Hyrelix is an interview-as-a-service platform operated by Hyrelix Ventures ("Hyrelix", "we", "us"). We connect organisations hiring for technical roles with vetted interview panellists, and we host the interviews themselves.
For the purposes of the EU General Data Protection Regulation (GDPR) and India's Digital Personal Data Protection Act 2023 (DPDP), Hyrelix acts as:
We collect only what the service needs. Fields marked optional in our forms are genuinely optional.
| Category | Examples | Who it concerns |
|---|---|---|
| Account and identity | Name, email address, password (stored only as a hash by our identity provider — we never see or store your password), two-factor authentication enrolment | All users |
| Contact and locale | Mobile number, country, city/state and postal code, timezone | All users |
| Professional profile | LinkedIn profile URL, résumé/CV, role applied for or offered, seniority | Candidates, panellists |
| Interview content | Audio/video recording, code written in the coding pad, interviewer scorecard, AI-generated report | Candidates, panellists |
| Interview integrity signals | During a booked interview, from the candidate's device only: when and for how long the interview tab or window lost focus, the size (character count, not the content) of text pasted into the coding pad from outside it, periods when no face or more than one face was in view, and periods when the camera stopped. No images or video frames are sent for this. | Candidates |
| Payments and payouts | Transaction records, payout ledger entries, KYC information required of panellists we pay | Clients, panellists |
| Support and consent | Support ticket contents, consent records with timestamp and policy version, audit log of administrative actions | All users |
| Technical | IP address, device and browser information, sign-in timestamps, security events such as failed login attempts | All users |
We do not ask for, and you should not send us, special-category data — racial or ethnic origin, political opinions, religious beliefs, trade-union membership, genetic or biometric data for identification, health data, or data about sex life or sexual orientation. Demographic attributes are never used as inputs to interview scoring or panellist matching.
| Purpose | Legal basis (GDPR) | Basis (DPDP) |
|---|---|---|
| Creating and securing your account; authentication and two-factor | Contract; legitimate interests (security) | Consent; legitimate use |
| Scheduling and conducting interviews | Contract | Consent |
| Recording interviews and generating reports | Explicit consent, captured separately before each interview | Consent |
| Interview integrity checks during booked interviews | Explicit consent, captured with the recording consent before each interview; legitimate interests (fair assessment for the client and other candidates) | Consent |
| Verifying panellist identity and professional background | Contract; legitimate interests (platform integrity) | Consent |
| Processing payments and panellist payouts | Contract; legal obligation (tax and accounting) | Legal obligation |
| Fraud prevention and platform abuse detection | Legitimate interests | Legitimate use |
| Service emails (verification, reminders, receipts) | Contract | Consent |
| Marketing emails, where applicable | Consent, withdrawable at any time | Consent |
Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal. We do not use pre-ticked consent boxes.
Interviews on Hyrelix are recorded. Because this is intrusive, we treat it separately from your general account consent:
During a booked interview (not in the practice room), the candidate's browser records a small number of integrity signals, listed in section 2. You are told about them in the consent you give before each interview.
We do not sell personal data. We share it only as follows.
If you interview through Hyrelix for a client, that client receives your interview outcome, scorecard and report. They are a separate controller for how they use it in their hiring process.
| Provider | Purpose |
|---|---|
| Google (Firebase / Google Cloud) | Authentication, database, hosting, serverless functions, file storage (résumés, interview recordings) — asia-south1, Mumbai |
| Payment gateway [TO CONFIRM — provider not yet contracted] | Card and UPI payments, panellist payouts |
| Resend (Resend, Inc., USA) | Transactional email — interview scheduling notices, report-ready notices, résumé reminders. Receives your name, email address and the details in the message (role, company, interview time). Emails are sent from Resend's Tokyo region (ap-northeast-1); no link or open tracking is used. |
| SMS gateway [TO CONFIRM — not yet enabled] | Mobile number verification |
| LiveKit (LiveKit, Inc., USA) | Real-time interview audio/video. Media is routed through LiveKit's global network during the interview; the recording itself is written to our own Google Cloud storage in Mumbai and deleted after 24 hours. |
| Google Vertex AI (Gemini), within our Google Cloud project | AI interview report generation, from the code written in the interview and the panellist's scorecard. Recordings are not transcribed or sent to the AI. Processing uses Google's global endpoint, so it may take place outside India. |
We require each processor to handle personal data only on our instructions and to maintain appropriate security. [TO CONFIRM] Data processing agreements are being executed with each provider; the providers above are named now so you know who handles your data; we will note here when each agreement is in place.
We may disclose data where required by law, to establish or defend legal claims, or to protect the rights and safety of users.
Account and profile data is stored in Google Cloud's asia-south1 region (Mumbai, India). Some processors process data in other countries — currently the United States and Japan (email, via Resend), LiveKit's global network (live interview media) and Google's global AI endpoint (report generation). See section 5.
Where data of individuals in the European Economic Area or the United Kingdom is transferred outside that area, we rely on an appropriate safeguard — in most cases the European Commission's Standard Contractual Clauses. [TO CONFIRM] EU data residency can be offered to client organisations that require it; contact us to discuss.
| Data | Retention |
|---|---|
| Interview recordings | 24 hours, then deleted |
| Interview reports and scorecards | As required by the client contract, then deleted |
| Interview integrity signals and review decisions | Kept with the interview record and deleted with it; if you delete your account, your name is removed from any integrity flag |
| Account and profile data | While your account is active; inactive accounts reviewed annually |
| Financial and tax records | As required by Indian statute [TO CONFIRM — typically 8 years] |
| Security and audit logs | [TO CONFIRM] |
| Support tickets | [TO CONFIRM] |
You can delete your account yourself from your dashboard. Deletion takes effect immediately and cannot be undone: your profile, your résumé file and your sign-in are deleted at once. Interview reports and job applications that involve a client organisation are kept so the client's records stay complete, but with your name, email address and résumé removed. An audit record that the deletion took place is retained. Backups are purged on their normal rotation cycle.
Subject to local law, you may:
To exercise any of these, contact us using the details in section 13. We will verify your identity before acting, and respond within the statutory deadline — 30 days under GDPR, and within the period prescribed under DPDP.
If you are in the EEA or UK and believe we have handled your data improperly, you may complain to your local supervisory authority. In India, you may complain to the Data Protection Board of India.
No system is perfectly secure. If a personal data breach occurs, we will assess it and notify the relevant authority and affected individuals within the statutory timelines — 72 hours under GDPR, and as prescribed under DPDP.
We use strictly necessary cookies and local browser storage to keep you signed in and to remember your preferences. These are required for the service to function.
[TO CONFIRM] We do not currently run advertising or third-party tracking. Where analytics or other non-essential technologies are introduced, in jurisdictions that require it they will be set only after you give affirmative consent.
Hyrelix is not intended for children. You must be at least 18 years old to register as a candidate, panellist or client user. We do not knowingly collect data from children, and will delete such data if we discover it. [TO CONFIRM] Age assurance at registration is planned but not yet implemented.
We will post any changes on this page with a new version number and effective date. Where a change materially affects how we use your data, we will notify you and, where required, seek fresh consent. The version you consented to is recorded against your account.
For privacy questions or to exercise your rights: