Privacy Policy

This Privacy Policy explains how Peoplesage ("we", "us", or "our") collects, uses, stores, and protects personal data. Peoplesage is a platform for the full employee lifecycle: organizations use it to recruit and hire, and then to manage their employees, including records, documents, attendance, payroll, performance, and training. This policy applies to everyone whose data is on the platform: account owners, administrators, recruiters, hiring managers, line managers, employees who are given access by their employer, candidates, and visitors to our website. By using Peoplesage, you acknowledge the practices described in this policy.

Who is responsible for your data depends on how it came to be on Peoplesage: • Candidate and employee data: the organization that uses Peoplesage to recruit or employ you (the "Customer") decides what data is collected and how it is used. The Customer is the data controller, and Peoplesage acts as its processor, handling that data only on the Customer's instructions • Account, billing, and website data: for the details of the people who sign up for and pay for Peoplesage, and for visitors to our website, Peoplesage is the data controller If you are a candidate or an employee and have a question about your data, your first point of contact is the organization you applied to or work for. We will support them in responding to you.

We collect the following categories of information: Account Information: Name, email address, company name, phone number, job title, and billing details provided during registration. Candidate Data: Resumes, CVs, cover letters, contact information, work history, education, skills, and any other data uploaded by recruiters or submitted by candidates through job application and career portals. Assessment Data: Brain Test answers, Brain Task submissions (including file uploads and GitHub links), scores, and integrity monitoring data (such as tab-switch events). AI Interview Data: Video and audio recordings of interviews conducted by Riya, our AI interviewer, a recording of the screen the candidate shares during the interview, transcripts, typed answers, rubric scores, and summaries. We also collect integrity signals, such as whether the same person remained on camera, the direction of their gaze, how many voices were detected, how many monitors are connected, tab switches, leaving full screen, copy and paste attempts, page reloads, device and network changes, and a session identifier used to detect the interview being open in more than one window. Employee Data: Records for the employees an organization manages on the platform, including profile and contact details, job title, department, manager, contract type and employment dates, employment history, identification and tax reference numbers, salary, pay-cycle, allowance and deduction details, and the bank or payment details used to pay them. Employee Documents: Contracts, identification documents, work permits, certifications, and signed policies, along with their expiry and renewal dates. Attendance and Leave Data: Clock-in and clock-out times, shifts, breaks, overtime, late arrivals, absences, corrections to hours, leave balances, and leave requests and approvals. Payroll Data: Pay runs, gross and net pay, taxes, statutory contributions, loan repayments and other deductions, payslips, and pay history. Performance and Training Data: KPIs, targets, and weighting, progress against targets, review cycles and outcomes, skill assessment results, skill gap analyses, development plans, onboarding progress, and certification records. Usage Data: Login timestamps, feature usage patterns, page views, click events, IP addresses, browser type, and device information. Communication Data: Emails sent and received through the platform, notes, call logs, and messaging history. AI-Generated Data: Candidate evaluation scores, match scores, interview reports, AI-generated job descriptions, candidate submission profiles, HR Copilot responses, and analytics reports.

We use collected information for the following purposes: Recruitment and hiring: • To process AI evaluations across 7 dimensions (technical skills, relevant experience, education, career trajectory, project evidence, role fit, and risk flags) • To conduct, record, transcribe, and score AI interviews, and to flag integrity concerns for a person to review • To run the Skill Veracity program (Brain Tests and Brain Tasks) and generate assessment scores • To power the AI Matching Engine for candidate-to-job scoring • To automate email sequences, follow-ups, interview scheduling, and candidate submissions • To carry a hired candidate's details forward into their employee record, so they are not entered twice Employee management: • To maintain employee records and documents, and to flag documents that are due for renewal • To route leave requests and changes to employee details to the right approver, and to record who approved what • To record attendance, shifts, overtime, and leave, and to flag exceptions for managers to review • To calculate salaries, taxes, and deductions from the rules the organization configures, and to produce payslips • To track KPI targets, run review cycles, and record skill assessments, development plans, onboarding, and certifications • To give each employee access to their own record, leave balance, payslips, and progress Running the platform: • To provide, operate, and maintain the Peoplesage platform, including HR Copilot, analytics dashboards, recruiter scorecards, and reports • To process billing and manage subscription plans • To provide customer support and respond to inquiries • To send platform updates, security alerts, and service-related communications • To improve platform features and user experience through aggregated, anonymized analytics We do not sell personal data, and we do not use candidate or employee data for our own marketing.

Peoplesage enforces mandatory PII anonymization on every AI evaluation of a candidate, on every plan. Before any AI evaluation occurs: • Candidate name, gender, address, and nationality are automatically stripped from the data • 8 built-in fairness rules are active by default • All AI evaluation scores are backed by verbatim quotes from the candidate's CV, interview transcript, or assessment submission, ensuring transparency and auditability This process ensures that AI scoring is based on skills, experience, and qualifications, not on personal characteristics. Because AI interviews are conducted on camera and by voice, the recording itself cannot be anonymized. Interviews are scored against the same rubric for every candidate, and integrity checks are only ever flagged for a person to review. Employee management data, such as pay and attendance, is not anonymized, because it is needed to pay and manage the right person. It is visible only to the people the organization authorizes. AI-generated scores, reports, and suggestions are advisory. Peoplesage does not make hiring, pay, promotion, or dismissal decisions; those are always made by people at the organization using the platform.

