produced through the Services (e.g. interview summaries and assessments) is marked or labelled, including in machine-readable form, where the law requires.
5.2 How AI is used in interviews through Tracy
- Screening support, such as reading CVs to tailor questions, extracting skills and generating interview questions;
- Conducting the interview, including asking follow-up questions based on the interviewee's answers;
- Writing an assessment of each answer, with the reasoning behind it, for a person to review;
- Workflow automation, such as interview invitations, reminders and interviewee communications.
We recognise that AI used in recruitment is treated as high-risk under applicable AI laws. We design and operate these features accordingly, including risk management, data governance and quality controls, technical documentation, logging, accuracy and bias testing, and effective human oversight, and we support our customers in meeting their own obligations as deployers of these features.
5.3 Human oversight
Tracy's AI features are decision-support tools. The Services do not make final hiring, rejection or other decisions producing legal or similarly significant effects about interviewees on a solely automated basis. Recruiters and hiring managers review and remain responsible for outcomes. Where a customer configures processing that involves automated decision-making with significant effects, the customer is responsible for ensuring a lawful basis, meaningful human involvement and the safeguards required by law, and Qode provides the contractual and technical means to do so.
5.4 Your rights in relation to AI
- To be informed when you are interacting with an AI system and when content is AI-generated;
- To obtain meaningful information about the logic involved in automated processing that significantly affects you, and its significance and envisaged consequences;
- To request human review of, express your point of view on, and contest any decision producing legal or similarly significant effects;
- To object to processing based on legitimate interests, including profiling.
6. How we share personal data
- The organisation that invited you. Your interview recording, transcript and assessment are made available to the customer that invited you to the interview, for their recruitment or interview purposes.
- Service providers (sub-processors). Hosting, cloud infrastructure, AI model providers, analytics, communications, payment and customer-support providers, bound by written contracts imposing confidentiality, security and data protection obligations consistent with this Policy and applicable law. A current sub-processor list is available on request.
- Professional advisers (lawyers, auditors, insurers) under confidentiality obligations, including auditors performing our SOC 2 examinations.
- Authorities and legal process. Where required by applicable law or a valid, binding request by competent public authorities, we disclose the minimum necessary and, where lawful, notify affected customers.
- Corporate transactions. In a merger, acquisition, financing or sale of assets, subject to confidentiality and continuity of protections; we will notify you of any change of controller.
We do not sell or rent personal data, and we do not share it with third parties for their own direct marketing.
7. International data transfers
We may transfer personal data to countries other than the one in which you are located, including, but not limited to, Singapore, the United States, Vietnam and Indonesia. Where we do, we apply the safeguards required by the law of the originating jurisdiction, such as adequacy decisions, approved standard contractual clauses or equivalent transfer mechanisms, transfer impact assessments, regulatory filings or notifications where required, and supplementary technical measures such as encryption in transit and at rest and strict access controls. You may request a copy of the relevant safeguards (redacted where necessary) via the contacts in Section 1.3.
8. Data retention
We retain personal data only as long as necessary for the purposes described in this Policy, after which it is deleted or irreversibly anonymised. Indicative periods:
| Data | Indicative retention |
|---|---|
| Account data | Life of the account + 90 days after closure, except as needed for legal claims or statutory record-keeping. |
| Customer-managed interview data, including recordings, transcripts and assessments (Qode as processor) | Per customer instructions and the Data Processing Agreement; deleted or returned on termination within 60 days. |
| AI interaction logs | 12 months, for security, quality and audit purposes. |
| Billing and tax records | As required by applicable tax and accounting law. |
| Security logs | 12 months. |
Where applicable law sets shorter deadlines, we honour them: in particular, when individuals in Vietnam withdraw consent or validly request deletion, we action the request within 72 hours of receipt, subject to statutory exceptions.
9. Data security and SOC 2
We maintain a written information security programme aligned with the AICPA Trust Services Criteria. Qode undergoes an independent SOC 2 Type II examination covering the Security, Availability and Confidentiality criteria over a rolling audit period; the resulting report is available to customers under NDA. Our measures include:
- Encryption of personal data in transit (TLS 1.2+) and at rest;
- Role-based access controls, least-privilege provisioning, multi-factor authentication and periodic access reviews;
- Logging and continuous monitoring, vulnerability management and penetration testing;
- Secure software development lifecycle, change management and environment segregation;
- Vendor/sub-processor risk assessments and contractual security obligations;
- Business continuity, disaster recovery and tested backup procedures;
- Personnel confidentiality undertakings, background screening where lawful, and security training.
9.1 Personal data breach notification
We maintain a documented incident response plan. Where a personal data breach occurs, we will notify the competent regulators and, where required, affected individuals without undue delay and within the timeframes required by applicable law (in most of our jurisdictions, within 72 hours of becoming aware of the breach), and we will notify affected customers without undue delay so they can meet their own obligations.
10. Your rights
Subject to the conditions and exemptions in applicable law, you have the right to:
- Be informed about how your personal data is processed;
- Access your personal data and receive a copy, including in a portable format;
- Rectify or correct inaccurate or incomplete data;
- Request deletion or erasure of your data;
- Restrict or object to processing, including profiling and direct marketing (which you may opt out of at any time);
- Give, refuse or withdraw consent at any time, without affecting prior processing;
- Not be subject to solely automated decisions with legal or similarly significant effects, except as permitted by law;
- Complain to a regulator, initiate legal proceedings and claim damages for violations as provided by your local law.
10.1 How to exercise your rights
Submit requests to hello@tracyinterview.ai. We may need to verify your identity. We respond within the timeframes set by applicable law, generally within one month, and within shorter statutory deadlines where they apply.
11. Consent and withdrawal
Where we rely on consent, consent is obtained through a clear affirmative act, is specific to each purpose, and is recorded in a form that can be printed or reproduced. Silence or inactivity does not constitute consent. You may withdraw consent at any time via your account settings or by contacting us; withdrawal does not affect the lawfulness of processing before withdrawal. Upon withdrawal, we will cease the relevant processing and confirm within the timeframe required by applicable law.
12. Cookies and similar technologies
We use strictly necessary cookies to operate the Services and, with your consent where required, analytics and functional cookies. You can manage preferences through our cookie banner and your browser settings.
13. Children
The Services are intended for professional use and are not directed at children. We do not knowingly process personal data of anyone under 16 (or the higher age set by applicable law). Where local law requires, processing of a child's personal data is carried out only with the consent of a parent or guardian. If you believe we hold a child's data, contact us and we will delete it.
14. Prohibition on crawling and scraping of our Services
We prohibit the use of any automated system or software (including bots, crawlers and scrapers) to extract data from the Services. This protects the personal data within the Services against unauthorised access and disclosure. Violations may result in suspension, termination and legal action.
15. Changes to this Privacy Policy
We may update this Policy from time to time. We will post the updated version on this page with a revised "Last updated" date and, for material changes, provide reasonable advance notice (e.g. by email or in-product notice) and, where required by law, seek renewed consent.
16. Contact us
Questions about this Policy or our data practices: hello@tracyinterview.ai.