Canonical: [https://getkira.com/legal/privacy](https://getkira.com/legal/privacy)

For recruiters

# Privacy policy

How Kira-AI collects, uses, stores and shares your personal data, and how you can exercise your privacy rights.

Last updated

13 October 2026

Applies to

getkira.com and the Kira-AI app

Contents▾

1.  [01What this covers](https://getkira.com/legal/privacy#scope)
2.  [02Controller and processor](https://getkira.com/legal/privacy#roles)
3.  [03Your account data](https://getkira.com/legal/privacy#account-data)
4.  [04Candidate data](https://getkira.com/legal/privacy#candidate-data)
5.  [05Why we use personal data and our legal basis](https://getkira.com/legal/privacy#purposes)
6.  [06Optional platform-review invitations](https://getkira.com/legal/privacy#platform-review-invitations)
7.  [07How long we keep it](https://getkira.com/legal/privacy#retention)
8.  [08Who else processes the data](https://getkira.com/legal/privacy#subprocessors)
9.  [09Data locations and international transfers](https://getkira.com/legal/privacy#location)
10.  [10Automated decision-making](https://getkira.com/legal/privacy#automated-decisions)
11.  [11Security](https://getkira.com/legal/privacy#security)
12.  [12Your rights](https://getkira.com/legal/privacy#rights)
13.  [13Changes and contact](https://getkira.com/legal/privacy#changes)

01

## What this covers

This policy explains how Kira-AI (“we”) handles personal data on our website, in our recruiter application and during AI voice interviews.

-   **Recruiters and their colleagues** — people who hold an account with us. For your account data we are the controller.
-   **Candidates** — people invited to an interview by a company that uses Kira-AI. For candidate interview data the employer is the controller and we act on their instructions. For information about your interview data and rights, read our [Candidate privacy notice](https://getkira.com/legal/candidate-privacy).

02

## Controller and processor

**We are the controller** for the data we need in order to run a business: your account and profile, your workspace and its settings, team membership and invitations, billing and subscription records, transactional email we send you, support correspondence, and the security and audit records described below.

**We are a processor** for everything that belongs to a hiring process: candidates, their interviews, recordings, transcripts, scorecards, and the notes recruiters write about them. The customer decides which roles to advertise, whom to invite, what to ask, how candidates are assessed and what happens next. We process that data only to provide the service, on the customer’s documented instructions.

If a candidate separately requests a platform-review invitation, Kira-AI acts as controller only for the limited contact and consent data used for that request.

The processor terms are set out separately in our [Data processing agreement](https://getkira.com/legal/dpa).

03

## Your account data

We collect the following information to provide and manage your account:

-   **Identity and login** — email address, display name, an optional profile photo, interface language, and the authentication records held by our database provider (password hash, login sessions, and that provider’s own security log, which does record IP addresses).
-   **Workspace** — company name, logo, brand colour, client names and company information you provide to guide interviews.
-   **Team** — who is a member, who owns the workspace, invitations you have sent (email address, a hashed invitation token, expiry) and when people joined or were removed.
-   **Connected AI apps** — which app you connected, when you approved it, and the authorization records needed to keep the connection working.
-   **Billing** — your subscription, plan and usage counts. Card details are handled by our payment provider and never reach our servers.
-   **Email we send you** — recipient address, message type, template and delivery reference.

When you create a workspace, we also record the campaign labels (UTM tags), referring website and first page that brought you to us, based on our legitimate interest in learning which campaigns work; no cookie is used for this.

### The public demo

If you try the demo, we collect your verified email address, product-updates preference, and the interview recording and transcript. Kira-AI is responsible for this data. Demo interviews are not scored or shared with hiring companies. We send product updates only if you opt in. We also record the campaign labels (UTM tags), referring website and first page that brought you to the demo, on the same legitimate-interest basis and without a cookie. To request deletion, email [support@getkira.com](mailto:support@getkira.com).

### What we do not collect

We use a hashed version of your IP address to limit repeated requests. These security records are kept for 24 hours. We do not record browser or device fingerprints, and do not derive your location from those product records. Optional measurement starts only after explicit consent. Google Analytics then measures the public website and logged-in recruiter app; app measurement sends route templates rather than record identifiers or page titles. It never measures candidate, interview, public-demo, public-careers, login, onboarding or legal pages. We may also retain a Google click identifier and source tags for up to 90 days and send consented workspace signup and first-payment outcomes to Google Ads. We send no email, phone number, candidate data or interview content for this purpose. No Google Ads browser tag, remarketing, ad personalisation or Google Signals are enabled. The support chat also runs in your browser, which receives your IP address. Chat cookies keep your conversation available when you open the chat — see [Cookie policy](https://getkira.com/legal/cookies).

Embedded help and blog videos use YouTube’s privacy-enhanced player, which connects to YouTube when the page opens. Google then receives your IP address and may use cookies or browser storage to provide playback. The video does not allow Kira-AI advertising measurement or change your cookie choice.

Our hosting, storage and email providers also keep infrastructure logs that may include IP addresses.

