The plain-English summary
You control candidate data; we process it only on your instructions. The headline commitment, because it is the one your candidates care about most: CVs and CV-derived analysis are automatically hard-deleted 90 days after processing, by default — deleted meaning gone, not flagged hidden — and candidate code follows at 180 days. Both windows are yours to shorten or extend per workspace. When you leave the platform, everything identifying any person is deleted completely, with one narrow, named exception spelled out in section 6. If we ever have a breach affecting your data, you hear it from us without undue delay. The numbered sections below are the same commitments in the language your counsel needs.
1. Roles
You are the controller. Arbiter is the processor. We process candidate personal data only on your documented instructions, which are the Terms of Service, this agreement, and your use of the product.
This allocation matters: the lawful basis for assessing a candidate is yours, not ours, and we cannot supply one on your behalf.
2. What we process
Candidate name and email address. CV text you submit. Code and files the candidate writes, and the saved history of the workspace during the session (the automatic snapshots, with what changed in each). The prompts the candidate types to the in-workspace navigator (Arbiter Pair) and its replies, where it is on for the assessment. A record of commands run, files saved, the size of text pasted and each refusal by the clipboard limit during the session — never the pasted text itself — where you have enabled it. Assessment scores and the reasoning behind them.
3. Sub-processors
We use the following. You are notified before any is added or replaced.
- E2B — cloud sandboxes in which candidate code is executed.
- Anthropic — four purposes, and they are listed separately because they involve different data: (a) routing an assessment to a suitable challenge, and adapting the wording of a task to a candidate's background — candidate CV text is sent; (b) preparing interview questions for your reviewer after an assessment is graded — the code the candidate wrote is sent; (c) answering the prompts a candidate types to the in-workspace navigator, Arbiter Pair — the candidate's own prompt text is sent, never their files and never the brief; (d) nothing else. No model scores a candidate, and no model makes or recommends a hiring decision.
- Resend — transactional email delivery.
- Supabase / PostgreSQL hosting — data at rest.
4. Security
Data is isolated per workspace by row-level security enforced in the database, not by application code alone. Grading runs in a sandbox with no outbound network access. Assessment content that would reveal answers is held in a schema no application role can read.
5. Retention and automatic deletion
Retention is not a policy we promise to run; it is a scheduled process that runs without anyone deciding to. During the contract:
- CV text and CV-derived analysis are hard-deleted 90 days after processing, by default. Hard-deleted: the rows are destroyed, not soft-flagged, and nothing downstream retains a copy.
- Candidate code, and everything derived from it (grader artifacts, diffs, the AI-drafted interview guides that quote it), is hard-deleted after your code retention window — 180 days by default.
- The detailed session record is deleted sooner, on an event. The saved workspace history, the raw behavioural events and, where an in-workspace assistant is used, its transcript are hard-deleted 7 days after a candidate is rejected or the position is archived, and in any case 30 days after the attempt ends. The score, the final diff, the rubric outcome, the decision record and a per-minute activity digest (counts, never content) remain for the code retention window. The person who rejects a candidate or archives a position is shown the deletion date before they confirm.
Both windows are configured per workspace. Shorten them and the sweep runs sooner; a request from your counsel to extend them for a specific dispute is a configuration change, not a support escalation.
6. Offboarding
On termination, or 60 days after an expired licence goes unpaid, the workspace is offboarded and we delete — completely and irreversibly:
- all candidate personal data: names, email addresses, ATS identifiers, and the CV-derived analysis;
- all candidate-authored code: patches, repositories, and the AI-drafted interview guides that quote them;
- all behavioural session records and integrity signals;
- your team's personal data: member names and email addresses;
- recruiter and reviewer notes.
One category of data survives offboarding, and we state it here rather than in a definition: anonymised, aggregated performance metadata — which challenge was attempted, the score, the band, and the time to completion, with every identifier above removed. After offboarding these records cannot be connected to any person or, beyond the workspace's internal identifier, to any of your candidates. We retain them for exactly one purpose: keeping the global calibration of our challenge library honest — knowing that a task's pass rate or completion time has drifted requires history. They are not sold, not shared, and not used to profile any person.
Evidence of legal acceptances is retained separately and for longer, because it is the record that we met our obligations to the candidate.
7. Breach notification
If we become aware of a personal data breach affecting your candidates' or your team's data, we notify you without undue delay after becoming aware of it, with what we know at the time: the nature of the breach, the categories and approximate volume of records concerned, the likely consequences, and the measures taken or proposed. We do not wait for the investigation to finish before the first notice, and we do not announce a breach affecting your data publicly before you have been told.
8. International transfers
Where personal data leaves its region of origin, transfers rely on Standard Contractual Clauses with each sub-processor.
9. Assistance and audit
We will assist you in responding to data subject requests, and in any data protection impact assessment you carry out for your use of the product. On reasonable notice we will make available the information necessary to demonstrate the commitments in this agreement — including the security posture document published alongside it.