Candidate Privacy Notice

This notice explains how your personal data is handled when you take part in an interview or selection process run on the Correlia platform, including an interview with Corra, Correlia’s AI interviewer. It is written for candidates. If you are an employer or recruiter, see the Customer Terms of Service (/legal/terms) and the Data Processing Addendum (/legal/dpa). For everything else Correlia does, see the Privacy Policy (/legal/privacy).

In short

• You were invited by an employer or recruiting company (the “Employer”) that uses Correlia to run part of its hiring process. The Employer decides who to hire. Correlia does not.
• Corra is an AI interviewer. Corra’s face and voice are computer-generated. There is no human on the other side of the conversation.
• The interview is recorded (video and audio) and transcribed. The recording, the transcript, AI-generated scores and a summary are shared with the Employer’s hiring team.
• Correlia runs an automatic integrity check on each interview. It looks at observable events (for example, whether the interview window lost focus, whether text was pasted, how long answers took, whether a person stayed on camera). It produces a signal for a human reviewer. It is not a lie detector and it does not reject anyone.
• Corra evaluates what you say and write, against the job requirements the Employer configured. Corra does not analyse your facial expressions, emotions, tone, accent, appearance or background, and does not create voiceprints.
• The only face processing is a temporary integrity check that confirms a person is present and that the same person stays on camera during the interview. Its data is deleted automatically when the interview ends and is never used to identify you anywhere else.
• Your data is stored in the United States on Amazon Web Services. The Employer chooses how long interview data is kept (the default is 12 months after the interview). You can ask for deletion at any time.
• Using your recording to train Correlia’s own AI models is optional and happens only if you tick a separate box before the interview. Leaving it unticked has no effect on your application.
• You can ask for a copy of your data, for corrections, for deletion, and for a human to review any outcome. Contact the Employer using your invitation details, or write to ntitov@correlia.ai.

1. Who is responsible for your data

1.1 Correlia. The Correlia platform and Corra are operated by Correlia Inc., 630 Chapel St., New Haven, CT 06510, USA (“Correlia”, “we”, “us”).

1.2 The Employer. The Employer that invited you decides to use Correlia, configures the role, the job requirements and the interview questions, chooses how long your data is kept, receives the results and makes all hiring decisions. Under data protection laws in the EU, the UK and similar jurisdictions the Employer is the “controller” of your data for the hiring process, and Correlia is its “processor”. Under the California Consumer Privacy Act the Employer is the “business” and Correlia is its “service provider”. The Employer’s own privacy notice for candidates applies alongside this one.

1.3 Correlia’s own limited purposes. Correlia is responsible in its own right (as an independent controller) only for a few limited things: keeping the platform secure and preventing abuse of the platform; complying with law and responding to lawful requests; improving the service using de-identified or aggregated data; communicating with you about your data rights; and, only if you give the separate optional consent described in Section 5, using your interview recording to train and improve Correlia’s own AI models.

1.4 Questions. For anything about the role, the process, an alternative to an AI interview, accommodations, or the Employer’s decision, contact the Employer using the details in your invitation. For anything about Correlia or this notice, contact ntitov@correlia.ai.

2. Where your data comes from

2.1 From the Employer. Your name, contact details, resume or CV, application answers and any notes the Employer already holds. The Employer may have uploaded this data, synchronised it from its applicant tracking system (for example Ashby or Greenhouse), received it from a job board you applied through (for example hh.ru), or imported it from a public professional profile (for example LinkedIn) where the Employer sources candidates.

2.2 From you. Everything you say, write, code or show during the interview, plus any information you provide in forms or messages.

2.3 Automatically. Technical information about your device, browser and connection, and the in-session integrity signals described in Section 3.

3. What data we process

3.1 Identity and contact data. Name, email address, phone number, links you or the Employer provided, and a photo if one is included in your resume.

3.2 Resume and profile data. Work history, education, skills, languages, location, salary expectations and anything else contained in your resume, application or the Employer’s records.

