Your interview and your data

You have been invited to a short interview run by HireCall, on behalf of the company you applied to. It takes a few minutes and you take it on your own phone, whenever suits you.

This page explains what is recorded, who sees it, how long it is kept, and how to have it deleted. It is written to be read, not to be scrolled past. If anything here is unclear, the contacts are at the bottom.

The short version

• You will be talking to an AI, not a person. We say so before we start, and we say so again here.
• What you say is written down as you speak. In a voice interview, a recording of the audio is also kept. In a written (text-only) interview, nothing is recorded.
• The company you applied to gets a written summary of what you said, with each point linked back to your own words.
• No machine decides anything about you. Whether you go forward is decided by a named person at the company.
• The recording is deleted after 90 days. The transcript and the summary are kept for up to 12 months. Ask, and everything is deleted sooner.
• You do not have to do this. If you would rather not be recorded, tell the company — see If you would rather not below.

Who is responsible for what

Two organisations are involved, and it matters which is which.

The company you applied to decides to run the interview, sets the questions, reads the result and decides what happens next. Under data protection law it is the controller — the one legally responsible for your data. If you want to exercise a right, that is who you go to. Their name and contact details are in the invitation you received.

HireCall builds and runs the interview for them. HireCall is a processor: it acts on the company's instructions and does not use your interview for its own purposes. HireCall does not sell your data, does not use it to advertise to you, and — see below — does not use it to train AI models.

HireCall is a trading name of DIGITSOLUTIONS, a French company registered with the RCS of Rennes under number 977 519 586.

What actually happens during the interview

You call in, or open the link, from your own phone. Then:

1. Before the first question, you are told what is recorded, what it is for, and how to have it erased — and you are asked to agree. What is kept as proof of your agreement is the time you agreed, the exact version of the text you were shown, and the language it was shown in. Your IP address is not recorded — proving what you actually saw is better evidence than where your connection came from, and it means keeping less about you.
2. An AI interviewer asks you a set of questions written for the specific job. Everyone applying for that job gets the same structured interview.
3. Your voice is captured and transcribed as you speak, and a recording of the audio is kept for the period stated below.
4. It lasts around a few minutes.

Some interviews run in writing instead. If the company has chosen the text-only mode, no audio recording is made or kept: your speech is turned into text as you talk and only the text is retained — or you type your answers. The screen you see before the interview tells you which kind yours is.

To confirm. The product's text-only consent variant states that the interview is not recorded and that voice is processed in real time and not retained. The descriptions above must track the exact consent wording shown in the product (v2/v3), mode by mode.

The questions are about the job: what you have done, how you did it, what happened. They are not about your age, your health, your origin, your religion, your political views, your sexuality, your family situation, whether you are a union member, or anything else the law protects. If you are ever asked something that feels like it strays into that territory, please tell us — the contacts are at the bottom, and we want to know.

What the company receives

The company gets a written brief: what you said about each of the things the job calls for, with every claim traceable to a specific point in your transcript. Where the evidence for something is not there, the brief says so rather than guessing.

Depending on how the company has set things up, it may also be able to read your full transcript or listen to the recording.

To confirm. Whether the recruiter can play back the audio, and whether the raw transcript is exposed in the console or only the brief, changes what this paragraph should say. The product team must confirm the actual behaviour — this notice has to describe the product as built, not as intended.

What is deliberately not produced

HireCall does not generate, and the company does not receive:

• a score — there is no number out of 100, and no overall "fit" rating;
• a ranking or leaderboard placing you above or below other candidates;
• an automatic rejection — nothing rejects you on its own;
• any analysis of your tone, your accent, your emotions or your personality;
• any inference about characteristics the law protects.

That last one is worth spelling out: HireCall does not attempt to work out how you were feeling from how you sounded. Inferring emotions from people in a workplace or hiring setting is prohibited in the EU under Article 5 of the AI Act, and HireCall does not do it anywhere, including for candidates outside the EU.

Nobody is rejected by a machine

Under Article 22 of the GDPR you have the right not to be subject to a decision based solely on automated processing that significantly affects you. A hiring decision is exactly that kind of decision.

Every outcome — invited to the next stage, kept on file, or turned down — is an action taken by an identified person at the company you applied to. The HireCall system does not take that action and cannot take it. It produces evidence; a human reads it and decides.

If you want to know more about how the interview was used in the decision about you, or you want to contest that decision or put your point of view to someone, you can ask the company. They are required to be able to answer.

⚠️ The most important review point in this document.

This paragraph is a promise about the employer's behaviour, made by HireCall, in a document candidates will rely on. HireCall cannot see whether a recruiter genuinely weighed the brief or simply forwarded whatever it said.

