Privacy policy

1. Who we are

Procteye is an AI interview and proctored assessment platform operated by Generic Technologies Private Limited, India ("Procteye", "we", "us"). This policy explains what personal data we collect when you use procteye.com, the Procteye employer and candidate portals, the Procteye Focus desktop app and the Procteye mobile app, why we use it, who we share it with, and the choices you have. Organisations that invite candidates to assessments on Procteye decide why those assessments are run; for assessment data we process on their behalf, that organisation is responsible for its own hiring decisions and we act on its instructions.

2. Information we collect

Account information: your name, email address, phone number if you add one, organisation and role, confirmation that you are 18 or older, and a password hash if you sign in with a password. Information from sign-in providers: when you choose Sign in with Google we receive your email address, whether Google has verified that email address, your name and your profile picture (the openid, email and profile scopes only); Sign in with Apple gives us your email address (which may be an Apple private relay address) and, on first sign-in only, your name; LinkedIn and enterprise single sign-on give us your name, email address and, where available, your profile picture. Assessment and proctoring data: webcam video and audio, screen activity, analysis of your face, gaze and voice, integrity events, your answers and code, interview recordings and transcripts, device information, device attestation results and your IP address. Consent records: when you give or withdraw a consent, we record the choice, the version of the text you saw and the time. Payment information: payments are handled by our payment providers; we keep transaction references, not full card numbers. Technical data: service logs, error reports, browser and device type, and the cookies and browser storage described in section 12.

Checking it's really you: before or during a proctored session, we may take a photo of your face and a photo of your government ID. AI compares the two, and compares your face with later camera images, so the organisation knows the person taking the assessment is you. The result, including any mismatch, is added to the integrity report for the organisation that invited you.

Mobile app as a second camera: when you join a proctored session with the Procteye mobile app as an observer camera, the app sends your phone's camera video to our live video provider. If that live video connection fails, the app sends still photos to our servers instead. It also uploads photos and short video clips as evidence of possible misconduct, and reports when it detects a screenshot or screen recording. Face, head position and object detection run on your phone; the results, such as whether a face is visible, which way your head is turned and whether an object such as another phone is in view, are sent to us as integrity events. The observer camera doesn't use your microphone.

Nearby Bluetooth devices: during a proctored session in observer mode, the mobile app scans for nearby Bluetooth devices to detect devices that are not allowed. For each device we receive a pseudonymised identifier that only works for that session, its signal strength and transmit power, its type, how many services it offers and whether it shows a name, but not its name or address. On Android 11 and lower, Android only lets apps scan for Bluetooth devices if they have the location permission, so the app asks for it there, but it doesn't collect your location.

CVs and verification: when you upload a CV, the AI providers listed in section 7 read it to fill in your profile. When you add employment or work authorisation records, we keep the details you enter, such as employers, job titles and dates, the country and status of your work authorisation, your visa category, whether you need sponsorship, and any supporting documents. When you ask us to verify a job with a former employer, we email the contact you gave us at that employer with your name and the organisation, and a link to confirm the record.

Jobs: we keep your job searches and the saved searches and alerts you create, the jobs you save and the applications you send. When you open a job from a partner job site, we record the click with the job, a keyed hash of your IP address and your browser's user-agent string. We don't link these clicks to your account.

Approximate location: when you sign in, we work out your approximate country and city from your IP address and store them with that sign-in session, so that you can see where your account is signed in.

Mobile app notifications and diagnostics: the mobile app uses Google Firebase to send you push notifications and to load app settings. It can also send crash reports through Firebase Crashlytics and usage analytics, such as the screens you open, through Google Analytics for Firebase. Both are off until you turn them on: the app asks you once whether to share analytics, and you can turn crash reports and analytics on or off at any time in the app's privacy settings. We don't use them for advertising.

Saved cards: if you save a card for later payments, we keep a token from the payment provider, the last 4 digits, the card network, the issuing bank and the expiry date. We never see or keep the full card number.

3. Why we use your information and our legal basis

Proctoring recordings and the analysis of your face, gaze and voice: your explicit consent, which we ask for before your first proctored session. Creating and running your account, and running, scoring and reporting the assessments and interviews you take part in: performance of our contract with you, and of our contract with the organisation that invited you. Keeping the service secure and preventing fraud, bots, cheating and tampering (including device attestation and Cloudflare Turnstile checks), and fixing errors: our legitimate interests in a safe and reliable service. Issuing invoices and keeping tax and accounting records: our legal obligations. Service messages such as sign-in codes and assessment invitations are part of running your account. Optional emails such as product news are sent only if you opt in. We do not use your personal data for advertising and we do not sell it.