3.3 Interview recording. Video and audio of you for the entire interview. If the role includes a live-coding exercise, the code you type and edit in the coding widget.

3.4 Transcript. A written transcript of Corra’s questions and your answers.

3.5 AI-generated outputs. Scores (resume match, requirements match, hard skills, soft skills, overall), per-question evaluations, a written summary and the integrity report, all produced from the content of your resume, your answers and the signals below, measured against the requirements configured by the Employer.

3.6 Integrity signals. During the interview the platform records: whether the interview window lost focus or visibility (for example switching tabs or windows, or the pointer leaving the window); copy and paste events; how long you took to answer each question; simple text patterns in your answers (sentence length, self-corrections, filler words); whether a person is present on camera and whether more than one person appears; camera or microphone interruptions; the language of the interview; your approximate location (country) derived from your IP address; and your device and browser type. To confirm that the same person remains on camera, the platform may also create a temporary biometric template of your face during the interview; it exists only while the interview is running, is deleted automatically when the interview ends, and is never compared against any external database or used to identify you outside the interview. These signals are used only for the integrity report and for platform security. They are not used to score your ability.

3.7 Technical and usage data. IP address, timestamps, log data, device identifiers and the strictly necessary cookies described in the Cookie Policy (/legal/cookies). Candidate interview pages do not use advertising or analytics cookies.

3.8 Communications. Invitations, reminders, messages exchanged through the Employer’s job board or applicant tracking system integration, and any correspondence with Correlia.

3.9 Hiring-process data recorded by the Employer. Pipeline stage, decisions, rejection reasons, comments and offer dates entered by the Employer’s team.

3.10 Sensitive data. The interview is not designed to collect information about your health, disability, religion, political opinions, sexual orientation, trade union membership, ethnic origin or other special categories of data, and Corra does not ask for it. If you volunteer such information during the interview, it will be part of the recording and transcript. Please do not share information you do not want the Employer to see. If you need an accommodation for a disability or health condition, ask the Employer directly rather than telling Corra.

4. Why we process your data and the legal basis

4.1 Running the interview. To invite you, check your camera and microphone, conduct the adaptive interview, record it and transcribe it. EU/UK legal basis: the Employer’s legitimate interest in assessing candidates and the steps taken at your request before entering into an employment contract (Article 6(1)(b) and 6(1)(f) GDPR), plus applicable national employment law.

4.2 Evaluating your answers. To produce the scores, per-question evaluations and summary described in Section 3.5, so that the Employer’s hiring team can assess you consistently against the job requirements. EU/UK legal basis: as in 4.1. The evaluation is produced by AI and reviewed by humans at the Employer; see Section 6.

4.3 Integrity check. To produce the integrity report so that the Employer can see whether the interview was completed by you, on your own, under the conditions it set. EU/UK legal basis: the Employer’s legitimate interest in a fair and reliable process and Correlia’s legitimate interest in protecting the platform from misuse (Article 6(1)(f) GDPR).

4.4 Delivering results to the Employer. To make the recording, transcript, outputs and integrity report available to the Employer’s authorised users inside the Correlia platform and, on the Employer’s instruction, through its integrations (for example pushing a scorecard to the Employer’s applicant tracking system or posting a summary to the Employer’s Slack workspace). EU/UK legal basis: as in 4.1.

4.5 Communicating with you. To send invitations, reminders and technical messages, and to respond to your requests. EU/UK legal basis: as in 4.1, and Correlia’s legitimate interest in handling your requests.

4.6 Security, legal compliance and service improvement. To keep the platform secure, detect and prevent abuse, keep records required by law, respond to lawful requests, and improve the service using de-identified or aggregated data that no longer identifies you. EU/UK legal basis: Correlia’s legitimate interests and legal obligations (Article 6(1)(c) and 6(1)(f) GDPR).

