Data processing agreement

This agreement is entered into between the customer (“the controller”) and ▲Legal entity — VV to supply (“Kira-AI”, “the processor”), and forms part of the terms of service at /legal/terms. It applies to the processing of candidate personal data by Kira-AI on the controller’s behalf, and it reflects Art. 28 GDPR.

Kira-AI acts as a processor for candidate personal data. Kira-AI is an independent controller for the customer’s own account, billing and security records; that processing is described in the privacy policy at /legal/privacy and is outside this agreement.

Where this agreement conflicts with the terms of service on the handling of candidate personal data, this agreement prevails.

Subject matter. Conducting structured, recorded voice interviews with candidates the controller invites, and producing a transcript and an evidence-based scorecard from each interview.

Nature of the processing. Collection by voice conversation; recording; storage; automatic transcription; analysis of the transcript by a large language model against criteria the controller defines; making the results available to the controller’s authorised users; deletion on instruction.

Purpose. Screening applicants for roles the controller is recruiting for. For no other purpose.

Duration. For as long as the controller holds a workspace, and thereafter until the data is deleted under clause 12. Candidate data has no automatic expiry; it is retained until the controller instructs deletion.

Data subjects. Candidates and applicants invited to interview by the controller. Incidentally, any individual a candidate names while speaking.

Special categories. Kira-AI does not solicit special-category data. The interviewer is instructed never to elicit or infer protected characteristics, and the assessment model is prohibited from inferring or mentioning personality, emotion, mood, confidence, culture fit or any protected characteristic. A candidate may nonetheless volunteer such information in speech, and it would then be present in the recording and transcript. The controller must not configure criteria that call for it.

The product accepts no CV, document or file uploads, and stores no phone number, postal address or date of birth.

Kira-AI processes candidate personal data only on the controller’s documented instructions, which comprise this agreement, the terms of service, and the controller’s configuration and use of the product — the roles it creates, the criteria it sets, the candidates it invites, and the requests it makes to us.

Kira-AI does not use candidate personal data for its own purposes, does not sell it, and does not use it to train or fine-tune models.

If Kira-AI is required by law to process data beyond the controller’s instructions, it will inform the controller before doing so unless the law prohibits it. Kira-AI will tell the controller if, in its opinion, an instruction infringes data protection law.

Kira-AI ensures that people authorised to process candidate personal data are bound by an obligation of confidentiality, and limits access to those who need it to operate and support the service.

Access to a controller’s data by Kira-AI staff requires a platform-administrator role and is recorded in a dedicated access log with the operator, the workspace, the operation and the reference for the instruction it was performed under. That log is retained for 24 months. Listening to a candidate recording requires a separate grant that expires after five minutes.

Kira-AI implements the following technical and organisational measures. They are described concretely so the controller can assess them rather than read a list of adjectives.

Tenant isolation

Every table enforces row-level security, and the application connects through narrowly scoped database roles rather than a single privileged account. Access is scoped to the workspace of the authenticated user. Components hold only the permissions they need: the scoring service, for example, has no permission to write to a candidate’s status.

Encryption

Data is encrypted in transit. Invitation tokens, one-time codes and API secrets are stored only as hashes. The reference to the AI provider session and candidate details held in the outbound email queue are encrypted at rest.

Recordings

Audio is stored in private buckets with no public access. Playback is served through Kira-AI’s own servers using a sealed, encrypted, time-limited reference; signed storage URLs are capped at five minutes. The voice relay holds audio in memory and never writes it to disk, and its logs are structurally incapable of carrying prompt or transcript text.

Accountability

Deletion is proved: every erasure writes a signed ledger record and confirms that the stored objects are actually absent before the operation is closed.

What exists beyond that is narrower than an audit log, and this agreement should not be signed on the wider reading. Operators of the internal administration application have their actions logged there, and the customer dashboard carries an activity feed. Neither is a customer-facing, exportable record of every action taken against a candidate, and neither carries a retention rule.

▲Audit log — no customer-facing audit trail exists; scope, retention and whether one is contracted for to be decided ▲Certifications — none held; ISO 27001 / SOC 2 status to confirm ▲Backup, restore and business-continuity detail — VV to supply ▲Penetration testing cadence — VV to supply

The controller gives general authorisation for Kira-AI to engage the sub-processors below. Each is bound by data protection terms no less protective than this agreement, and Kira-AI remains liable for their performance.

The payment provider (Stripe) receives the controller’s own billing details and no candidate personal data, so it is not a sub-processor for the purposes of this agreement.

There is no analytics, tracking or session-replay provider in the product, and no separate speech-to-text vendor.