This is not a theoretical worry. In SCHUFA (C-634/21, 7 December 2023) the Court of Justice held that an automated output produced by one company can itself be an Article 22 decision where the company receiving it draws strongly on it. A brief that a recruiter follows without real scrutiny is squarely within that reasoning.

Two things must follow, and neither is drafting work:

1. The customer terms and the DPA must place a contractual obligation on the employer to ensure a competent person with authority to reach a different outcome actually reviews the brief. That obligation is drafted in terms-of-service.md and dpa.md.
2. The product should make rubber-stamping visibly hard — for example by requiring the named decision-maker and a reason to be recorded before an outcome is set. Whether it does this today is unconfirmed.

Until both are in place, this paragraph is stronger than the facts support.

Is my voice "biometric data"?

A fair question, and the honest answer has two parts.

Recording and transcribing your voice is not, by itself, biometric data under the GDPR. European law treats voice as biometric data only when it is processed by specific technical means in order to identify you uniquely — voiceprinting, in other words. HireCall records what you say and writes it down. It does not build a voiceprint, does not use your voice to verify who you are, and does not match your voice against any other recording.

In some places the line sits differently. Illinois, in the United States, treats a "voiceprint" as a biometric identifier under a law that requires written notice and written permission before any collection, and lets individuals sue directly. Techniques that sound innocuous — separating speakers in a recording, generating a voice "embedding" — have been argued to cross that line.

So the position stated to candidates is: HireCall captures your voice to transcribe what you said, and for no other purpose.

✔ Verified in HireCall's own code, 19 August 2026 — but the check is a standing duty, not a one-off. A source review found no voiceprinting, speaker embedding or diarization anywhere in HireCall's own code, and the product's consent copy affirmatively commits to not assessing biometric signals. The only diarization capability present sits inside a vendored third-party SDK, disabled by default and unused.

The exposure is therefore latent, not current — but it is one configuration flag and one provider change away. Before each release, and whenever a speech provider or SDK is changed, re-confirm that nothing performs speaker diarization producing a persistent voice embedding, voice-based identity or liveness checking, anti-fraud voice matching, or speaker recognition — at HireCall or at any sub-processor (the speech-to-text provider still processes the raw voice, so its terms matter too).

If any of those ever exist, this section is wrong, and much more than this section changes: Illinois BIPA requires written notice and a signed written release before collection, with statutory damages per affected person and a private right of action, and under the GDPR the data becomes special category data under Article 9 requiring explicit consent. See README.

How long it is kept

Two different clocks run, and it is honest to tell you about both:

• The audio recording of your interview is deleted 90 days after you take it — automatically, by a scheduled job, without anyone having to remember. The deletion is logged, so it can be shown that it happened.
• Your transcript and the written summary are kept for up to 12 months, so the company can finish its hiring process and answer questions about it.

Or sooner, if you ask. If you ask for your interview to be erased, it is erased — recording, transcript and summary. You do not have to give a reason.

⚠️ Review point — the public claim is narrower than the truth.

The retention periods above are what the product actually does, verified in source on 19 August 2026: a 90-day automatic purge of audio (configurable per customer), and a 12-month horizon for transcript and brief stated in the product's own consent copy. The HireCall landing page, however, says only "Deleted after ninety days ... automatically, or the day a candidate asks" — with no mention of the 12-month transcript period. That is a material omission in a public promise and the landing page must be reworded, not this notice softened to match it.

Three further points for counsel:

1. HireCall is a processor. The schedule must be an agreed instruction from the employer, which is how dpa.md clause 4.2 now records it.
2. The employer may need it longer. In France a discrimination claim can be brought up to five years from when the claimant became aware of it. The 12-month transcript period helps; deleting audio at 90 days is still a choice the employer must make knowingly.
3. "The day a candidate asks" promises more than Article 17 requires — erasure has exceptions, including defending legal claims. HireCall may exceed the law deliberately, but the employer must agree to it in the DPA.

Retention is configurable per customer in the product, which is what the pricing page's "custom retention" refers to — so the two public pages can be reconciled by stating 90 days / 12 months as defaults and disclosing that a different agreed period is always shown in this notice.

If the company that invited you has agreed a different retention period with HireCall, this notice will say so: retention period for this interview: [[RETENTION PERIOD]].

Where your data is kept

Your recording and transcript are stored in the European Union. That is what the consent text you agree to in the product says, and it is what this notice says. Every outside company involved in running the interview is named in a signed agreement with your employer-to-be.

You can ask the company which providers are involved. HireCall publishes the list of its sub-processors at [[SUBPROCESSOR PAGE URL]].