4.7 Training Correlia’s AI models (optional). Only with your separate, explicit consent, to use your interview recording to train and improve Correlia’s own AI models, as described in Section 5. EU/UK legal basis: your explicit consent (Article 6(1)(a) and, to the extent the data is treated as biometric, Article 9(2)(a) GDPR). In Illinois, your consent serves as a written release under the Biometric Information Privacy Act.

4.8 Where consent is required for the interview itself. Some laws require your consent before an interview is recorded, before artificial intelligence is used to analyse it, or before biometric data such as the temporary face check described in Section 3.6 is collected (for example the Illinois Artificial Intelligence Video Interview Act, the Illinois Biometric Information Privacy Act, and recording laws in states such as California, Florida, Illinois, Maryland, Massachusetts, Pennsylvania and Washington). You give that consent by ticking the required box and pressing “Start interview” after reading this notice and the AI Transparency Statement; where the GDPR applies, it is also your explicit consent for the temporary face check (Article 9(2)(a)). If you do not wish to be recorded or evaluated by AI, do not start the interview; contact the Employer, which can offer an alternative process.

5. Optional consent to train Correlia’s AI models

5.1 What we ask. Before the interview you will see a separate, unticked box: “Optional: Correlia may use my interview recording (video, audio, transcript) to train and improve its own AI models.” Ticking it is entirely voluntary.

5.2 What it means. If you tick the box, Correlia may use your recording and transcript to train, test and improve the AI models behind Corra, for example models that generate the avatar’s speech and appearance, recognise speech, run the conversation and evaluate answers. Your recording would be one of many examples used to teach the models. Correlia will not use your recording to create an avatar, voice or any output that depicts, imitates or impersonates you, and will not share your recording with third-party AI companies for their own model training.

5.3 What it does not affect. Your choice has no effect on your interview, your evaluation or the Employer’s decision. The Employer does not see your choice as part of your evaluation.

5.4 Withdrawing consent. You can withdraw at any time by emailing ntitov@correlia.ai with the email address you were invited with. Withdrawal takes effect going forward: we will remove your recording from training datasets within 30 days. Models that were already trained before withdrawal are not retrained, but your recording will not be used again.

5.5 Retention. Recordings covered by this consent are kept for training purposes until you withdraw consent or until Correlia no longer needs them, whichever is earlier, even if the Employer has deleted its copy.

5.6 Employer choice. Some Employers ask Correlia to switch this option off for their candidates. If you do not see the box, the option is not available for your interview.

6. How artificial intelligence is used, and what it means for you

6.1 Corra is AI. The interviewer you see and hear is an AI system. Corra’s face and voice are synthetic: they are generated by computer and do not belong to a real person. No human is watching or speaking to you during the interview.

6.2 What Corra does. Corra asks the questions the Employer configured, listens to your answers, asks adaptive follow-up questions, and then produces the evaluation described in Section 3.5. Corra’s evaluation is based on the content of what you say and write, compared with the skills, experience and requirements the Employer defined for the role, together with your resume. Examples of what is assessed: the relevance and depth of your answers, concrete examples you give, clarity and structure of your reasoning, technical correctness for hard-skills questions, and the match between your experience and the stated requirements.

6.3 What Corra does not do. Corra does not identify you against any face or voice database and does not keep face templates or voiceprints: the only biometric processing is the temporary same-person check described in Section 3.6, and its data is deleted when the interview ends. Corra does not create a voiceprint or other profile to identify you by your voice; does not analyse your facial expressions, eye movement, tone of voice, accent, appearance, clothing, body language or background; does not try to detect emotions, personality traits, honesty or lying; and does not infer or score race, ethnicity, sex, gender identity, age, religion, disability, national origin, sexual orientation or any other protected characteristic. Answer timing and other integrity signals are used only for the integrity report, never for scoring your ability.

6.4 The integrity report. The integrity report summarises the signals listed in Section 3.6 and flags patterns that may indicate the interview was not completed by you alone or that outside tools were used in ways the Employer did not allow. It is a signal for a human reviewer, not a finding of misconduct. Signals can have innocent explanations (an unstable connection, a family member walking past, a notification popping up). Correlia does not reject candidates and instructs Employers not to reject anyone solely on the basis of the integrity report.

