This Privacy Policy describes how Gradogram (“Gradogram,” “we,” “us,” or “our”) processes personal information when you use our websites, applications, and related services (“Services”). For contractual matters, additional terms in your agreement may apply.
1. Who is responsible
Gradogram acts as a data controller for information we collect about visitors and account holders. Where we process personal data on behalf of your employer or organization (for example, candidate records in your tenant), we typically act as a processor under instructions from that organization, which is the controller for that processing.
2. Information we collect
We may collect:
- Account and contact data: name, work email, organization, phone, and authentication identifiers from your identity provider.
- Recruitment and assessment data: candidate profiles, applications, interview and test responses, scores, notes, and communications sent through the platform.
- Technical data: IP address, device and browser type, timestamps, logs, cookies or similar technologies, and security signals.
- Assessment integrity data: To keep assessments fair for everyone, we record integrity signals during an attempt — such as tab switches, paste actions, developer-tool usage, response timing, and the number of concurrent sessions — together with your consent record (the fact and time of consent and the IP address it was given from). Each assessment page is watermarked with your session identifier. We do not use webcam, video, audio, screen or environmental monitoring, and we do not capture any device media. Integrity signals are advisory: they are surfaced to the hiring organization for human review and never automatically change your grade.
- Cookies and similar technologies: we use only strictly necessary cookies that are essential for the Services to function. These are: (a) a session cookie set by our authentication provider to maintain your login session; (b) an OpenID Connect state cookie used during the sign-in flow to prevent cross-site request forgery; and (c) an anti-forgery token cookie that protects form submissions. These cookies do not track you across websites, are not used for advertising, and expire when your session ends or within 24 hours. Because they are strictly necessary for the Services to function, no cookie consent banner is required for them.
- Support and feedback: information you provide when you contact support or participate in surveys.
3. How we use information
We use personal information to:
- Provide, secure, and improve the Services.
- Authenticate users and enforce access controls.
- Operate assessments and produce scores or reports as configured by customers.
- Communicate about the Services, including service and security notices.
- Comply with law and respond to lawful requests.
- Analyze usage in aggregate or de-identified form to understand product usage, unless you opt out where such choice is offered.
4. Legal bases
We process personal information on grounds such as: performance of a contract with you, our legitimate interests (for example, securing our Services and preventing fraud, balanced against your rights), your consent where required, and compliance with legal obligations. You may withdraw consent where processing is consent-based, without affecting prior processing.
5. Your privacy rights
Depending on where you live, you may have the right to access, correct, delete, restrict, or port your personal data, and to object to certain processing. You may also have the right to lodge a complaint with your local data protection authority. To exercise these rights, contact us using the details in the Contact section. We may need to verify your identity before responding.
Where you ask us to delete your data, we execute this as irreversible anonymization: your identifying details are permanently replaced in your candidate record, so that record can no longer identify you to the hiring organization. The separate audit record of the deletion itself is retained as described in the Retention section below and still contains your name; we do not use it to reconstruct your candidate record, and it is deleted at the end of the audit retention period.
6. Automated decision-making and your rights
When your prospective employer uses our assessment features, an artificial intelligence (AI) system analyzes and evaluates your assessment responses against the scoring criteria that the employer has configured, and may flag potential integrity signals for human review. The AI produces scores and written summaries. The significance of this processing is that those AI-generated results inform — but do not determine — the employer’s evaluation of your application: every AI-generated result is reviewed by the hiring organization’s recruitment team, and a human recruiter makes the final hiring decision.
You have the right to request human review of, to express your point of view about, and to contest any AI-assisted result. You can exercise these rights at any time by emailing support@gradogram.com — identify the assessment concerned and describe your request. We will route your request to the hiring organization (the controller for that processing) and support its review. Candidates are informed that AI is used before starting an assessment.
We will acknowledge your request promptly and provide a substantive response within a reasonable time, routing it to the hiring organization, which is the controller for that processing, and supporting its review.
7. Sharing and subprocessors
We share personal information with service providers who assist us (hosting, email, auth, analytics subject to settings, customer support) under contracts that require appropriate protection. A current list of subprocessors is available on request and is included in our Data Processing Agreement where applicable. We may disclose information if required by law or to protect rights, safety, and security. Business transfers (e.g., merger) may involve transferring information under safeguards described in this Policy.
8. International transfers
We may transfer personal data to countries outside your own. Where required, we use appropriate safeguards such as Standard Contractual Clauses or other mechanisms recognized by applicable law.
9. Retention
We retain personal information for as long as needed to provide the Services, fulfil legal obligations, resolve disputes, and enforce agreements.
Assessment and candidate data: unless the hiring organization’s data processing agreement specifies a different period, assessment responses, AI-generated scores and summaries, and related candidate records are retained for the duration of the recruitment process for the role concerned plus twelve (12) months, after which they are deleted or irreversibly anonymized. This default supports the resolution of questions or disputes about a hiring decision; hiring organizations may configure a shorter or longer period in their tenant settings where they have a lawful basis to do so, and candidates may request earlier deletion as described in the privacy rights section above.
Audit records. Separately from candidate and assessment data, we maintain an immutable audit trail recording actions taken in the platform — who did what, to which record, and when. Because these records exist to evidence what happened, we do not alter or delete individual entries, including in response to a deletion request. Entries about an assessment identify the person who acted: where that is you as a candidate, the entry holds your name, the IP address and browser you used, and the session identifier for that attempt; where it is a recruiter, it holds their work email address. Audit entries never contain your assessment answers or the text of any AI-generated feedback — only the action taken, the record it affected, and operational details such as scores, the integrity score for the attempt, timestamps, and the AI model version used.
We keep audit records for six (6) years from the date of the entry, after which they are deleted. We rely on our legitimate interest in establishing, exercising, and defending legal claims — including claims about how a hiring decision was reached — together with record-keeping duties that apply to AI systems used in recruitment. This is a recognized exception to the right to erasure, which means an audit record may outlive the candidate record it refers to, and may be retained after a customer agreement ends. If you believe retaining a particular audit record is not justified in your case, contact us using the details below and we will review it.
10. Security
We implement technical and organizational measures designed to protect personal information appropriate to the risk. No method of transmission or storage is completely secure. In the event of a personal data breach, we will notify affected customers without undue delay, as required by applicable law.
11. Children
Our Services are not directed to children under 16, and we do not knowingly collect their personal information for recruitment purposes in violation of applicable law.
12. Changes to this Policy
We may update this Privacy Policy from time to time. We will post the updated version and revise the “Last updated” date. Material changes may be communicated as described in our Terms of Service or by email where appropriate.
13. Contact
For privacy requests or questions, contact us at privacy@gradogram.com. If we have appointed a data protection officer or representative, their details will be made available on our website.