What we record during an AI interview session
- Microphone audio — the candidate's voice during the conversation.
- Webcam video — the candidate's face and immediate background.
- A live transcript — text of what was said, by whom, with timestamps.
- Browser fraud signals — same as our text-based interviews: face presence, head pose, multiple-face detection, tab focus, copy-paste events. We do not record screen contents or other browser tabs.
Why we record it
- The recruiter who scheduled the screen reviews the recording + AI evaluation as part of their hiring decision.
- The candidate can replay their own session via the magic link they were sent.
- Our AI uses the transcript to score the candidate's answers and generate a written report for the recruiter.
- Aggregate, de-identified statistics may be used to improve the AI interviewer's behavior across the platform.
Where it lives
- Audio + video MP4: encrypted at rest in our private object storage (S3-compatible, hosted on Railway in the United States).
- Transcript: encrypted at rest in MongoDB (US region).
- The AI inference runs on OpenAI's Realtime API. Audio is streamed in and out for the duration of the conversation. Per OpenAI's API data-usage policy, your data is not used to train OpenAI's models.
- WebRTC routing is handled by LiveKit Cloud (US region). Media is encrypted end-to-end during transit.
How long we keep it
- Default: 90 days after the interview ends.
- If your interview was scheduled by an organization with a custom retention policy, that policy applies (always within 30–365 days).
- After the retention window, recordings are permanently deleted by an automated daily job. The interview record (score, transcript metadata) is retained for billing + audit, but the media artifacts and stitched transcript are gone.
Who can see the recording
- The candidate — via the magic-link replay page they were sent after the interview, for the full retention window.
- The recruiter who scheduled the screen — and only that recruiter. If they're an organization member, the organization owner/admin can also access it.
- Infyva super-admins — only when investigating a support ticket, fraud signal, or legal request. All super-admin access is logged.
- OpenAI processes the audio in real time but does not retain it (per their API data policy).
- LiveKit Cloud routes the media but does not retain it after the session ends.
- No third-party AI training, no advertising partners, no data brokers.
Candidate rights
- Right to access — candidates can replay any session within the retention window via the magic link they were sent.
- Right to portability — candidates can request a download of all their session data via privacy@infyva.ai; we deliver within 30 days.
- Right to erasure — candidates can request deletion of any specific session, or all their data, via privacy@infyva.ai; we delete within 30 days. Note: if a recruiter has already used the recording in a hiring decision, they retain a copy of the AI-generated written report (no audio/video) for their hiring records, per their own privacy policy.
- Right to human review — if a candidate believes the AI scored unfairly, they can request a human reviewer via privacy@infyva.ai. We'll have a human read the transcript and produce a second-opinion report at no cost, attached to the same session.
Bias and fairness
We've designed Nova, our AI interviewer, to assess candidates against the recruiter's stated job requirements, not against demographic factors. Nova does not see candidate names, photos, or other identifying details outside what's voluntarily shared during the conversation. We do not evaluate accent, appearance, or non-verbal cues. We periodically audit our scoring model for disparate impact across protected classes, and we publish an annual fairness report.
For roles in New York City, candidates have the right to opt out of automated decision-making per Local Law 144. Recruiters must surface this option before a hiring decision is made; we'll route the screen to a human reviewer at no cost to either party.
Subprocessors
We use the following third parties to deliver our AI interviews. Each has signed a Data Processing Agreement with Infyva.
| Subprocessor | Purpose | Region |
|---|---|---|
| OpenAI (gpt-4o-mini-realtime-preview) | Real-time AI conversation (audio in / audio out / LLM) | United States |
| LiveKit, Inc. (LiveKit Cloud) | WebRTC media routing (does not retain media) | United States |
| Railway Corp. | Application hosting (compute), Bucket object storage, MongoDB, Redis | United States |
| Stripe, Inc. | Subscription billing + metered overage usage | United States |
| Pusher Limited | Real-time UI notifications (does not see AI interview media) | United States / Europe |
| Functional Software, Inc. (Sentry) | Error tracking (no transcript content; session_id only) | United States |
We will provide 30 days' notice in this section before adding or replacing any subprocessor that processes AI interview session data. Customers under a Data Processing Agreement with Infyva can object during that window.
Security
- All data encrypted in transit (TLS 1.2+) and at rest (AES-256).
- Production data is segregated from staging and dev.
- Access to production media is logged and limited to a small ops team via SSO + 2FA.
- We are working toward SOC 2 Type II certification — current status is in our security overview.
Questions or concerns
Email privacy@infyva.ai for anything not covered here. We respond within 5 business days.
Change history
- 2026-04-26 — initial AI interview data-handling policy.