04

## Candidate data

We process the following candidate data on behalf of the hiring company:

-   **Identity** — name (optional), email address, and an internal reference number.
-   **Invitation and consent** — the invitation record, a hashed access token and a hashed one-time verification code, plus the exact version, language and timestamp of the consent the candidate gave.
-   **The interview** — start, activity and completion timestamps, the interview language, which planned questions were answered or skipped, and an encrypted reference to the AI provider’s session.
-   **Audio** — Separate audio recordings of the candidate and AI interviewer. We do not record video or request camera access.
-   **Transcript** — The interview text, including who spoke and when.
-   **Scorecard** — scores for each assessment criterion, explanations, supporting transcript quotes, strengths, gaps and relevant factual information. We also record the model and prompt version used to produce it.
-   **Human input** — Recruiter ratings, notes and comments, recruitment stage and any recorded rejection reason.
-   **Candidate feedback** — an optional star rating and free-text comment about the interview experience.

Kira-AI does not accept CV or document uploads.

05

## Why we use personal data and our legal basis

| What | Why | Legal basis |
| --- | --- | --- |
| Account, workspace, team | To provide the service you signed up for | Performance of a contract — Art. 6(1)(b) |
| Billing and usage counts | To calculate usage and issue invoices | Contract, and legal obligation for tax records — Art. 6(1)(b), 6(1)(c) |
| Transactional email | To send invitations, verification codes and account notices | Contract — Art. 6(1)(b) |
| Security, rate limiting, audit records | To prevent misuse and keep records of access | Legitimate interests — Art. 6(1)(f) |
| Candidate interviews and scorecards | To screen applicants for the hiring company | Determined by the hiring company as controller |
| Optional platform-review invitations | To send the Trustpilot invitation you request | Consent, Art. 6(1)(a). |
| Support access by our staff | To investigate problems at the customer’s request and record staff access | Legitimate interests, and the DPA — Art. 6(1)(f) |

06

## Optional platform-review invitations

If you request a review invitation, Kira-AI acts as controller for that request and relies on your consent. We share your verified email address and a review reference with Trustpilot so it can send you an invitation. We do not share your interview recording, transcript, assessment, hiring outcome or hiring-company details.

We keep a limited consent and invitation record to fulfil your request and prevent duplicate invitations. You can withdraw consent or request deletion by contacting [support@getkira.com](mailto:support@getkira.com). This cannot recall an email already sent. Trustpilot handles invitation data on our behalf and separately controls any account or public review you create under its [Privacy Policy](https://corporate.trustpilot.com/legal/for-reviewers/privacy-policy-end-user/jun-2026).

07

## How long we keep it

Recordings, transcripts and scorecards are kept until deleted. They do not expire automatically. The hiring company is responsible for deciding how long to retain candidate interview data.

How long we keep different types of data:

| Data | Kept for |
| --- | --- |
| Recordings, transcripts, scorecards, candidate records, recruiter notes | Until deleted. No automatic expiry. |
| Staff access records | 24 months |
| Deletion records | 24 months |
| Delivered or failed transactional email records | 30 days |
| Review-invitation and consent records | Until you request their deletion or the linked candidate record is deleted. |
| Invitations that were never linked to a candidate | 30 days |
| Rate-limit counters (hashed IP) | 24 hours |
| Contact details on unused prospect invitations | 90 days |
| Unmatched payment-provider webhook events | 30 days |

After deletion, we retain pseudonymous deletion records for 24 months and transactional email delivery records for 30 days. Under our providers’ standard terms, content processed by Gemini may remain in Google’s abuse-monitoring records for 55 days; Resend retains email and logs for 30 days and backups for 7 days. These retained copies are distinct from Kira-AI’s active database and file storage. Lawful billing and legal retention also applies.

08

## Who else processes the data

Kira-AI is built on a small number of named providers. This is the complete list of parties that receive personal data, and what each one receives.

| Provider | What it processes | Where |
| --- | --- | --- |
| Google (Gemini API) | Live interview audio in both directions, live transcription, the interview plan, the transcript and criteria for scoring, and recruiter-entered role text for drafting | See “Where the data lives” below — this is the open item |
| Supabase | The database and authentication: candidate records, transcripts, scorecards, recruiter accounts and notes | EU — Frankfurt |
| Cloudflare (R2) | Interview audio files, workspace logos, and the deletion ledger | EU-jurisdiction storage, enforced at start-up |
| Fly.io | The voice relay and background workers. Audio passes through memory only and is never written to disk | EU — Amsterdam |
| Vercel | Hosting for the website, the recruiter app and the admin console — all web traffic passes through it | See “Where the data lives” below |
| Resend | Transactional email: recipient address and message content | United States |
| Trustpilot | Your email address and a review reference, for the invitation you request | May involve international transfers under Trustpilot’s [Data Processing Agreement](https://corporate.trustpilot.com/legal/for-businesses/data-processing-agreement/oct-2026). |
| Stripe | Subscriptions and payments. Receives billing contact details only, never candidate data | US, under standard contractual clauses |
| Crisp | The support chat on this website and on the logged-in pages of the app: your IP address, your messages, and — if you are logged in and open the chat — your name, email address and workspace name. We never send it interview recordings, transcripts or scorecards | EU — messages in the Netherlands, plug-in data in Germany; Crisp IM SAS is French |
| Google | Optional Google Analytics 4 on the public Kira-AI website and logged-in recruiter app, plus consented workspace signup and first-payment measurement for Google Ads. We send click identifiers and business outcomes, never candidate or interview data, email addresses or phone numbers. Advertising browser storage, remarketing, ad personalisation and Google Signals are disabled | Google may process Analytics data outside the EU; see Google’s [data-processing terms and safeguards](https://business.safety.google/adsprocessorterms/) |