6.5 Humans decide. Scores, summaries and the integrity report are decision-support for the Employer’s recruiters and hiring managers, who are expected to review the transcript and recording before acting. Correlia’s terms require Employers to ensure meaningful human review, not to base a decision solely on AI outputs, and to offer an alternative process or accommodation on request. If the Employer’s decision is based solely on automated processing, laws in the EU, the UK and elsewhere give you the right to obtain human intervention, to express your point of view and to contest the decision; ask the Employer, and copy ntitov@correlia.ai if you wish.

6.6 Your options. Before the interview you may choose not to proceed and ask the Employer for an alternative. After the interview you may ask the Employer for an explanation of how Correlia’s outputs were used in its decision, ask for a human review, and ask for your data to be corrected or deleted. The AI Transparency Statement, “How Corra interviews and evaluates candidates” (/legal/ai-transparency), explains the process, the characteristics assessed, known limitations and how fairness is tested.

7. Who receives your data

7.1 The Employer. Your recording, transcript, outputs and integrity report are available to the Employer’s authorised users inside the platform. Correlia’s terms require the Employer to use them only to evaluate you for the relevant role, to share them only with people involved in that hiring decision, and not to download, copy, screen-record, redistribute or publish them outside the platform, except through exports Correlia provides for the Employer’s own hiring process (for example to its applicant tracking system).

7.2 Sub-processors. Companies that help Correlia run the platform under contract, acting on Correlia’s instructions, including Amazon Web Services (hosting and storage in the United States) and ElevenLabs (speech-to-text, under terms that prohibit training on our data). The AI models that conduct and evaluate interviews, and Corra’s avatar and voice, run on Correlia’s own infrastructure. The current list, with names and locations, is at /legal/sub-processors.

7.3 Integrations chosen by the Employer. On the Employer’s instruction, data may be sent to tools the Employer uses, such as its applicant tracking system (Ashby, Greenhouse), its Slack workspace, its calendar or task tools, or the job board you applied through. Those tools are governed by the Employer’s arrangements with their providers.

7.4 Legal and corporate. Authorities, courts or other parties where the law requires or permits it, including to protect rights, safety and the integrity of the platform; professional advisers; and a successor in a merger, acquisition or reorganisation, under this notice.

7.5 No sale. Correlia does not sell your personal data and does not share it for targeted advertising.

8. Where your data is stored and international transfers

8.1 All candidate data is stored and processed in the United States on Amazon Web Services, encrypted in transit and at rest. Your data may therefore be transferred to the United States from the country where you are located.

8.2 For candidates in the European Economic Area, the United Kingdom and Switzerland, transfers to Correlia are protected by the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914) entered into between the Employer and Correlia and between Correlia and its sub-processors, with the UK International Data Transfer Addendum and Swiss adaptations where applicable, supported by a transfer impact assessment and supplementary measures such as encryption and strict access controls. Correlia intends to certify to the EU-US Data Privacy Framework and its UK and Swiss extensions once it is eligible; once certified, Correlia may also rely on that framework. You can request a copy of the relevant safeguards at ntitov@correlia.ai.

8.3 For candidates in other countries, transfers are made under the safeguards required by local law, including contractual clauses where applicable.

9. How long we keep your data

9.1 Interview data (recording, transcript, outputs, integrity signals). Kept for the period configured by the Employer, which is by default 12 months after the interview. The temporary face-check template described in Section 3.6 is not stored at all: it exists only during the interview and is deleted automatically when the interview ends. The Employer may delete it earlier at any time. When the Employer’s contract with Correlia ends, its candidate data is deleted within 30 days of termination (backup copies within 90 days). The Employer may keep its own records for longer where employment law requires it (for example, some US laws require hiring records to be kept for up to four years).

