Privacy Policy

1. Scope and roles

First Round SI ("First Round," "we," "us") is controller for account, platform, job-seeker, talent-network, outreach, security, and guest-demo data that we determine how to use. For candidate interview data submitted or collected for an employer Customer, the Customer is controller and First Round is its processor, acting on documented instructions. Candidates should ordinarily direct rights requests about an employer interview to that Customer; we will assist the Customer as required.

1.1 Data we process

We process account identity and contact details; company profiles, users, permissions and scheduling/workforce data; interview questions, rubrics and job listings; candidate names, email, resumes, parsed resume fields, application answers, transcripts, recordings, scores, grades, evaluations and recommendations; coaching content; and talent-network information. Application answers are encrypted at rest and may be cryptographically signed to preserve integrity.

We process payment transaction identifiers through a third-party checkout but do not store full card numbers. We may process SMS preferences and message metadata; phone-verification events (codes are stored only as short-lived HMAC hashes and one number may be limited to one account); connected social-account data authorized by the user; SI assistant and agent chat logs; business outreach and lead intelligence; and access, audit, security, device, usage, metering and rate-limit logs.

1.2 Voice, video, biometrics and automated observations

The interviewer is a computer-generated ElevenLabs voice agent, not a person. Audio is processed for interview delivery, realtime or batch transcription, and evaluation. We do not create a voiceprint or use candidate voice for biometric identification. Realtime streaming speech-to-text is the official transcript and follows the same scoring and retention rules as batch transcripts.

Where a Customer enables video, we may process video, face imagery and related technical signals. Voice or face information may qualify as biometric information under BIPA, Texas CUBI, Washington law or similar laws. The Customer must provide required notice, obtain written consent, maintain a lawful retention/destruction schedule, and prohibit sale or improper disclosure. Automated visual observation, attention, integrity, sentiment, smoking or vaping outputs are estimates, not facts. We do not estimate, store or display apparent ethnicity, gender or age, and outputs must never be used to infer a protected characteristic or make an automated hiring decision.

1.3 Inferred and SI-generated data

We derive interview summaries, competency signals, rubric scores, recommendations, integrity flags, sentiment estimates, job-listing drafts, resume-parsing output and usage analytics. SI outputs may be inaccurate. Multilingual transcription and translation may contain errors and require human review, especially for high-stakes decisions; language choice must not create disparate impact.

1.4 Purposes and legal bases

Under GDPR Article 6, we process account and contracted service data to perform a contract; billing, tax, compliance and verified consent records to meet legal obligations; security, product reliability, limited business analytics and fraud prevention for legitimate interests; marketing and optional cookies with consent where required; and candidate interview data on the Customer's documented instructions. Where special-category or biometric data is involved, the Customer must identify an Article 9 condition and obtain explicit consent where required. Consent may be withdrawn without affecting earlier lawful processing.

2. Sharing and subprocessors

We disclose data to authorized Customer users and vetted providers for cloud hosting/storage, authentication, ElevenLabs voice delivery, transcription/SI processing, Base44 Payments checkout, email/SMS, analytics, monitoring and support. Current categories and provider details are available through Support. Providers are contractually limited to the service they perform. We do not sell biometric data or use candidate audio to identify a person.

3. Retention

Account and contract records are kept during the relationship and generally seven years thereafter where needed for tax, fraud and claims. Candidate interview content is retained for the Customer-configured period or, absent configuration, up to three years after the hiring process; Customers may require earlier deletion. Raw demo audio is kept up to 30 days; demo transcripts and consent evidence up to two years. Verification events are kept up to two years, while raw codes expire within minutes. Payment records are kept seven years; security and access logs up to two years; support and agent chats up to three years; marketing preferences until withdrawal plus suppression evidence; biometric source data only for the disclosed purpose and no longer than three years after the last interaction, or sooner where law requires. Backups age out on controlled schedules. Legal holds may extend these periods.

4. Rights and choices

Depending on location, a person may request access, correction, deletion, portability, restriction or objection; withdraw consent; appeal a refusal; and complain to a regulator. California and similar laws may provide rights to know, delete, correct, limit sensitive-data use, opt out of sale/sharing or targeted advertising, and receive equal service. We honor legally recognized Global Privacy Control signals for the browser where applicable. We verify identity and respond within applicable deadlines. There are no solely automated hiring decisions: Customers must provide meaningful human review. See Terms of Service §6.

5. Security, transfers and incidents

We use role-based access, encryption in transit and at rest, integrity signatures, logging, monitoring and incident response. No system is perfectly secure. International transfers rely on adequacy decisions, Standard Contractual Clauses and transfer-impact assessments as applicable. We notify controllers and regulators without undue delay and, where GDPR applies, support notification within 72 hours after awareness when required; affected people are notified where law requires.

6. Children and contact

The service is not directed to children under 16 and is not for employment interviews below the lawful working age. Contact Support for privacy requests, our Data Protection Officer, Article 27 representative details, subprocessor information, or accessibility accommodations. Candidates should identify the relevant employer and interview.

Server trust, cryptographic integrity and protected fields

Policy acceptance is established from server records, not browser state. For each decision, the server computes a SHA-256 hash of the exact policy text shown and signs the acceptance envelope—including the user, policy, version, server timestamp, signature name, and text hash—with an HMAC-SHA-256 key unavailable to the browser. A record is treated as current only after server verification succeeds and its version matches the currently published version. Hashing proves text integrity; it is not encryption and does not by itself prove that a person read every provision. Sensitive application answers, support content, phone data, signatures, and comparable protected fields are encrypted at rest with AES-256-GCM where the feature requires field-level protection, while transport uses TLS.

Last revised September 15, 2026 (Version 1.1). Previous versions are available in the policy archive.

2026 Platform Protections Addendum

1. SI output limitations

SI-generated or automated outputs may be incomplete, inaccurate, delayed, or unsuitable for a particular purpose. Users must apply qualified human review before relying on material decisions.

2. No professional advice

The service does not provide legal, medical, financial, employment, safety, engineering, or other regulated professional advice.

3. Feature availability and discretion

Plans, models, integrations, credits, limits, prices, and features may change. FirstRound SI may limit, pause, replace, or disable a feature at its sole discretion for safety, compliance, provider availability, abuse prevention, or product operations.

4. Credits, billing, and taxes

SI credits fund recorded provider costs, are not cash, and are not transferable unless expressly stated. Taxes may apply. Recurring credits do not roll over unless checkout terms expressly say otherwise.

5. Third-party services

Connected providers, models, payment processors, data sources, and external links operate under their own terms and may change or become unavailable without notice.

6. Account and credential security

Users are responsible for safeguarding accounts, links, tokens, devices, and credentials and for promptly reporting suspected unauthorized use.

7. Content rights and permissions

Users must have the rights and permissions needed for uploaded, generated, recorded, or shared content and must not submit unnecessary secrets or regulated personal data.

8. Demo, alpha, and beta services

Demo, alpha, beta, preview, and experimental services are provided for evaluation, may reset or contain simulated data, and must not be treated as production guarantees.

9. Abuse prevention and enforcement

FirstRound SI may investigate, rate-limit, suspend, remove, preserve, or disclose activity as reasonably required to prevent fraud, abuse, harm, infringement, or legal violations.

10. Policy changes and continued use

Material changes are published as a new version and may require renewed acceptance. Continued use after the effective date constitutes acceptance where permitted by law.