Some uses have their own basis. Reading your CV with AI to fill in your profile: performance of our contract with you. Sharing your profile with matching employers, and sending sign-in codes by WhatsApp: your consent, which you can withdraw at any time. Keeping a hashed form of your phone number so the same phone can't claim sign-up bonuses again: our legitimate interest in preventing abuse.

4. Face, gaze and voice analysis

During a proctored assessment or interview your camera, microphone and screen are monitored automatically, and we analyse your face, gaze and voice to detect possible misconduct. Short clips around flagged moments are kept for the organisation to review, and a proctor may join and watch at any time. We treat this analysis as sensitive personal data. It happens only after you give explicit consent on the consent screen shown before your first proctored session, and we record which version of the consent text you agreed to. If the text changes, we ask again. You can withdraw your consent at any time in Settings, under Security & privacy, on the web, or in Account settings, under Data and privacy, in the mobile app; after that you cannot start new proctored sessions until you consent again, and data from past sessions is kept only for the retention period described in section 9. When you take an assessment embedded on another organisation's own website through our integrity service, that organisation is responsible for asking for your consent.

We use your face and ID photos only for these identity checks, and we keep them only as long as the rest of the session's data.

AI helps score your answers and interviews and flags anything that might be misconduct, such as a face that doesn't match your ID. These scores and flags go to the organisation that invited you, or that you applied to. The organisation makes the hiring decision, not Procteye. If you think a score or flag is wrong, you can ask a person to look at it again, by contacting us or the organisation.

5. Data we receive from Google

When you sign in with Google we use your email address and its verified status to identify your account and to confirm the address belongs to you, and your name and profile picture to set up and display your profile when your account is created. We do not request access to any other Google data. We do not sell Google user data, use it for advertising, or use it to develop, improve or train generalised or non-personalised AI or machine learning models. People at Procteye do not read it except with your permission, where needed for security or to investigate abuse, or where the law requires it. Procteye's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can remove Procteye's access at any time at https://myaccount.google.com/permissions, and you can ask us to delete the data we received from Google as described in section 10.

6. Who we share information with

We share assessment results, recordings and integrity reports only with the organisation that invited you to that assessment. We may also disclose information when the law requires it, to protect the rights and safety of our users or the public, or as part of a merger or acquisition under the same protections. We do not sell personal data.

When you apply for a job: the employer gets the profile details you check before sending, plus your verified green tags.

If you turn on profile sharing: we may tell employers whose jobs match you, including employers who don't use Procteye yet, by email. They get a short summary with your match and trust scores, your work authorisation status and a link to your profile. You can turn profile sharing off at any time.

7. Service providers (sub-processors)

These providers process personal data for us under contract and only for the purposes in this policy: Amazon Web Services (hosting and storage, in the Mumbai, India region); Amazon Simple Email Service (sending email); Cloudflare (content delivery, network security and bot protection); LiveKit (real-time audio and video for interviews); Deepgram (speech to text and text to speech); Google Firebase (push notifications, app settings, and crash reports and analytics if you turn them on); Apple and Google (checking that the mobile app runs on a genuine device); Merge.dev (checking your employment through an employer's HR system when you ask us to verify a job); Instantly (sending emails to employers about matching candidates, when you turn on profile sharing); Sentry (error reports, with card details removed); and Razorpay, Cashfree, Lemon Squeezy and Dodo Payments (payments). Enterprise single sign-on runs on Ory Polis, which we host ourselves on our own infrastructure, so it is not a third party.

AI providers: we use AI models from specialist providers to read CVs, create and score assessments, run and score AI interviews, and check identities. Right now these are Anthropic, OpenAI and Google. We may switch between providers or add new ones at any time, and we keep this list up to date when we do. Every provider processes data for us under contract, and only for the purposes in this policy.

We also use MSG91 and WhatsApp, operated by Meta, to send verification codes to your phone number.