We implement industry-standard security measures to protect your data: • All data is encrypted in transit (TLS 1.2+) and at rest (AES-256) • Infrastructure is hosted on secure, SOC 2-compliant cloud providers • Role-based access control (RBAC) ensures that users only access data they are authorized to view • Each employee can see only their own record, payslips, and progress, and never those of other employees • Access to payroll, identification, and bank details is restricted to the roles the organization authorizes • Enterprise plans support SSO/SAML integration for centralized authentication • Audit logs track actions on the platform, including approvals, corrections to hours, and changes to pay runs, for compliance and security monitoring • Regular security assessments and penetration testing are conducted • All data is isolated per organization, meaning one company's candidate or employee data is never accessible to another

We do not sell your personal data. We may share data with: • Payment processors for subscription billing (e.g., Stripe) • Cloud infrastructure providers for hosting and data storage • AI and speech processing providers that power evaluations, interviews, and transcription • Email delivery services for automated communications • Job board integrations (50+) when you choose to post jobs externally • Calendar services for interview scheduling integrations • Analytics providers for aggregated, anonymized usage insights • Public authorities, where we are required to do so by law All third-party providers are bound by data processing agreements and are required to maintain appropriate security standards. We share only the minimum data necessary for each service. Within an organization, employee data is shared with the account owner, administrators, and the managers they authorize. Peoplesage does not send payroll data to banks or tax authorities on an organization's behalf unless the organization has separately arranged this with us.

Recruiters and organizations using Peoplesage are responsible for ensuring they have an appropriate legal basis (such as consent or legitimate interest) to collect and process candidate data through the platform. Candidates who apply through Peoplesage-powered job portals are informed that: • Their application data will be processed by the hiring organization using Peoplesage • AI evaluation will be used to assess their application, with PII anonymized • Brain Test and Brain Task assessments include integrity monitoring (auto-submit on tab switch) • AI interviews are recorded on camera and microphone and transcribed, the candidate is asked to share their screen for recording, and integrity signals are logged for a person to review • Screen sharing, camera, and microphone access are requested through the browser's own permission prompt, and cannot be started without the candidate's action • If they are hired, their application details may be carried forward into their employee record • They can request access to, correction of, or deletion of their personal data by contacting the hiring organization

When an organization uses Peoplesage to manage its employees, it is the employer and the data controller for those employees' data. The organization is responsible for: • Having a lawful basis for the employee data it holds, such as the employment contract or a legal obligation to keep pay and tax records • Telling its employees what data is held about them, how it is used, and who can see it • Telling employees that their working time is recorded through clock-ins and clock-outs • Keeping employee records accurate, and deciding how long they are kept, in line with employment and tax law Employees can see their own details, documents, leave balance, payslips, pay history, targets, progress, and development plans through the account their employer creates for them. Employee accounts are created by the employer and cannot be self-registered. When an employee leaves, their employer revokes their access, and their record is retained according to the employer's policy and any legal retention requirements. Attendance is recorded from the entries employees and managers make. Peoplesage does not monitor employees' screens or keystrokes.

We retain data as follows: • Active account data is retained for the duration of the subscription • Upon account termination, data is retained for 30 days to allow for reactivation or export, then permanently deleted unless we are required by law to keep it • Assessment data, interview recordings, and transcripts are retained for as long as the associated candidate record exists • Employee records, documents, attendance, payroll, and performance records are retained for as long as the organization keeps them on the platform • Many laws require employers to keep payroll, tax, and employment records for several years. Organizations are responsible for exporting any records they must retain before their account is closed • Audit logs are retained for 2 years for compliance purposes • Aggregated, anonymized analytics data may be retained indefinitely for product improvement • A full data export can be requested at any time through account settings

Depending on your jurisdiction, you may have the following rights: • Right to Access: Request a copy of the personal data held about you • Right to Rectification: Request correction of inaccurate or incomplete data • Right to Erasure: Request deletion of your personal data (subject to legal retention requirements, such as those that apply to payroll and tax records) • Right to Portability: Request your data in a machine-readable format • Right to Object: Object to the processing of your data for certain purposes • Right to Restrict Processing: Request that we limit how your data is used • Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent If you are a candidate or an employee, please send your request to the organization you applied to or work for, as they control your data. We will help them respond. For all other requests, contact us at info@peoplesage.com. We will respond within 30 days.

Peoplesage uses cookies and similar technologies for: • Authentication and session management, including for employee and candidate logins • Remembering user preferences and settings, such as language and timezone • Platform analytics and performance monitoring • Security and fraud prevention You can accept or reject non-essential cookies through our cookie banner, and manage cookies through your browser settings. Essential cookies required for platform functionality cannot be disabled while using Peoplesage. Our Cookie Policy explains this in more detail.

If you access Peoplesage from outside the United States, your data may be transferred to and processed in the United States or other jurisdictions where our infrastructure is located. We ensure appropriate safeguards are in place for international data transfers, including Standard Contractual Clauses (SCCs) where required by GDPR.

Peoplesage is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a minor, we will take steps to delete it promptly.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-app notification at least 30 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.

For questions, concerns, or requests related to this Privacy Policy, contact us at: Peoplesage Email: info@peoplesage.com