Privacy Policy

Overview

This Privacy Policy describes how SkillSauce, Inc. (“SkillSauce,” “we,” “us,” or “our”) collects, uses, stores, shares, transfers, and protects personal data when you use our website, platform, and related services (collectively, the “Services”).

SkillSauce operates on hardened, access-controlled infrastructure designed so that you and other authorized users in your organization access your data through the platform-not SkillSauce personnel in the course of normal operations.

The majority of customer and candidate data stored on our secure servers is protected by encryption at rest (including industry-standard algorithms such as AES-256) and encryption in transit (TLS 1.2+). Combined with role-based access control (RBAC), least-privilege permissions, and tenant isolation, this means SkillSauce staff do not have standing or routine ability to read, browse, export, or inspect your account content. Data is decrypted and presented only when you (or another authorized user acting within permissions you define) authenticate to the Services.

SkillSauce personnel do not have unrestricted administrative access to customer or candidate records. Any exceptional internal access-for example, security incident response, legal compliance, or support you explicitly request-is strictly limited, individually authorized, time-bound, logged in immutable audit records, and subject to confidentiality obligations. We do not use your stored data for advertising, profiling, or unrelated commercial purposes.

Our application for compliance with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF is currently under review.

Definitions

Personal data: Information relating to an identified or identifiable individual, such as name, email address, employment history, assessment responses, and account identifiers.

Sensitive data: Special categories of personal data (such as gender or nationality), collected only with explicit opt-in consent where applicable.

Google user data: Information received from Google APIs or Google Sign-In-limited to profile fields and OAuth 2.0 tokens within scopes you approve on the consent screen. SkillSauce does not receive or store Google account passwords or login credentials.

OAuth token: A scope-limited authorization credential issued by Google that allows SkillSauce to identify your linked account and perform only the Google API actions you explicitly approved-not unrestricted access to your Google account.

Processing: Any operation performed on personal data, including collection, recording, organization, storage, adaptation, alteration, retrieval, disclosure, or deletion.

Client / Customer: An organization or recruiter that uses SkillSauce to administer assessments and hiring workflows.

Candidate: An individual who participates in an assessment or hiring process initiated by a Client through SkillSauce.

Data Ownership & Roles

Who is responsible for candidate data?

Each SkillSauce Client that administers an assessment owns the data of candidates who take that assessment. The Client is responsible for updating and deleting candidate data upon valid request. SkillSauce acts as a data processor for candidate personal data on behalf of Clients and provides tools and support to help Clients fulfill privacy obligations.

When you create a SkillSauce recruiter account, we act as a data controller for account registration and billing data necessary to provide the Services to you.

Who can access your data?

You control access. Your SkillSauce account data is reachable only through authenticated sessions on our secure servers. Role-based access control (RBAC) and organization-level permission settings determine which users within your account can view or manage specific hiring and candidate data. Candidates can access their own assessment-related information only as exposed through the platform for their session.

SkillSauce does not operate as a silent observer of your data. Our secure server architecture is designed so that, under normal operations, SkillSauce employees cannot open, read, or download your stored recruitment data. The platform decrypts and serves data to you and your authorized users-not to SkillSauce staff for discretionary review.

The only narrow exceptions are when access is technically necessary and explicitly justified-for example, responding to a support ticket you initiate, investigating a confirmed security incident, or complying with valid legal process. Such access is restricted to authorized personnel, logged, and governed by internal security policies and confidentiality obligations.

Data We Collect

Recruiter and account data

If you register for or use a SkillSauce account, we may collect:

• Name
• Email address
• Phone number (optional)
• Company and billing details provided during signup
• Authentication and session information

Candidate assessment data

When a Candidate begins an assessment session initiated by a Client, we store the following on behalf of that Client:

• Email address and name
• Optional fields at the Client's discretion: phone number, education details, academic degree, major, programming experience, resume, and links to professional profiles (such as GitHub or LinkedIn)
• Assessment and survey responses, scores, and related evaluation outputs
• Employment history and professional qualifications where collected for assessment purposes

Proctoring and session metadata

Where online proctoring or integrity monitoring is enabled by the Client, we may collect metadata such as:

• IP address and approximate location
• Browser usage data
• Webcam snapshots (where enabled)
• Session recording data (where enabled)

Proctoring features and specific data points are optional and configured at the Client's discretion.