8. Storage, security and international transfers

Personal data is stored on Amazon Web Services in the region that serves your account (currently Mumbai, India). If we add regions, we will update this policy and tell you. Data is encrypted in transit with TLS and encrypted at rest, access is limited to the people and systems that need it, and administrative access requires strong authentication. Some of our service providers process data outside India. Where personal data from the European Economic Area is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914); for data from the United Kingdom, we rely on the UK International Data Transfer Agreement or Addendum.

9. How long we keep information

Account data: while your account is active. Proctoring evidence (recordings, identity check photos, analysis results and the integrity report of a session): for the retention period set by the organisation that invited you, fixed when the session starts, which is 30 days unless the organisation sets a different period; it is then deleted automatically. Exported report PDFs: deleted automatically when the organisation's export retention period ends. Sign-in records (the date, approximate location and device of past sign-ins): 180 days. Backups: deleted data can stay in our backups for up to 30 days before it's overwritten. Consent records: kept as evidence of the choices you made. When you delete your account, we also delete the proctoring data of the sessions linked to your account, including recordings, reports and your search profile. If a recording from one of your sessions is part of an open dispute, we keep your account until the dispute is settled, then delete it automatically. Records that an organisation created when it invited you to its assessment belong to that organisation, and you can ask it or us to delete them. We may keep part of your data longer only where we must do so to meet a legal obligation, resolve a dispute or prevent fraud.

Your verified work history: verified employment records, meaning records an employer has confirmed or that an employer using Procteye has added about its employees, work like a credit report for your career. If you delete your account, we keep these records but seal them: no other organisation can see them. The employer that added a record can still see its own records. If you create a Procteye account again with the same verified email address or phone number, your sealed work history is linked back to it. If you live in the European Union or the United Kingdom, we delete sealed records after 6 months, unless we need them for a legal claim. If a record is wrong, tell us and we'll correct it.

10. Your rights and choices

You can ask us for a summary of and a copy of your personal data, and ask us to correct, complete, update or delete it, or to stop using it. You can withdraw any consent at any time, as easily as you gave it; withdrawal does not affect processing that happened before. Under the Digital Personal Data Protection Act, 2023 (India) you can also nominate another person to exercise your rights if you die or become unable to do so, and you can complain to the Data Protection Board of India if you are not satisfied with our response. If the GDPR or the UK GDPR applies to you, you also have the rights to restrict processing, to data portability and to object to processing based on our legitimate interests, and you can complain to your local data protection authority. To make a request, email us from the email address on your account. If you don't have a Procteye account, for example because an organisation invited you to an assessment by email, write from the email address the organisation invited. We respond within 30 days, or tell you within that time if we need longer, as the law allows. For assessment data, we may pass your request to the organisation that invited you so it can respond as well.

You can also delete your account yourself, in the mobile app or in your account settings on the website. https://procteye.com/account/delete explains each way and what we keep. In a few cases we can't delete your account straight away; that page explains when.

11. Age requirement

Procteye is only for people aged 18 or older. You must confirm that you are 18 or older when you create an account, and accounts created through a sign-in provider must confirm it before their first proctored session. We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has given us personal data, contact us and we will delete it.

12. Cookies and browser storage

The candidate site uses only cookies and browser storage that are strictly necessary for it to work, so we do not ask for cookie consent. Sign-in cookies set by our server keep you signed in (access and refresh tokens, which your browser's scripts cannot read). Cloudflare Turnstile, shown on sign-in and sign-up forms, and Cloudflare's network protection may set cookies to tell people and bots apart. Our pages keep small values in your browser's storage: the time of the last sign-in refresh, the page to return to after sign-in, the security state of a Google sign-in in progress, a marker that you signed out, the job you chose before signing in, and an unsaved job search. When you buy credits in Indian rupees, the Razorpay or Cashfree checkout is loaded and may set its own cookies for that payment. Payments in other currencies happen on the Lemon Squeezy or Dodo Payments checkout page. We do not use analytics, advertising or tracking cookies.

13. Changes to this policy

We will post any change to this policy on this page and update the date above; if a change is significant we will tell you before it takes effect. If we change the proctoring consent text, we will ask for your consent again before your next proctored session.

14. Contact and Grievance Officer

Our Grievance Officer and privacy contact is Koushik Raj, Generic Technologies Private Limited, India, getintouch@procteye.com. Send questions, requests and complaints about this policy or your data to that address. We respond within 30 days, or tell you within that time if we need longer, as the law allows.