Status — read first
AI-assisted best-effort draft · not legal advice · not lawyer-reviewed.
This document was drafted with AI assistance as a best-effort starting point. No licensed attorney has reviewed, approved, or certified it, and it is not safe to rely on as a binding or compliant document. A qualified attorney in each operating jurisdiction must review and finish it before it is published or enforced. Nothing here claims an audit, certification, corporate registration, or executed contract that has actually happened.
A licensed lawyer must confirm that each retention window below actually satisfies every statutory floor and ceiling that applies (EEOC 1602.14, the Illinois AI Video Interview Act's delete-on-request, GDPR Art. 5(1)(e)), and confirm that the product technically enforces the schedule, before any deletion or retention promise is published. The product now enforces the schedule automatically (soft-delete plus a nightly retention sweep) — see the enforcement note for exactly what is and is not built.
One schedule, everywhere
This retention schedule is the single source of truth. The Privacy Policy, the AI-compliance page, the DPA, the AEDT data page, and any accommodations page cite these numbers and do not restate them differently. Earlier, the site carried three different headline numbers (“12 months,” “life of account + 90 days,” and “until the recruiter deletes”) — a GDPR storage-limitation problem. The numbers below are the ones to use: transcripts, AI scoring, and audio (to the extent any is stored) are kept 12 months from interview completion; the recruiter account and its config live for the account lifetime plus 30 days; and operational request logs at our infrastructure subprocessors roll off in ~30 days.
Enforcement reality — read before relying on anything
The deletion machinery is now built. Tombstone columns (dataDeletedAt, deletedAt) exist, and a scheduled TTL sweep (/api/cron/retention-prune) runs nightly: it scrubs candidate personal data that has been inactive for 12 months and hard-deletes each scrubbed tombstone within 30 days. An explicit erasure request — candidate self-service, or the recruiter acting for their own candidate — scrubs the personal fields immediately while keeping non-personal counts so aggregates stay accurate. The one earlier promise still not built is the “signed deletion receipt.” The enforcement note below states precisely what runs today and the two items counsel should still confirm.
How deletion works today — and the two items counsel should still confirm
- Deletion mechanics (built). The model is retain-by-default via soft-delete plus right-to-erasure on request. Tombstone columns (
dataDeletedAt,deletedAt) exist, and a nightly retention job (/api/cron/retention-prune) enforces the schedule: candidate personal data untouched for 12 months is scrubbed automatically, and each scrubbed tombstone is hard-deleted within 30 days. On an explicit erasure request — candidate self-service via the invite link, or the recruiter acting for their own candidate — the personal fields (name, email, phone, transcript, AI report, recruiter notes) are scrubbed immediately across the candidate and interview rows, while non-personal counts are kept so quota and funnel totals stay accurate. The only deletion feature still not built is the optional “signed deletion receipt” some earlier drafts described; counsel confirms this schedule meets each statutory floor before it is relied on. - Audio. Whether any audio file persists depends on the LiveKit egress configuration, which engineering has not confirmed. We do not claim “we never store audio” until that is verified. If egress records, the audio retention row applies and the claim must change.
The schedule
| Data | Default retention | Trigger | Notes |
|---|---|---|---|
| Candidate identity row | 12 months from last interaction | Last interview, application, or email | Retain-by-default via soft-delete. The nightly retention job scrubs PII at 12 months and hard-deletes the tombstone within 30 days. Recruiter-initiated erasure and candidate self-service both scrub PII immediately on request. |
| Interview audio (if any is stored) | 12 months from completion | completedAt | Storage is unconfirmed — reconcile with the audio note before relying on this row. |
| Interview transcript | 12 months from completion | completedAt | Stored on Interview.transcriptJson. |
| Interview AI scoring and rationale | 12 months from completion | completedAt | Stored on Interview.scoreJson. EU AI Act Art. 12/19 log-keeping ≥6 months. |
| EmailDispatch audit row | 24 months | createdAt | Deliverability / spam dispute. |
| AuditLog (recruiter actions) | 24 months | createdAt | Security incident review. |
| SecurityLog | 24 months | createdAt | Breach forensics. |
| Candidate.consentJson | 6 years — counsel to confirm | Kept as long as processing relied on it | Counsel checks 6 years against data-minimization; do not over-retain. |
| Candidate.unsubscribeToken | Reconsider "indefinite" — counsel to decide | Suppression-list obligation (CAN-SPAM §5) | Indefinite retention of a token tied to a person is hard to defend under GDPR; a hashed suppression entry may suffice. |
| Recruiter User / Session / Account | Account lifetime + 30 days | Account deletion | Better Auth standard. |
| Billing rows (Stripe / Polar) | 7 years | Tax floor | Do not delete. |
The audio note
The audio row assumes audio is stored. Whether it actually is depends on the LiveKit egress configuration, which engineering has not confirmed, and it directly contradicts any “audio is never persisted” claim. We confirm the real behavior before relying on either statement: if nothing is stored, we say so and drop the row; if egress records, the row stands and the “never stored” claim must change. The two cannot both stand.