Website and marketing data

When you visit our website, we may collect device and usage information, IP address, cookies, and analytics events as described in the Cookies & Tracking section below.

Automated decision-making

Automated systems may be used to grade or evaluate assessments based on predefined criteria. You have the right to request human intervention, contest automated decisions, and understand the logic involved, subject to applicable law and the role of your recruiting organization.

Legal bases for processing (GDPR)

• Consent - where required, including sensitive data and optional proctoring features
• Contractual necessity - to provide the Services
• Legal obligation - to comply with applicable laws
• Legitimate interests - for security, fraud prevention, and service improvement using aggregated or de-identified data

Service improvement

We may analyze disassociated and aggregated data to identify patterns that help improve the Services-for example, expanding our assessment library based on in-demand skills or prioritizing features based on usage trends. We do not use Google user data for these purposes. We do not use Google user data or any other user personal data to train, fine-tune, or improve TESSA AI or any other AI models.

Google Sign-In, Calendar & Google User Data

This section describes how SkillSauce accesses, uses, stores, shares, transfers, and discloses information received from Google Sign-In and Google APIs, including OAuth tokens and Calendar data.

Self-hosted AI model (TESSA AI): SkillSauce uses a self-hosted AI model named TESSA AI. TESSA AI is a set of artificial intelligence models that SkillSauce developed, hosts, and operates on its own infrastructure. It is used across the SkillSauce platform (for example, AI interviews, candidate shortlisting, and related hiring features). TESSA AI is not a third-party AI service and has no links with any third-party AI provider.

We do not use Google user data for SkillSauce's own purposes beyond Sign-In and Calendar. In particular, SkillSauce does not use Google user data-or any other user personal data-to train, fine-tune, improve, or develop TESSA AI or any other AI models. We do not feed Google data or user data into TESSA AI for model training, and we do not share Google data, personal data, or TESSA data with anyone outside SkillSauce. See TESSA AI - self-hosted AI models below for the full description.

Google Sign-In and account linking

When you choose to sign up or log in with Google, SkillSauce requests only the Google permissions displayed on the OAuth consent screen at the moment you authorize access-nothing more.

What we receive: Your name, email address, Google account identifier, and profile picture (only if included in the scopes you approved on the consent screen).

What we do not receive, store, or possess: We do not collect, receive, store, or have access to your Google account password, username/password combination, or any other Google login credentials. SkillSauce never sees how you sign in to Google.

What we store instead: We store only a limited OAuth 2.0 access token and/or refresh token issued by Google. These tokens are cryptographic authorization credentials-not login credentials. They are used solely to:

• Identify you and authenticate your SkillSauce account on return visits
• Link your SkillSauce profile to your Google account
• Call Google APIs for the specific Calendar actions you authorized on the consent screen

Scope boundary: These tokens do not grant SkillSauce unrestricted, blanket, or administrative access to your Google account. We cannot access Gmail, Drive, Contacts, Photos, or any other Google product or data type unless you explicitly granted that scope on the consent screen-and we request only the minimum scopes required for Sign-In and interview scheduling. We access only the Google data and API actions covered by the scopes you approved; we do not exceed, expand, or repurpose those permissions. We do not use Google Sign-In data to train or improve TESSA AI or any other models, and we do not use it for advertising, profiling, or any purpose other than authentication and account linking as described above.

Google Calendar (virtual interviews)

If you authorize Calendar access, SkillSauce uses it only to create and manage calendar events for virtual interviews you schedule through our platform (for example, event title, date/time, attendees, and meeting details).

