Privacy Policy

1. Who we are and what this policy covers

This Privacy Policy explains how Soreon (“we”, “us”, “our”) collects, uses, shares, and protects personal data when you use Soreon - the real-time AI copilot for human interviewers - including our website, the interviewer console, and related services (together, the “Service”). It also explains the rights you have under the EU General Data Protection Regulation (“GDPR”) and how the EU Artificial Intelligence Act (“AI Act”) applies to how the Service is built and used.

Soreon is operated by [Soreon legal entity], established in [country] at [registered address]. If you have any questions about this policy or how your data is handled, contact us at hello@getsoreon.com.

Controller and processor roles. For personal data captured during interviews - including recordings, transcripts, and any candidate personal data - the organization that uses the Service to run interviews (our customer, the “Customer”) is the data controller, and we act as a data processor on that organization’s documented instructions. For account, website, and demo-request data, we act as the controller. Where we act as a processor, this policy is provided for transparency and does not replace the Customer’s own privacy notice to candidates.

2. The personal data we process

Depending on how you interact with the Service, we may process the following categories of personal data:

• Account and sign-in data - your name, email address, organization, role, and approval status, obtained when you sign in with Google and when an administrator approves your account.
• Interview content - audio, video, and the resulting transcript of interviews the Service is used to capture, and any personal data spoken during them. This can include personal data about candidates and other participants.
• AI-generated records - competency signals, suggested follow-up questions, and editable scorecards the Service produces from an interview, together with the evidence they link back to.
• Website and demo-request data - the information you submit through the “book a demo” or contact forms, and basic technical data (such as IP address and browser type) needed to operate and secure the site.
• Essential cookies and local storage - the small amount of data described in section 9, used to sign you in and to remember your cookie choice.

3. How and why we use personal data, and our legal bases

We use personal data only for the purposes below, and only where we have a legal basis under Article 6 GDPR:

• To provide the Service - capturing interviews, producing suggestions and scorecards, and giving interviewers the console - on the basis of performance of a contract with the Customer, or the Customer’s instructions where we act as processor.
• To manage accounts and access - creating, approving, securing, and administering user accounts - on the basis of our (or the Customer’s) legitimate interests in operating a secure, access-controlled service.
• To communicate with you - sending account-approval, notification, and transactional emails - on the basis of legitimate interests or, for demo requests, your consent or steps taken at your request.
• To keep the Service secure and reliable - logging, monitoring, and preventing misuse - on the basis of our legitimate interests and legal obligations.
• For interview recording and transcription, the Customer is responsible for establishing the appropriate legal basis and for informing and obtaining any consent required from candidates and other participants before the Service is used.

4. AI processing and the service providers we use

The Service uses AI models to analyze interview transcripts and generate suggestions and scorecards. This processing is carried out on our behalf by a small number of vetted service providers (sub-processors), each bound by contract to protect the data and to process it only on our instructions:

• Recall.ai - joins the meeting as a participant to capture and transcribe the interview. Recall calls are directed to its EU region.
• Amazon Web Services (AWS) - hosts the application and stores data in the Frankfurt (eu-central-1) region, and provides the AI models (Amazon Bedrock) used to generate suggestions and scorecards. AI inference runs on the EU inference profile.
• Google - used solely to authenticate sign-in (we receive your name, email, and profile identifier); Google does not receive interview content.
• Our email provider - sends transactional and account emails (such as approval and notification messages).

5. Where your data is processed and international transfers

We are structured to keep interview content and AI processing within the European Union (our infrastructure and AI inference run in Frankfurt, eu-central-1). Some providers that support the Service - such as those handling meeting capture or email delivery - are established outside the European Economic Area. Where personal data is transferred outside the EEA, we rely on appropriate safeguards under the GDPR, such as the European Commission’s Standard Contractual Clauses, and take additional measures where required.

6. How long we keep personal data

We keep personal data only for as long as needed for the purposes described in this policy. Account data is kept while your account is active. Interview recordings, transcripts, and scorecards are retained on the Customer’s instructions and deleted or anonymized within [retention period] after they are no longer needed, unless a longer period is required by law. Website and demo-request data is kept for [retention period] and then deleted.

Where we act as processor, we delete or return interview and candidate data on the Customer’s instruction and on termination of their agreement, except where retention is required by law.

7. Your rights

Subject to the conditions in the GDPR, you have the right to access the personal data we hold about you; to have inaccurate data corrected; to have data erased; to restrict or object to processing; to data portability; and, where processing is based on consent, to withdraw that consent at any time. You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects - see section 8.

If you are a candidate or interview participant, the organization running the interview is the controller of that data, and you should direct requests about your rights to them; we will support them in responding. For data where we are the controller, contact us at hello@getsoreon.com. You also have the right to lodge a complaint with your local data-protection supervisory authority.

8. Automated decision-making, profiling, and the EU AI Act

Soreon is designed to augment, not replace, human judgement. It surfaces evidence and uncertainty and privately suggests follow-up questions; it does not make hiring decisions. Every conclusion is intended to link back to a moment in the interview so a person can review it, and a human interviewer remains responsible for all decisions. We do not use the Service to make decisions about candidates based solely on automated processing within the meaning of Article 22 GDPR, and Customers are contractually required not to do so either.

Because it is used to evaluate candidates in a recruitment and selection context, the Service falls within a category the EU AI Act treats as high-risk. We build the Service to meet the AI Act’s expectations for such systems - including human oversight, transparency, logging, and evidence-linked output - and, where the Service constitutes a high-risk AI system, we act as its provider and the Customer acts as its deployer. The Customer is responsible for informing candidates that AI is used to assist the interview and evaluation, and for the deployer obligations that apply to them. The Service is never to be used to infer emotions, deception, or personality from a candidate’s face or voice; that use is prohibited under the AI Act and is not a purpose Soreon is designed or licensed for.

9. Cookies

The marketing website uses only essential cookies needed to operate the site and to sign you in. It does not use advertising or third-party tracking cookies. When you first visit, a notice lets you accept or decline, and your choice is stored locally in your browser so the notice does not reappear. Because the cookies we set are strictly necessary to provide a service you have requested, they are used to keep the Service secure and functional.

10. How we protect personal data

We use technical and organizational measures appropriate to the risk, including encryption in transit, access controls and role-based permissions, per-organization isolation, and audit logging of AI decisions. Access to interview content is limited to what is needed to operate the Service.

11. Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date above, and, where changes are significant, take reasonable steps to bring them to your attention.

12. Contact

For any question about this policy or to exercise your rights, contact us at hello@getsoreon.com. This Privacy Policy should be read together with our Terms & Conditions.