Data processing agreement

This agreement is entered into between the customer (“the controller”) and Volodymyr Terekhov (trading as Kira-AI) (“Kira-AI”, “the processor”), and forms part of the Terms of service. It applies to the processing of candidate personal data by Kira-AI on the controller’s behalf, and it reflects Art. 28 GDPR.

Kira-AI acts as a processor for candidate personal data. Kira-AI is an independent controller for the customer’s own account, billing and security records; that processing is described in the Privacy policy and is outside this agreement.

Where this agreement conflicts with the terms of service on the handling of candidate personal data, this agreement prevails.

Subject matter. Conducting and recording candidate voice interviews, and producing transcripts and scorecards.

Nature of the processing. Collecting, recording and storing interview data; transcribing and assessing answers against the customer’s criteria; providing results to authorised users; and deleting data on instruction.

Purpose. Screening applicants for roles the controller is recruiting for. For no other purpose.

Duration. For as long as the controller holds a workspace, and thereafter until the data is deleted under clause 12. Candidate data has no automatic expiry; it is retained until the controller instructs deletion.

Data subjects. Candidates and applicants invited to interview by the controller. Incidentally, any individual a candidate names while speaking.

Special categories. Kira-AI does not solicit special-category data. The interviewer is instructed never to elicit or infer protected characteristics, and the assessment model is prohibited from inferring or mentioning personality, emotion, mood, confidence, culture fit or any protected characteristic. A candidate may nonetheless volunteer such information in speech, and it would then be present in the recording and transcript. The controller must not configure criteria that call for it.

Kira-AI processes candidate personal data only on the controller’s documented instructions, which comprise this agreement, the terms of service, and the controller’s configuration and use of the product — the roles it creates, the criteria it sets, the candidates it invites, and the requests it makes to us.

Kira-AI does not use candidate personal data for its own purposes, does not sell it, and does not use it to train or fine-tune models.

If Kira-AI is required by law to process data beyond the controller’s instructions, it will inform the controller before doing so unless the law prohibits it. Kira-AI will tell the controller if, in its opinion, an instruction infringes data protection law.

Kira-AI ensures that people authorised to process candidate personal data are bound by an obligation of confidentiality, and limits access to those who need it to operate and support the service.

Access by Kira-AI staff is restricted and logged. Access logs are retained for 24 months. Listening to interview recordings requires separate, time-limited authorisation.

Kira-AI implements the following technical and organisational security measures.

Encryption

Data is encrypted in transit. Invitation tokens, one-time codes and API secrets are stored only as hashes. The reference to the AI provider session and candidate details held in the outbound email queue are encrypted at rest.

The controller gives general authorisation for Kira-AI to engage the sub-processors below. Each is bound by data protection terms no less protective than this agreement, and Kira-AI remains liable for their performance.

The payment provider (Stripe) receives the controller’s own billing details and no candidate personal data, so it is not a sub-processor for the purposes of this agreement.

The same is true of the support chat (Crisp IM SAS, France, hosted in the EU). It receives the messages and contact details of the workspace members who write to us; no candidate personal data is routed to it by Kira-AI, and it plays no part in running an interview, so it is not a sub-processor for the purposes of this agreement. What a member types into a support conversation is the member’s own choice, and candidate details do not belong there. It is described in the Cookie policy.

Google Analytics is optional on the public website and logged-in recruiter pages after separate consent. It does not run on candidate or interview pages and receives no candidate personal data, so it is not a sub-processor under this agreement. There is no advertising or session-replay provider, and no separate speech-to-text vendor.

Changes

We will email you at least 30 days before adding or replacing a provider that processes your candidate data. You can raise any data protection concerns during that time. If we cannot resolve them, you can cancel the affected service at no extra charge.

Our interview database and audio storage are located in the EU.

Google’s Gemini API processes interview audio, transcripts and assessment prompts. This processing may take place outside the European Economic Area (EEA).

Our application is hosted in Frankfurt, while our hosting provider may route requests through other countries.

Resend stores email data, including recipient addresses and message content, in the United States.

We will transfer personal data outside the EEA only where permitted by applicable data protection law, using an applicable adequacy decision or appropriate safeguards, such as the European Commission’s standard contractual clauses.

Kira-AI assists the controller in responding to requests from candidates to exercise their rights, taking into account the nature of the processing.

If a candidate contacts us about their data, we will direct them to you and notify you promptly.

For help with requests to access, copy, correct, restrict or delete candidate data, email support@getkira.com. We verify each request and act on your instructions.

If we become aware of a personal data breach affecting your candidate data, we will notify you without undue delay. We will explain what happened, the data and people affected, the likely consequences and the steps taken, sharing updates as more information becomes available.

We will help you meet your notification obligations. You are responsible for notifying regulators and affected candidates where required.

You are responsible for carrying out any required data protection impact assessment. We will provide relevant information available to us to help with your assessment and any required consultation with a data protection regulator.

We will provide information needed to demonstrate our compliance with this agreement and Article 28 GDPR, and cooperate with audits or inspections by you or your appointed auditor.

Audits require reasonable notice and take place during business hours, with confidentiality and other customers’ data protected. They are limited to once a year unless a regulator requires otherwise or a data breach occurs. Where documents and written answers adequately address your request, we may provide those instead.

A workspace owner can request account and workspace deletion together in Kira-AI Settings. A member deleting their personal account does not delete the workspace. Cancelling a subscription alone does not delete data.

On termination of the service, and at the controller’s choice, Kira-AI deletes or returns all candidate personal data and deletes existing copies, unless law requires it to be kept.

We confirm removal from Kira-AI’s active database and file storage. Provider security records and backup copies may remain for the periods in our privacy policy. We keep pseudonymous deletion records for 24 months to evidence deletion and prevent deleted data returning after a backup restore, and retain billing and usage totals without links to individual candidates.

Absent an instruction, candidate data is retained rather than deleted — there is no automatic expiry. Deciding a retention period, and instructing us to act on it, is the controller’s decision.

To request deletion of candidate data, email support@getkira.com. We will complete your request within 30 days and confirm when it is done, unless we are legally required to retain specific data.

To request a copy of your candidate data, email support@getkira.com. We will confirm your request and agree with you how the data will be provided.

This agreement applies when you accept our Terms of Service and remains in effect while we process candidate personal data for you. The liability limits in our Terms of Service also apply to this agreement. This agreement is governed by Spanish law.

For a signed copy or questions about data protection, email support@getkira.com.

Kira-AI is operated by Volodymyr Terekhov. Our postal address is in the Terms of Service. Contact: support@getkira.com.