We do not use Google Calendar data for advertising, analytics, profiling, AI/ML training, fine-tuning, or improving TESSA AI or any other models-or for any purpose unrelated to interview scheduling within SkillSauce.

TESSA AI - self-hosted AI models

What is TESSA AI? TESSA AI is SkillSauce's self-hosted AI model (a set of AI models). SkillSauce developed TESSA AI in-house, hosts it on SkillSauce infrastructure, and operates it as part of the SkillSauce product. TESSA AI is used across the platform-including AI-powered interviews, candidate shortlisting, and related recruitment features-to help deliver SkillSauce services to you.

Self-hosted - not third-party: TESSA AI is self-hosted by SkillSauce. It is not provided by Google, OpenAI, or any other external AI vendor. TESSA AI has no affiliation, integration, partnership, or data link with any third-party AI provider.

We do not use Google data or user data to train or improve TESSA AI: SkillSauce does not use Google user data, Google Calendar data, OAuth tokens, or any other user personal data to train, fine-tune, improve, retrain, or develop TESSA AI or any other AI models. User data is notused anywhere for AI model training or model improvement. TESSA AI runs as SkillSauce's own self-hosted models without learning from your Google account data or using your data to build or improve those models.

No sharing of personal, Google, or TESSA data: SkillSauce does not sell, rent, transfer, disclose, or otherwise provide your personal data, Google user data, or TESSA AI data to any third party. Your Google data is used only for the Sign-In and Calendar features you authorize-not for SkillSauce AI training, and not shared with anyone for AI or any other secondary purpose.

Relationship to Google Sign-In and Calendar: Google Sign-In and Google Calendar are used only for account authentication and interview scheduling as described in this section. Google user data is not sent to TESSA AI for training, is not sent to third-party AI providers, and is not used by SkillSauce to improve any AI models. TESSA AI does not rely on Google or any other third party to run its models.

How we store and protect Google user data

Google profile fields and OAuth tokens are stored on SkillSauce secure infrastructure within your designated data region, using defense-in-depth safeguards:

• Encryption in transit - TLS 1.2+ (HTTPS) for all communication between your browser, our servers, and Google APIs
• Encryption at rest - OAuth tokens and associated Google user data are encrypted at rest using industry-standard algorithms (including AES-256) on our secure servers
• Token isolation - OAuth tokens are stored separately from general application data, with strict access controls; they are never treated as reusable login credentials
• Least-privilege access - internal systems access tokens only as required to perform scope-authorized API calls on your behalf; SkillSauce staff do not have routine access to decrypt or view your Google tokens or linked Google profile data
• Scope enforcement - our integration layer validates every Google API request against the scopes you granted on the consent screen before execution

Your Google-linked data remains in the data region associated with your account or location (see Data Residency). We do not copy, mirror, or transfer your Google user data to other geographic regions except where strictly necessary to deliver the authorized feature within that region or as required by applicable law.

SkillSauce does not use Google user data to train or improve AI models, build independent user profiles, conduct surveillance, or support unrelated analytics or advertising.

Google user data - retention and deletion

OAuth tokens and associated Google user data are retained only for as long as needed to provide the authorized features or until you revoke access, disconnect your Google account, or delete your SkillSauce account-whichever comes first.

You may revoke SkillSauce's access at any time via your Google Account permissions. Upon revocation or account deletion, we delete or anonymize associated Google user data and tokens within our standard retention period, except where retention is required by law.

Google API Services - Limited Use disclosure

SkillSauce's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We limit use of Google user data solely to providing the user-facing Sign-In and Calendar features that are prominent in SkillSauce's interface and disclosed on the OAuth consent screen. We do not use Google user data to train, fine-tune, improve, or develop TESSA AI or any other AI/ML models. We do not use Google user data for any other purpose, and we do not access Google data beyond the approved scopes.