9.2 Deletion on request. You may ask the Employer or Correlia to delete your interview data at any time. We will coordinate with the Employer and delete within 30 days unless the Employer has a legal obligation to retain it, in which case it will tell you. For interviews for positions based in Illinois, we delete the recording and instruct every recipient to delete it within 30 days of your request, as the Illinois Artificial Intelligence Video Interview Act requires. A request to delete your interview also withdraws the Optional Training Consent, if you gave it.

9.3 Training copies. As described in Section 5.5.

9.4 Consent and audit records. A record of the notices you were shown and the boxes you ticked (with time, IP address and document version) is kept for 5 years after the interview as evidence of consent. It is stored separately from the recording and survives deletion of the recording.

9.5 Platform security logs. 12 months.

9.6 Correspondence with Correlia about your rights. 3 years after the request is closed.

9.7 Retention schedule and destruction. This Section 9 is Correlia’s published retention schedule for candidate data. Data that has reached the end of its retention period is permanently deleted from production systems and from backups on their normal rotation, using secure deletion methods.

10. Security

Correlia protects your data with encryption in transit (TLS) and at rest, role-based access controls and least-privilege access, multi-factor authentication for staff, access logging, network isolation, regular backups, vulnerability management and an incident-response process. Access to recordings inside the platform is logged, and recordings may be watermarked. No system is perfectly secure; if a security incident affects your data we will notify the Employer and, where the law requires, you and the relevant authorities.

11. Your rights and choices

11.1 Rights available to everyone. Wherever you are, you can: ask what data we hold about you and get a copy; ask us to correct inaccurate data; ask us to delete your data; ask for an explanation of how Correlia’s outputs were used and for a human review; withdraw the Optional Training Consent; and complain to us about how your data is handled.

11.2 How to exercise them. Because the Employer controls the hiring process, the quickest route is usually to contact the Employer using the details in your invitation. You can also write to ntitov@correlia.ai. If your request concerns data we process for the Employer, we will pass it to the Employer within five business days and help it respond; if it concerns Correlia’s own purposes, we will respond directly. We may ask you to confirm your identity, for example by writing from the email address you were invited with. We respond within one month (or the shorter period required by local law) and will tell you if we need more time. You will not be treated differently for exercising your rights.

11.3 European Economic Area, United Kingdom and Switzerland. You have the rights of access, rectification, erasure, restriction of processing, data portability and objection (including to processing based on legitimate interests), the right to withdraw consent at any time without affecting earlier processing, and the rights relating to automated decision-making described in Section 6.5. You may lodge a complaint with your local data protection authority or with the authority of the country where the Employer is established. Correlia will publish the details of its EU and UK representatives on this page once they are appointed; Correlia’s data protection contact is ntitov@correlia.ai.

11.4 California. This section is Correlia’s notice at collection for California candidates under the California Consumer Privacy Act, as amended. In the past 12 months Correlia has collected, on behalf of Employers, the following categories of personal information: identifiers; personal information described in California Civil Code section 1798.80(e) (for example name, contact details); professional or employment-related information; education information; audio and visual information (the interview recording); internet or other electronic network activity (the technical and integrity signals in Sections 3.6 and 3.7); geolocation at country level derived from IP address; and inferences drawn from the above in the form of the AI-generated outputs. Sensitive personal information is not intentionally collected; the contents of a recording may include information you choose to share. We use these categories for the purposes in Section 4 and keep them for the periods in Section 9. We do not sell or share personal information and have not done so in the past 12 months, and we use sensitive personal information only to provide the service. You have the rights to know, to delete, to correct, to limit the use of sensitive personal information, to opt out of sale or sharing (not applicable), and not to be discriminated against for exercising your rights; you may use an authorised agent. Because Correlia acts as a service provider to the Employer, the Employer responds to requests about its hiring process and Correlia assists. From 1 January 2027, Employers using Correlia’s outputs in a way that replaces or substantially replaces human decision-making must provide a pre-use notice about that automated decision-making technology and offer an opt-out or a human appeal; the AI Transparency Statement provides the information Employers need for that notice, and Correlia’s terms require Employers to ensure human review. The California Civil Rights Council’s regulations on automated-decision systems also apply to the Employer; Correlia does not analyse reaction time, facial expressions or tone of voice to evaluate candidates.