Changes

Kira-AI will give the controller at least ▲Notice period — VV to supply, 30 days suggested notice before adding or replacing a sub-processor. The controller may object on reasonable data protection grounds within that period; if the objection cannot be resolved, the controller may terminate the affected service without penalty.

Candidate data at rest is held in the EU: the database in Frankfurt, audio in EU-jurisdiction object storage — the service refuses to start if pointed at a non-EU storage endpoint — and the relay and workers in Amsterdam. There is no US replica and no US copy of the recordings.

Two qualifications are disclosed here in full.

The AI model provider

Interview audio, transcripts and assessment prompts are processed by Google’s Gemini models. The system is built to call those models through a European endpoint and refuses, by design, to run a production deployment against any other region. That European path is not yet in service. As deployed today, calls are made to Google’s general API endpoint, which carries no regional processing commitment for this model. Interview audio and transcripts may therefore be processed outside the EEA.

Hosting routing

Application code runs in Frankfurt, but the hosting provider’s routing layer — which refreshes a session cookie and performs redirects — runs in every region it operates. It processes requests in transit only, stores nothing, and logs no content.

Where personal data is transferred outside the EEA, it is transferred under the European Commission’s standard contractual clauses or, where the recipient is certified, the EU–US Data Privacy Framework, together with the supplementary measures identified in a transfer impact assessment. ▲Transfer mechanism per sub-processor, and TIA — for counsel

Kira-AI assists the controller in responding to requests from candidates to exercise their rights, taking into account the nature of the processing.

If a candidate contacts Kira-AI directly, Kira-AI will not respond to the substance of the request but will refer the candidate to the controller and inform the controller without undue delay.

What is available today

• Erasure — implemented. On the controller’s instruction, Kira-AI deletes a candidate’s record, invitation, interview attempts, recordings, transcripts, scorecards, feedback and the controller’s own notes about them, and deletes the stored audio objects, confirming their absence before closing the operation. Deleting a role deletes every candidate under it. Billing counts are retained but stripped of any link to the person, and audit entries are retained with the personal reference removed, so that a deletion cannot itself be used to reconstruct who was deleted. A signed record that the deletion happened — containing a one-way keyed reference, not an identity — is kept for 24 months.
• Access, copy, rectification, restriction and portability — manual. There is no export function in the product. These requests are assembled by Kira-AI’s operations team on the controller’s instruction.

Kira-AI notifies the controller without undue delay after becoming aware of a personal data breach affecting candidate personal data, and in any event within ▲Breach notification window — VV and counsel to set of becoming aware. The notification describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken.

Kira-AI assists the controller with its own notification obligations under Art. 33 and 34 GDPR. Notifying the supervisory authority and the affected candidates is the controller’s responsibility.

Kira-AI provides the controller with the information reasonably needed for a data protection impact assessment and for any prior consultation with a supervisory authority, taking into account the nature of the processing and the information available to Kira-AI.

A DPIA is likely to be required for this processing: it involves systematic evaluation of individuals, voice recording, and the use of an AI system in a recruitment context. Carrying it out is the controller’s obligation.

Kira-AI makes available to the controller the information necessary to demonstrate compliance with Art. 28 GDPR, and allows for and contributes to audits, including inspections, conducted by the controller or an auditor it mandates.

Audits are on reasonable notice, no more than once in any twelve-month period unless required by a supervisory authority or following a breach, during business hours, subject to confidentiality, and conducted so as not to disrupt the service or the data of other customers. Kira-AI may satisfy an audit request by providing documentation and answering a security questionnaire where that reasonably addresses the request.

On termination of the service, and at the controller’s choice, Kira-AI deletes or returns all candidate personal data and deletes existing copies, unless law requires it to be kept.

Deletion covers database records and the stored audio objects, and is confirmed by the deletion-proof mechanism described in clause 09. Retained afterwards: the signed deletion record described above, for 24 months; and billing and usage counts stripped of any link to an individual, for accounting purposes.

Absent an instruction, candidate data is retained rather than deleted — there is no automatic expiry. Deciding a retention period, and instructing us to act on it, is the controller’s decision.

▲Deletion turnaround commitment — VV to set, must be operationally owned ▲Return format for data export — none exists today

This agreement takes effect when the controller accepts the terms of service and remains in force while candidate personal data is processed. Liability under this agreement is subject to the limitations in the terms of service. It is governed by ▲Governing law — VV to supply.

For a countersigned copy, or to raise a data protection question, contact ▲Support email — VV to supply.

▲Legal entity — VV to supply
▲Registered address — VV to supply
▲Data protection officer / Art. 27 representative — confirm whether required