Privacy

Last updated 15 September 2026

Sophia records and analyses job interviews, which means we handle sensitive information about people who are often not our customers. This page explains exactly what we collect, why, who sees it and how to get rid of it.

Who is responsible for what

Two different relationships run through this product, and almost every other question on this page depends on which one applies.

When an employer uses Sophia to interview someone, the employer decides who is interviewed, what they are assessed on and what happens to the result. In data protection terms the employer is the controller and Sophia is the processor. We act on their instructions and we do not decide who gets hired or interviewed.

For the account itself, the billing details and the people who log in to use Sophia, we are the controller and this policy governs directly.

If you are a candidate who was interviewed and you want your recording deleted, the fastest route is to ask the employer who invited you. They can delete it themselves, immediately. You can also write to us at privacy@sophia.cleverhire.ai and we will pass the request on and help them action it.

What we collect

From candidates

Name and email address, given to us by the employer who invites you.
Your CV, if the employer uploads one, and the text extracted from it.
Video and audio of the interview, plus a shared view of your screen where you enable it.
A written transcript of what was said.
Measurements taken from the recording afterwards: where your eyes were pointed relative to your own baseline, whether a second face appeared, and whether you were visible. We describe this in full below.

From customers

Account and workspace details, and the name and email of each person you invite to your team.
The roles you create, the skills you choose to assess and the notes you write.
Payment records. Card details go to Stripe and never reach our servers.
Ordinary technical logs: IP address, browser, timestamps and error traces.

How Sophia evaluates candidates

Several laws require candidates to be told, before an interview is recorded, how the analysis works and what it looks at. Illinois requires it explicitly for AI video interviews. Here it is in full.

The interview itself. A voice agent asks questions based on the job description and the skills the employer listed, and follows up on your answers. It is not a fixed script. You are told at the start that you are speaking to an AI, and nothing is recorded until you consent.

The assessment. A language model reads the transcript and rates each skill the employer asked about, quoting the part of your answer it relied on. Skills the conversation never reached are reported as unassessed. No score is inferred from silence.

What it does not look at. Sophia does not assess your appearance, your accent, your tone of voice, your facial expressions or your personality. It does not infer age, gender, ethnicity, disability or emotional state, and it does not use any of those as an input. The assessment is based on what you said.

The integrity review. After the interview we analyse the recording for three things: whether your eyes moved away from your screen for a sustained period, whether a second face appeared, and whether you were absent from the camera. The result is a list of timestamps for the employer to watch. It carries no score, it never changes your assessment, and it never states that you did anything wrong. Gaze estimation is not accurate enough to support that kind of conclusion, and published research shows it performs unevenly across ethnicity, gender and age. We treat it as something a human should look at rather than something a machine should decide.

Sophia never makes a hiring decision. There is no automatic pass or reject, no ranking of one candidate against another, and candidates are never shown a score. A person at the employer reads the evidence and decides.

Why we are allowed to hold it

For candidate data we act on the employer's legal basis, which is normally their legitimate interest in assessing applicants. Separately, we ask you to consent before recording begins, and you can decline. If you decline, the interview does not proceed and no recording is made.

For customer and account data our basis is the contract between us, and our legitimate interest in keeping the service secure and working.

Who else sees it

We do not sell personal information, we do not share it for advertising, and we do not use interview recordings or transcripts to train AI models.

These are the companies that process data on our behalf:

Amazon Web Services — hosting, storage of recordings, and the computers that run the analysis. United States.
MongoDB Atlas — the database holding accounts, interviews and reports.
Stripe — payments. They handle card details directly; we only ever see the last four digits and the outcome.
OpenAI and Google — the language models that conduct the interview and write the assessment. Both are contractually barred from training on data sent through their APIs.
Cloudflare — serving this website.

We will also disclose information where the law genuinely requires it, and we will tell the affected customer unless we are forbidden from doing so.

Where it is held, and for how long

Data is stored in the United States. Where we handle information about people in the United Kingdom or the European Economic Area, transfers rely on the UK and EU Standard Contractual Clauses.

Recordings, transcripts and reports: 60 days by default. Customers can shorten this to 30 days in their workspace settings.
Account, workspace and billing records: for as long as the account exists, then seven years for the financial records tax law requires us to keep.
Technical logs: 30 days.
Anything under a legal hold: until the hold is lifted.

When a customer deletes an interview, or when the retention period ends, the recording and transcript are removed from live systems immediately and from encrypted backups within 30 days.

Your rights

Wherever you live, you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask for it in a portable format, or object to how we use it.

If you are in the UK or the EEA you also have the right to complain to your data protection authority. If you are in California you have the right to know, delete, correct and opt out of sharing, and the right not to be treated worse for exercising any of them. We do not sell your data, so there is nothing to opt out of.

Write to privacy@sophia.cleverhire.ai. We reply within 30 days. If you are a candidate, tell us the name of the employer who invited you, because it is the only way we can find your interview.

Security

Data is encrypted in transit and at rest. Recordings are served through short-lived signed links rather than public URLs. Access to production systems is limited to the engineers who need it, and every access is logged. Interviews are only visible to the person who created them and to administrators of that workspace. There are no guest links and no public report pages.

We are a small company and we would rather be plain than impressive: we do not yet hold SOC 2 or ISO 27001. If you need either before you can buy, tell us, because it affects how we prioritise.

Children

Sophia is for hiring adults. We do not knowingly process data about anyone under 16. If you believe we have, write to us and we will delete it.

Changes

If we change this policy in a way that materially affects you, we will email account administrators at least 14 days before it takes effect. The date at the top always reflects the current version.

Contact

Highbrow Technology Inc.
privacy@sophia.cleverhire.ai