Trustpilot may retain invitation data for up to two years, unless we request earlier deletion. Public reviews are handled separately under Trustpilot’s [Privacy Policy](https://corporate.trustpilot.com/legal/for-reviewers/privacy-policy-end-user/jun-2026).

Optional Google measurement does not run on candidate or interview pages and receives no candidate or interview content. Google Ads receives only the consented click and business-outcome data described above. There is no advertising browser tag, remarketing or session-replay provider, and no separate speech-to-text vendor: transcription is produced by the same model that conducts the interview.

09

## Data locations and international transfers

Our interview database and audio storage are located in the EU.

Google’s Gemini API processes interview audio, transcripts and assessment prompts. This processing may take place outside the European Economic Area (EEA).

Our application is hosted in Frankfurt, while our hosting provider may route requests through other countries.

Resend stores email data, including recipient addresses and message content, in the United States.

We will transfer personal data outside the EEA only where permitted by applicable data protection law, using an applicable adequacy decision or appropriate safeguards, such as the European Commission’s standard contractual clauses.

10

## Automated decision-making

Kira-AI does not make hiring decisions. This is not a positioning statement; it is how the system is built, and it was verified against the code before this page was written.

-   The model produces evidence, not verdicts. It is instructed never to recommend hiring, rejecting, advancing or ranking anyone, and never to state an overall judgement. It returns per-criterion scores with written rationale and verbatim quotes, must-have outcomes, and short strength and gap bullets.
-   The overall band shown on a scorecard is calculated by our own code as the arithmetic mean of those criterion scores, with each scored criterion counting equally. It is a triage label. It changes nothing about the candidate’s status.
-   There is no automatic rejection, no automatic advancement, and no score threshold anywhere that changes a candidate’s state. Moving a candidate — and in particular recording a hire or a rejection — can only be done by a logged-in human member of the workspace, and it is attributed to that person in the workspace activity feed. That feed is not an audit log — see “How long we keep it”. The scoring service is technically incapable of writing to a candidate’s status; that permission does not exist for it.
-   The model is explicitly prohibited from inferring or mentioning personality, character, emotion, mood, attitude, confidence, nervousness, culture fit, or any protected characteristic, and from reading meaning into pauses, hesitation, accent, grammar or vocabulary unless a criterion scores language proficiency. There is no emotion, sentiment or voice-analysis capability in the product, and the scoring step is given the text of the interview, not the audio.

On that basis we do not consider the product to make decisions producing legal or similarly significant effects within the meaning of Art. 22 GDPR. The employer remains responsible for the decision it takes, and for telling candidates that AI is used in its process.

11

## Security

We protect personal data through:

-   Access controls that keep each workspace’s data separate.
-   Private audio storage and time-limited playback access.
-   Encryption and hashing for sensitive identifiers and access codes.
-   Audio processing that does not write audio to the relay server’s disk or include interview content in its logs.
-   Restricted, logged staff access to customer data, with access logs retained for 24 months.
-   Deletion records and checks confirming that stored files have been removed.

12

## Your rights

You can request account deletion from your Profile in Kira-AI. If you own a workspace, this also deletes the workspace and ends its subscription. Other members keep their personal accounts. If you want your team to keep the workspace, contact support before deleting your account.

If you hold an account with us, you have the rights given by the GDPR: access, rectification, erasure, restriction, portability, objection, and the right to withdraw consent where processing rests on it. Write to [support@getkira.com](mailto:support@getkira.com) and we will respond within one month.

If you are a candidate, contact the company that invited you to exercise your privacy rights. You can also email us, and we will forward your request to that company and help carry it out on their instructions. See our [Candidate privacy notice](https://getkira.com/legal/candidate-privacy).

You can complain to a data protection authority, including the [Spanish Data Protection Agency (AEPD)](https://www.aepd.es/preguntas-frecuentes/13-reclamaciones), or the authority where you live or work.

13

## Changes and contact

We will post material changes to this policy here and, where the change affects how customer data is handled, notify workspace owners by email.

Kira-AI is operated by Volodymyr Terekhov. Our postal address is in the [Terms of Service](https://getkira.com/legal/terms#operator). Contact: [support@getkira.com](mailto:support@getkira.com).