This policy explains what biometric data the Infyva service can involve, the consent we ask for first, how long it is kept and how it is destroyed. It is our public retention schedule and destruction guidelines for laws such as the Illinois Biometric Information Privacy Act (BIPA), and it also covers similar laws in Texas and Washington and special category data under the GDPR and UK GDPR.
1. In short
- Infyva does not create face templates or voiceprints from interviews, and does not use facial recognition to identify candidates.
- The only feature that uses face geometry is the optional ID check, run by a separate identity provider, only for jobs that turn it on and only after the candidate's separate written consent. Infyva receives only the result.
- Nothing biometric is ever sold, leased, traded or used for profit.
2. Features this policy covers
| Feature | What happens | Biometric data stored by Infyva |
|---|---|---|
| Optional face presence check | Off unless the candidate turns it on. A detector inside the candidate's browser counts whether no one, one person or more than one is in view. No video or image leaves the browser. | None. Only the count result is kept, with the integrity signals. |
| Face presence check in live AI interviews | Off unless the candidate turns it on. Every few seconds a still frame is checked for how many people are in view, then discarded. | None. Only the counts are kept. |
| Optional ID check (jobs that use it) | An identity provider (none is switched on in this service today) compares the face on a photo of the candidate's government ID with a live selfie. | None. Infyva receives only "verified" or "not verified". The provider holds the images and the comparison. |
| Recordings of answers | Audio, and video for jobs set to video answers, so the hiring team can review them. They are not used to make voiceprints or face templates, and are never analysed by AI for the face or voice. | No biometric identifiers are extracted. The recordings themselves follow the retention schedule below. |
| Voice check | Not offered. Any voice profile left from an older version of the service expires 24 hours after it was made and is deleted by the next daily job, so within 48 hours. | None from current interviews. |
3. Consent before collection
Before the ID check, the candidate sees a separate notice that says biometric data will be collected, why, by whom and for how long, and gives written consent by ticking a box and continuing. We store the consent record with the notice version (2026-10-19), the time, the IP address and the browser. The face presence check also has its own opt-in item on the interview notice. Declining either one never stops the interview; the report simply says "not checked". Candidates can withdraw consent at any time by emailing privacy@infyva.ai.
4. Retention schedule
| Data | Who holds it | Destroyed |
|---|---|---|
| ID photo, selfie and the face comparison | The identity provider | Within 30 days of the check, or sooner on an erasure request |
| ID check result (verified or not) | Infyva | 2 years after the interview, by a daily job. This is not biometric data. |
| Face presence results (counts only) | Infyva | With the integrity signals, 2 years after the interview. This is not biometric data. |
| Legacy voice profiles | Infyva | Expire after 24 hours; deleted by the next daily job, within 48 hours |
| Consent records for these checks | Infyva | 3 years, kept as proof of consent |
| Answer recordings (audio or video) | Infyva | 90 days after the interview, by a daily job |
In every case biometric data is permanently destroyed when the purpose for collecting it has been met, and never later than 3 years after the person's last interaction with us, whichever comes first.
5. How data is destroyed
- Infyva's daily retention job deletes records that reach the end of their period. It does not wait for a request.
- An erasure request deletes the person's records across the service and asks the identity provider to delete its copy.
- The identity provider's own deletion period is set in our account with it and in our contract with it.
6. Use and disclosure
Biometric data is used only to confirm that the person interviewing is the person invited, for that application. It is never used to score answers. It is disclosed only to the identity provider that runs the check, and otherwise only where the law requires it. We do not sell, lease, trade or otherwise profit from it.
7. Security
We protect this data with the same or better care as other confidential data, as described on our security page, and require the identity provider to do the same by contract.
8. Employers
The hiring company decides whether a job uses the ID check and remains responsible for its own legal duties, for example a consent waiver for facial recognition in interviews under Maryland law. Infyva provides the notice, the consent record and the deletion described here to support those duties.
9. Contact
Questions or requests: privacy@infyva.ai or our privacy request page. See also the candidate privacy notice.