Privacy policy

SkillChecker is operated from Ireland. The legal entity responsible is named below.

TODO(RYAN): COMPANY_LEGAL_NAME + REGISTERED_ADDRESS

Two different relationships apply, depending on the data:

• As a processor — For participant answers, scores, reports and integrity signals, we act on the instructions of the hiring company that set up the assessment. They decide why the assessment happens and what is done with the result. They are the controller.
• As an independent controller — For recruiter account data, billing, security, fraud prevention and service logs, we decide the purposes ourselves and act as controller.

This distinction matters for rights requests: see below.

The categories of personal data stored are:

• Participant identity — name, and email address where the recruiter provides one or the participant enters it themselves.
• Assessment content — the skills and experience the recruiter entered, the questions generated from them, the answers written by the participant, the per-question scores, and the written report.
• Integrity signals — whether text was pasted, whether it appeared faster than typing allows, typing speed, and how many times the browser tab was switched.
• Recruiter account — email address, name, credit balance, and industry preference.
• Sharing — where a recruiter shares a result with a colleague, that colleague’s email address.

Several of these fields are free text. Assessment answers in particular are written by the participant and are not restricted, so they may contain more than the question asked for.

We use a small number of service providers to host the application, store data, generate and grade assessments, and send transactional email. There is no advertising network, analytics provider or data broker involved.

See the full sub-processor list

TODO(RYAN): HOSTING_AND_DB_REGIONS + TRANSFER_MECHANISM

Participant data is deleted automatically on the schedule below. These are maximums enforced by a job that runs daily, not targets — nothing is kept past them because a person forgot to remove it.

Every run of the deletion job is recorded, including runs that removed nothing, so the schedule can be shown to be working rather than asserted to be.

A hiring company can ask us to hold their participants' data for less time than the above. They cannot ask us to hold it for longer than 3 years, which is a hard ceiling in the system itself rather than a policy we apply by hand.

Deletion can also be requested before the period expires — see Your rights below. That route does not wait for the schedule.

What this schedule does not cover

• Encrypted database backups. When a record is deleted it is removed from the live database immediately, but copies remain in our hosting provider's automated backups until those expire on the provider's own cycle. Backups are not searchable and are used only to restore the service after a failure.
• Server logs held by our hosting provider, which are retained on their schedule rather than ours. Logs record errors and request metadata; they are not used to reconstruct assessments.
• Recruiter account and billing records, which are kept while the account is open and for as long as company and tax law requires afterwards. These are not yet on an automated schedule.

This product sets two cookies: one to keep a signed-in recruiter signed in, and one to remember a light or dark theme preference. Both are strictly necessary for the service to work as chosen. There is no advertising, analytics or tracking cookie, which is why you are not asked to consent to any.

You have the right to access your data, correct it, have it deleted, restrict or object to processing, and receive it in a portable form.

If you took an assessment, the hiring company is the controller and requests are normally routed to them. If you cannot identify or reach them, contact us directly and we will help — you should never be left without a route.

Make a request about your data

TODO(RYAN): PRIVACY_CONTACT_EMAIL — no contact address exists yet. Rights requests should use /trust/your-data, linked above, which creates a tracked record.

If you are unhappy with how your data has been handled, you can complain to the Irish Data Protection Commission, or to the supervisory authority in the EU country where you live or work.