Jurisdictional carve-outs
- EEOC 1602.14: applicant records for covered US employers must be kept at least one year from the personnel action. A 12-month default sits right at that floor — counsel confirms the interaction, because a deletion-on-request under another law could pull below it for the same record.
- Illinois AI Video Interview Act: a candidate can require deletion of all copies within 30 days. Honored through the self-service deletion path, which scrubs the personal data on request and hard-deletes the tombstone within 30 days.
- NYC Local Law 144: bias-audit results are published, and the audit is retained one year.
Counsel's job is the hard part: confirming a single 12-month default does not violate AIVIA's 30-day delete-on-request while still meeting the EEOC one-year floor. These pull in opposite directions for the same record, and only a lawyer should resolve it.
Subprocessors
The single canonical subprocessor list is below. The Privacy Policy and the DPA render from this same list so the three pages cannot disagree. If a vendor is not on this list, it is not processing personal data.
| Subprocessor | Purpose | Data categories | Processing location | Transfer mechanism | Retention by subprocessor |
|---|---|---|---|---|---|
| Vercel Inc. (US) | Hosting the web app, APIs, and agent runtime | All categories, at request time | US | DPA + EU SCCs — verify executed + capture version/date | Logs ~30 days |
| Neon, a Databricks company (US) | Managed Postgres for application data | All categories, at rest | US, us-east-1 (production). us-east-2 is the separate QA database and holds no production candidate data | DPA + EU SCCs — verify | Per Vettika's retention schedule |
| LiveKit Inc. (US) | Real-time audio transport for the interview | Interview audio | US | DPA + EU SCCs — verify | Egress/recording behavior must be confirmed — see the audio note |
| Deepgram Inc. (US) | Speech-to-text, via LiveKit Inference | Interview audio (streamed) | US | DPA + EU SCCs — verify | Zero-data-retention target — verify contractually |
| Google LLC (US) | Gemini LLM, via LiveKit Inference, for interviewer dialog and scoring | Transcript snippets, scoring context | US | DPA + EU SCCs — verify | Zero-data-retention target — verify contractually |
| Cartesia Inc. (US) | Text-to-speech for the interviewer voice | Interview turn text (no identity) | US | DPA + EU SCCs — verify | Zero-data-retention target — verify |
| Resend (US) | Transactional email | Recipient email, subject, body | US | DPA + EU SCCs — verify | ~30 days in dispatch logs |
| Upstash Inc. (US) | Rate-limiting store (Redis) | IP and token hashes for rate limits | US | DPA + EU SCCs — verify | Short-lived rate-limit keys |
| Cloudflare Inc. (US) | Turnstile bot/abuse check on auth forms | IP, challenge token | US | DPA + EU SCCs — verify | Per Cloudflare policy |
| Google LLC (OAuth) | Recruiter "Sign in with Google" | Recruiter identity, email, OAuth token | US | DPA + EU SCCs — verify | Token lifetime |
| Have I Been Pwned (HIBP) | Breached-password check at signup | k-anonymized password hash prefix only (no email, no full password) | US/UK | Assess — likely not a personal-data processor given k-anonymity; counsel to confirm | None retained by Vettika's use |
| Stripe Inc. (US) | Recruiter payment processing | Recruiter billing identity, payment metadata | US | DPA + EU SCCs — verify | Per Stripe policy |
| Polar Software Inc. (US) | Alternative billing surface where used | Recruiter billing identity | US | DPA + EU SCCs — verify | Per Polar policy |
Error tracking (Sentry or similar) is not selected. No vendor is listed here until one is actually in use. Vettika gives recruiter customers 30 days' advance notice before adding or replacing a subprocessor; a recruiter who objects may terminate per the DPA.
Where data lives
The Service is provided by Vettika, a service operated by Nexprove across two domains it operates — vettika.com and airecruiter.nexprove.com — which share the same production infrastructure described here. Transcripts, structured reports, scores, and recruiter notes live in a Postgres database hosted on Neon in us-east-1 (production) with at-rest encryption. us-east-2 is the separate QA database and holds no production candidate data. Vercel runs the application and agent runtime in the US. Whether any audio file persists depends on the unconfirmed LiveKit egress configuration described in the audio note above.
Security and breach notice
TLS in transit, encryption at rest for the database, least-privilege access, encrypted secrets, server-side campaign-ownership checks, and audit plus security logging for privileged actions and authentication events. Production and QA run against separate databases so QA activity never touches production candidate data. A vulnerability contact lives at /.well-known/security.txt. We notify affected recruiter customers of a personal data breach without undue delay and no later than 72 hours after becoming aware — the single breach window shared by the Privacy Policy and the DPA. Penetration testing is planned, not yet completed, and is not represented as done.