Legal & Compliance

Privacy Policy

Last Updated: September 9, 2026

1. Overview

EvexAI ("we", "our", or "us") is committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard candidate, recruiter, and Google user data when you access our hiring intelligence platform and related services.

2. Information We Collect

We collect information necessary to provide AI-powered hiring, interview scheduling, and talent assessment:

  • Account & Recruiter Data: Name, email address, password hashes, company/team details, and role assignments.
  • Candidate Data: Name, contact details, resumes, candidate work samples, work trial responses, and recorded interview assessments.
  • Google User Data (When Authorized):
    • Profile & Identity Information: Google user ID, primary email address, and profile photo (via openid, userinfo.email, userinfo.profile) to authenticate users and setup workspace accounts.
    • Calendar & Scheduling Data: Calendar availability (free/busy slots) and calendar event creation permissions (via calendar.events) to schedule interviews and generate Google Meet video conference links.
  • Usage & Log Data: IP addresses, browser types, session timestamps, and operational system logs for security and performance optimization.

3. Google API Services & Limited Use Disclosure

EvexAI's use and transfer of information received from Google APIs to any other app will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

Specifically, we enforce the following restrictions on all Google user data:

  • No AI/ML Model Training: Google user data—including raw, aggregated, anonymized, or derived data—is never used, transferred, or sold to train, develop, or improve generalized or foundational machine learning (ML) or artificial intelligence (AI) models.
  • Specific Purpose Only: Google user data is accessed solely to provide user-facing features (signing in to your account and scheduling candidate interviews with Google Meet links on your behalf).
  • No Advertising or Monetization: We never sell Google user data, transfer it to third-party data brokers, or use it for personalized advertising or marketing.
  • Human Access Restrictions: Human personnel cannot access your Google user data unless you have given explicit consent for troubleshooting, it is strictly necessary for security audits, or required by law.

4. With Whom We Share, Transfer, or Disclose Data

We maintain strict limits on how your information is disclosed:

  • Interview Attendees: When you schedule an interview through EvexAI, interview details (date, time, title, and Google Meet URL) are shared directly with the designated candidate and recruiter attendees via Google Calendar invitations.
  • Infrastructure & Service Providers: We use reputable cloud infrastructure and hosting providers (e.g., cloud database hosting and transactional email dispatch) under strict data processing agreements. These vendors are prohibited from using your data for any other purpose.
  • Third-Party AI & Sourcing Services (Candidate & Requisition Analysis Only): We integrate with specialized, enterprise-grade AI processing endpoints strictly for candidate resume matching, work trial scoring, and public talent discovery. No Google Workspace or Google Calendar user data is ever sent to or processed by third-party AI model providers.
  • Legal Compliance: We will only disclose information if required by law, subpoena, or to protect the vital security interests of our users.
  • No Commercial Data Transfers: We never sell, rent, or trade your personal information or Google user data to data brokers, advertisers, or third-party marketing services.

5. Data Protection & Security Mechanisms

We implement comprehensive technical and organizational safeguards to protect sensitive and personal data:

  • Encryption at Rest: Sensitive authentication tokens (including Google OAuth refresh tokens) are encrypted at rest using industry-standard AES-256 (Advanced Encryption Standard) encryption before storage in our database.
  • Encryption in Transit: All data transmitted between your browser, our servers, and third-party APIs (including Google and Stripe) is encrypted in transit using TLS 1.3 / HTTPS cryptographic protocols.
  • Access Controls & Token Isolation: OAuth tokens are isolated at the database level and are accessible only to authenticated server-side background workers executing explicit user actions.
  • Key Management: Encryption keys are segregated from application data and managed through secure server environment configurations.

6. Data Retention, Revocation & Account Deletion

You maintain complete control over your data and connected integrations:

  • Disconnecting Google Integration: You can disconnect your Google account at any time from your EvexAI dashboard settings. Upon disconnection, your OAuth tokens are immediately revoked and permanently deleted from our database.
  • Revoking via Google Security: You can also revoke EvexAI's access at any time via your Google Account Permissions Page.
  • Data Deletion Requests (GDPR & CCPA): Users and candidates may request permanent deletion of their account records, resumes, and assessment history by emailing our privacy team.

7. Contact Us

If you have any questions, concerns, or data requests regarding this Privacy Policy or our compliance with Google API policies, please contact our Data Protection Officer at:

EvexAI Privacy & Compliance Team

Email: support@evexai.ink

Website: https://recruiter.evexai.ink