⚠️ Review point — storage is in the EU, processing is not always. The landing page previously said "Pick EU or US at setup", then "stored in the EU and never leave it". Both were withdrawn on 22 August 2026: the page now says audio is stored in the EU and that processing outside it runs under standard contractual clauses, which is what the in-product notice tells the candidate. Verified against the product source on 19 August 2026: there is no region selection anywhere in the product — no residency field in the data model, all three versions of the in-product consent copy hardcode "stored in the EU", and the object-store region is not pinned per customer. The site's EU-or-US claim must be withdrawn until the capability exists, or the capability must be built before the claim is repeated to anyone.

If US storage ever ships while the in-product consent string still says "stored in the EU", the consent shown to candidates is false and the disclosure invalid — the consent copy, this notice and the DPA must all change before the first US-hosted interview, not after.

Even the EU statement needs one engineering confirmation: the object-store region must actually be pinned to an EU location rather than left on its "auto" default, and the same must hold for model inference, speech fallback, backups, logs and support access. If any leg cannot be pinned, narrow the claim to what is true — "stored in the EU" is defensible if storage is what is guaranteed. See README.

Is my interview used to train AI?

No. Your interview is not used to train or improve any AI model, by HireCall or by any provider it uses.

⚠️ Must be verified. This is one of the two or three questions candidates and works councils ask first, and one of the easiest to get wrong. It requires confirming that zero-retention / no-training terms are actually enabled on every AI provider account — not merely available on the price list — and that this is written into each sub-processor contract. If it cannot be confirmed for every provider, this section must say something narrower. Do not publish an unverified "no".

Your rights

You have the right to:

• know what data is held about you and get a copy of it;
• correct anything inaccurate;
• have it deleted;
• object to it being processed, or ask for it to be paused while a disagreement is sorted out;
• receive your data in a portable form;
• not be subject to a decision made solely by a machine — see above;
• speak to a human about a decision, express your point of view, and contest it.

How to use them. Because the company you applied to is the controller, requests go to them, and their contact details are in your invitation. If it is easier, you can contact HireCall at [[CANDIDATE CONTACT EMAIL]] and HireCall will pass your request to them and help them act on it. HireCall cannot decide the request itself — that is the company's call — but it will not be the reason your request goes unanswered.

You should get an answer within one month.

If you are not satisfied, you can complain to a data protection authority. In France that is the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr. If you live elsewhere in the EU, you can complain to your own country's authority.

If you would rather not

You are not obliged to take an AI interview.

If you would prefer to be interviewed by a person, or you do not want to be recorded, tell the company that invited you — their contact details are in the invitation. Ask for another way to be assessed.

⚠️ This is the load-bearing sentence of the whole notice, and it depends on something outside HireCall's control.

HireCall's public position is that "nothing is kept without consent". For consent to be valid under the GDPR it must be freely given, which means there has to be a real alternative and no penalty for using it. If declining the AI interview means the application stops, the consent is not free, and the legal basis collapses — taking the public claim down with it.

Note also that this is not only a data protection point in France. French employment law requires that a candidate be informed in advance of the methods and techniques used to assess them, and that those methods be relevant to the job. Article references to be confirmed by French employment counsel — we believe Articles L.1221-6, L.1221-8 and L.1221-9 of the Code du travail are the relevant provisions, and Article L.2312-38 for consultation of the CSE before introducing the tool.

Three things must be settled before this notice goes live:

1. Does an alternative route actually exist? Is the employer required by the HireCall terms to offer one? (Drafted as an obligation in terms-of-service.md.)
2. What happens to a candidate who declines — do they continue in the process on equal terms? The answer has to be yes.
3. Is consent the right legal basis at all, or is the employer's legitimate interest (or pre-contractual steps) the sounder basis, with consent reserved for the recording specifically? This is a decision for counsel, and it needs to be the same answer here, in the DPA, and on the marketing site.

Separately: New York City requires that candidates be told at least ten business days in advance where an automated employment decision tool is used, and be able to request an alternative process. If HireCall sells to employers hiring in NYC, that notice period has to be built into the invitation flow — it cannot be retrofitted into this page.

Under 16?

HireCall interviews are for job applicants. If you are under 16, please do not take the interview without a parent or guardian knowing — tell the company instead.

To confirm. France sets the digital-consent age at 15. If HireCall's customers recruit apprentices or alternants, minors are genuinely in scope and this section needs to be more than a line. Confirm whether under-18 candidates are expected.

Contacts

The company that invited you — in your invitation email. They decide about your data.

HireCall — [[CANDIDATE CONTACT EMAIL]]. For questions about how the interview works, or to be put in touch with the right person.

HireCall's privacy contact — privacy@hirecall.ai.

Last updated: [[PUBLICATION DATE]]