11.5 Illinois. If you are interviewing for a position based in Illinois, the Employer is required by the Artificial Intelligence Video Interview Act to tell you before the interview that artificial intelligence may be used to analyse your video interview and consider your fitness for the position, to explain how the AI works and what general types of characteristics it uses to evaluate candidates, and to obtain your consent. This notice, the AI Transparency Statement and the required box on the pre-interview screen serve those purposes. Your recording is shared only with people whose expertise or technology is necessary to evaluate your application. You may ask for your recording to be destroyed at any time; it will be destroyed, and every recipient instructed to destroy their copies, within 30 days. Under the Illinois Biometric Information Privacy Act: during the interview the platform creates a temporary scan of face geometry for the sole purpose of confirming that a person is present and that the same person remains on camera. It is retained only for the duration of the interview, is destroyed automatically when the interview ends, is never used to identify you outside the interview, and is never sold, leased, traded or disclosed except to the sub-processors that host the interview infrastructure. Correlia creates no voiceprints. Ticking the required box before the interview, after reading this notice, is your written release for that limited collection. If you give the Optional Training Consent, it serves as your written release for any use of the recording for training that could be considered biometric information, for the purpose and retention period described in Section 5. Section 9 is Correlia’s published retention schedule and destruction guidelines.

11.6 New York City. If you are applying for a position in New York City, the Employer is responsible for complying with Local Law 144 of 2021 on automated employment decision tools, including notice at least 10 business days before use, a published summary of an independent bias audit, and information on the data collected and the Employer’s data retention policy, which the Employer can provide on request within 30 days. Correlia provides Employers with the information needed for those notices and cooperates with independent bias audits.

11.7 Maryland. The temporary face check described in Section 3.6 may be treated as creating a facial template under Maryland Labor and Employment Code section 3-717. For positions based in Maryland, the Employer must obtain your signed waiver before the interview; contact the Employer using your invitation details if you have not been asked for one.

11.8 Colorado. From 1 January 2027, Colorado law requires Employers that use automated decision-making technology that materially influences employment decisions to give candidates a notice before use and, after an adverse decision, a plain-language explanation, an opportunity to correct data and, where reasonable, a human review. Correlia supplies Employers with the documentation they need to do this.

11.9 Canada. You have the right to access and correct your personal information and to withdraw consent subject to legal or contractual restrictions. If you are in Quebec and a decision about you is based exclusively on automated processing, you may ask the Employer for the information used, the reasons and principal factors, and to have your observations heard by a person able to review the decision.

11.10 Brazil. You have the rights under the Lei Geral de Proteção de Dados, including confirmation, access, correction, anonymisation, deletion, portability, information about sharing, and review of decisions taken solely on the basis of automated processing.

11.11 Australia. You have rights under the Australian Privacy Principles, including access and correction. Correlia’s outputs may substantially assist the Employer’s decisions; the kinds of data used and decisions involved are described in this notice and the AI Transparency Statement.

11.12 Other countries. You have the rights provided by the data protection law of your country. Write to ntitov@correlia.ai and we will explain how they apply.

12. Age

Correlia’s interviews are intended for candidates who are at least 18 years old (or the age of majority where they live, if higher) and legally able to work. If you are under 18, do not start an interview; ask the Employer to contact Correlia.

13. Changes to this notice

We may update this notice from time to time. The version shown on the pre-interview screen at the time of your interview is the version that applies to that interview, and we keep a record of it. Material changes will be highlighted on this page with a new effective date.

14. Contact

Correlia Inc., 630 Chapel St., New Haven, CT 06510, USA
Privacy, legal and security requests: ntitov@correlia.ai
EU and UK representatives: Correlia will publish the details of its EU and UK representatives on this page once they are appointed.