Sharing, Transfer, and Disclosure of Google User Data

Data Management

Data portability and export

SkillSauce provides tools for Clients to export hiring and candidate data. Depending on your subscription, the super administrator of your organization can export candidate and assessment data from the SkillSauce dashboard. Eligible customers may also use integration APIs to export, retain, or archive data in line with organizational policies. Contact [email protected] or your account manager for export options available on your plan.

Audit logs

SkillSauce maintains logs of state-changing actions for troubleshooting and security purposes. Super administrators can view audit logs from their dashboard. Additional audit log export or processing requests can be submitted to [email protected].

Candidate data requests

Because Clients control candidate data, requests from Candidates to access, correct, or delete personal data are forwarded to the relevant Client. Clients determine whether a request is valid and direct SkillSauce on how to proceed. SkillSauce supports Clients in fulfilling these requests through product features and support channels.

Data Residency

Your data stays in your location. SkillSauce customers who have agreed to our terms select the country or region where their production data is stored. We treat that selection as a binding residency commitment-not a preference.

Candidate assessment data, chat history where applicable, performance information, account records, OAuth tokens, and related platform data are stored exclusively in your chosen data region on geo-resident secure infrastructure. We do not silently replicate, mirror, or route your production data through other regions for convenience, analytics, or SkillSauce internal review.

Data residency controls are enforced at the infrastructure layer so that your information remains physically and logically separated within the region you select, helping you meet corporate policies and regulatory requirements (including GDPR locality expectations where applicable).

Google user data linked to your account follows the same residency rules: it is stored only in your designated region and is not moved across borders except where strictly required to perform the Google API actions you authorized or as required by law.

To move data to a different residency region, contact your SkillSauce account manager or [email protected] to discuss required changes. Moving regions does not change platform functionality for recruiters or candidates.

Cookies & Tracking

Cookies are small text files sent to your device that enable SkillSauce features. We use session-based cookies (deleted when you close your browser) and persistent cookies (until deleted or expired).

SkillSauce uses first-party cookies and third-party cookies for analytics and site optimization, including Google Analytics (via Google Tag Manager). Some cookies remember your login status; others support analytics and customization on our marketing website.

Categories:

• Essential / account - authentication and security
• Performance and analytics - understanding site and product usage (subject to your cookie consent choices on our website)
• Preferences - remembering settings where applicable

SkillSauce does not serve third-party advertising cookies on the platform. You can manage cookie preferences through our cookie consent banner or your browser settings. Limiting cookies may affect personalization and some features.

SkillSauce does not collect personal information about your online activities over time and across third-party websites for cross-context behavioral advertising. “Do Not Track” browser signals do not alter our practices because we do not engage in that form of tracking.

Additional detail is available in our Cookie Policy.

Security & Storage

Security measures

SkillSauce stores personal data on secure, hardened servers protected by multiple layers of technical and organizational controls. Our security program includes:

• Encryption at rest and in transit - AES-256 (or equivalent) at rest; TLS 1.2+ in transit
• Role-based access control (RBAC) and least-privilege permissions for all internal systems
• Tenant isolation - logical and infrastructure separation between customer environments
• Zero standing access - SkillSauce personnel do not maintain persistent, unrestricted access to decrypt or browse customer content in normal operations
• Immutable audit logging - state-changing actions and exceptional access events are recorded for security and compliance review
• Continuous monitoring - threat detection, intrusion prevention, and incident response processes
• Secure software development - security reviews, dependency management, and vulnerability remediation

Under this architecture, your data is safe on our secure servers: it is encrypted, region-bound, and in ordinary use accessible only when you or your authorized users authenticate to the platform-not through discretionary SkillSauce staff access.

Data in transit is protected using TLS over HTTPS. We maintain audit and activity logging to support security investigations and compliance.

International data transfers

Personal data may be transferred internationally. Where required, we use Standard Contractual Clauses (“SCCs”) and EU-specific data transfer and processing agreements to help ensure an adequate level of protection for transfers involving the EU/EEA.

Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Right of access
• Right to rectification
• Right to erasure (“right to be forgotten”)
• Right to data portability
• Right to restrict or object to processing
• Right to withdraw consent where processing is consent-based

To exercise rights relating to candidate assessment data, contact the recruiting organization that invited you. To exercise rights relating to your SkillSauce account or Google-linked data, contact us at [email protected].

California residents (CCPA/CPRA): You have additional rights including the right to know, delete, and opt out of the sale or sharing of personal information. SkillSauce does not sell personal information. See our CCPA Notice.

Children: We do not knowingly collect personal data from individuals under 18. If we learn that we have collected such data, we will delete it promptly.

Third-party links: Our website may link to external sites. We are not responsible for their privacy practices.

Retention & Deletion

Personal data is retained only for as long as necessary to provide the Services, fulfill the purposes described in this policy, or comply with legal obligations.

Clients may configure retention periods for candidate personally identifiable information. Data is generally stored for the duration of the contracted period with the Client and a defined grace period thereafter, after which it is deleted in accordance with Client settings and our procedures.

When you delete data or close an account, production data is removed from active systems. Deleted data may remain in encrypted security backups for a limited period before being permanently purged. After backup retention expires, we cannot retrieve deleted information.

Law Enforcement & Government Data Requests

SkillSauce complies with valid legal process from government and law enforcement entities when required by applicable law. Requests should be sent to [email protected] and must include sufficient detail to identify the account and data sought, including agency identity, matter description, and official contact information from a government-issued email where applicable.

We construe legal process as narrowly as possible and review all requests for validity and appropriateness. We will notify the affected customer before disclosing data to government or law enforcement unless prohibited by law or if there is a clear indication of illegal conduct or risk of harm.

For third-party or civil requests, we encourage parties to work directly with the relevant SkillSauce Client. We assist only where legally necessary and where the Client cannot reasonably fulfill the request themselves.

Subprocessors

We use vetted third-party subprocessors to help operate the Services, including:

• Cloud infrastructure and hosting providers
• Email and communication services
• Payment processing providers (for billing)
• Analytics providers on our marketing website (where consented)
• Google (for Sign-In, Calendar, and analytics services you authorize or that apply to our website)

Subprocessors process data only on our instructions and under contractual confidentiality and data-protection obligations. We do not authorize subprocessors to use personal data for their own independent marketing purposes.

Global Compliance

SkillSauce is committed to compliance with applicable privacy laws, including the GDPR for European data subjects and the CCPA/CPRA for California residents. We embed privacy features into our Services and offer contractual commitments to support Client compliance obligations.

We have designated a Data Protection Officer (DPO) to oversee our data protection strategy. Privacy and DPO inquiries: [email protected].

The U.S. Federal Trade Commission has jurisdiction over our compliance with applicable U.S. privacy laws. For GDPR-specific information, see our GDPR page.

For data privacy disputes, we support independent recourse mechanisms consistent with applicable frameworks, including EU-U.S. DPF principles where applicable.

Breach Notification

We maintain monitoring to detect personal data breaches. If a breach involving personal data occurs, we notify affected Clients within 72 hours of becoming aware of the breach, where required by law, so Clients can notify authorities and affected individuals as appropriate.

General security incidents may be communicated through our blog or status channels. Incidents affecting specific users or organizations are communicated directly by email to the primary account contact.

Policy Changes

We review this policy periodically and update it when our practices or legal requirements change. Material changes will be posted on this page with an updated “Last updated” date. Where appropriate, we may notify account holders by email.

This policy is governed by U.S. federal law, subject to mandatory local privacy laws in your jurisdiction. If any provision is found unenforceable, the remaining provisions remain in effect.

You are responsible for maintaining the confidentiality of your login credentials and for notifying us promptly of any unauthorized account activity.

Contact Us

For privacy questions, Google user data requests, data deletion, or to exercise your rights, contact us:

You may also reach us through our Contact Us page.