How Itya handles personal data

Itya is a product of Trovakap Private Limited, a company incorporated in India (“Trovakap”, “we”, “us”). This Privacy Policy applies to Itya websites, applications, interview-workflow services, and support channels that link to it. It covers information about workspace members, candidates, interview participants, visitors, and people who contact us.

When an organization uses Itya for hiring, that organization normally decides why and how candidate and interview information is processed. For that information the organization is the controller, business, or data fiduciary, and Trovakap acts as its processor or service provider.

Trovakap is the controller, and the data fiduciary under India’s Digital Personal Data Protection Act 2023, for its own records: workspace accounts, billing, website visits, security logs, support requests, and direct communications.

Your employer, recruiter, or prospective employer may provide an additional privacy notice. Their notice governs the hiring decisions and practices they control.

The information we process depends on how you and your organization use Itya:

• Account and workspace details: names, business email addresses, roles, organization settings, authentication events, and preferences.
• Hiring and interview content: candidate profiles, job context, scheduling details, meeting attendance, consent states, recordings when enabled, transcripts, notes, scorecards, debriefs, and follow-up tasks.
• Technical and usage data: device, browser, IP address, session, diagnostic, feature‑usage, integration‑health, and audit-log information.
• How you found Itya: your answer, if you give one, to the optional “How did you hear about Itya?” question when you create a workspace, and the Itya page and campaign tags carried by the sign-up link you clicked. The public site sets no cookie to collect this; the link carries it.
• Commercial and support data: subscription, invoice, billing-contact, support-request, and related correspondence.
• Connected-service data: information authorized from calendars, meeting platforms, applicant tracking systems, messaging tools, and other integrations.

Interview content can include sensitive information volunteered during a conversation. Organizations and interviewers should avoid requesting or entering information that is not necessary for a fair, job-related evaluation.

We process information to:

• Provide, operate, maintain, and support Itya and its connected workflows.
• Authenticate users, enforce workspace permissions, prevent abuse, and keep audit records.
• Deliver requested interview features such as capture, transcription, search, debriefs, scorecards, reminders, and value reporting.
• Manage trials, subscriptions, usage limits, invoices, and customer support.
• Diagnose reliability issues and improve accessibility, safety, and product performance.
• Understand, in aggregate, which pages, guides and channels bring new customers, so we know what to keep publishing.
• Meet legal obligations and enforce our agreements.

We do not use candidate interview content for behavioral advertising. Where we rely on consent, you may withdraw it subject to applicable law and the organization’s retention obligations.

Where data-protection law requires a legal basis, processing may be necessary to perform a contract, support our legitimate interests in operating a secure business service, comply with law, protect vital interests, or act on consent. The basis depends on the person, data, feature, and jurisdiction involved.

Customer organizations are responsible for choosing a lawful basis for the hiring data they place in Itya and for providing any notices or collecting any consents their process requires.

Itya can use automated systems to transcribe interviews, organize evidence, draft summaries, map content to configured rubrics, and suggest follow-up work. These features assist human reviewers; they do not replace the organization’s responsibility for hiring decisions.

Workspace members should review AI-assisted output for accuracy, relevance, unsupported claims, and inappropriate use of protected or sensitive information before relying on or sharing it. Provider access is limited to what is needed to deliver configured features and is governed by applicable service-provider terms and safeguards.

An organization can switch on integrity checks for its interview room and AI screens. The candidate is told on the page before they join, and nothing is captured from anyone who was not shown that notice. While the candidate is in the interview, the page notes when they switch to another tab or window, start or stop sharing their screen, copy text, or paste text from outside the interview — only that it happened, for how long and how long the pasted text was, never what was copied or pasted; whether a paste came from outside is decided on the candidate’s own screen, and pasting their own work again is not noted. If the candidate’s camera is on, a still photo is taken from it when they join and every few minutes; no photo is taken while the camera is off or from a shared screen, and the camera is optional. A recorded interview’s transcript is also checked for how long the candidate paused before answering and how even their pace was.

These notes and photos are shown only to the organization’s hiring team, as prompts for a person to look more closely. They are never used to reject anyone automatically, and no face recognition, face matching or other biometric processing is performed. Photos are deleted 30 days after they are taken; the other notes follow the interview record’s retention. Candidates can object or ask about this data through the organization that interviewed them, or through the data-request page.

We may disclose information to:

• Authorized members and administrators of the relevant workspace.
• Infrastructure, hosting, communications, analytics, payment, support, security, and AI service providers working for us under appropriate obligations.
• Integrations and third parties that a workspace administrator chooses to connect.
• Advisers, authorities, or other parties when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or complete a corporate transaction.

We do not sell candidate interview content. Workspace administrators control which members and connected services can access their organization’s records.

Interview recordings, transcripts and uploaded candidate files expire on the workspace’s retention policy. The default is 30 days, and a workspace administrator can set it anywhere from 7 to 365 days. The deletion deadline for a recording is fixed at the moment consent is captured, from the policy then in force, so a later policy change cannot extend the life of an interview a candidate has already sat.

Here is the full default per data class.

Until deleted means a record is kept until a candidate or an administrator asks for it to be deleted, or the workspace is closed; nothing expires it automatically.

Deletion may be delayed where a record is under legal hold, is needed for a live security investigation, or is subject to another lawful obligation. If that applies to something you asked us to delete, we will tell you and tell you why. A deletion is applied to live systems first and works through encrypted backups as those backups expire on their normal cycle.

We use administrative, technical, and organizational safeguards designed to protect information, including access controls, encryption, monitoring, and audit logging. No method of transmission or storage is completely secure, so customers should also configure roles, integrations, and retention carefully.

Trovakap is established in India, and the providers that process information for us do so in the locations named on our subprocessor list, which include the United States, the European Union, and the hosting region configured for the deployment. Information may therefore be processed in a country other than your own.

Transfers of personal data out of India are made only to countries to which the Government of India has not restricted transfers under the Digital Personal Data Protection Act. Transfers of personal data that is subject to EU or UK data protection law rely on the transfer mechanism recorded for each provider on the subprocessor list, usually the EU Standard Contractual Clauses with the UK Addendum. We make additional information available during a customer security review.

Depending on your location — under the EU or UK GDPR, India’s Digital Personal Data Protection Act 2023, or a US state privacy law — you may have rights to access, correct, delete, restrict, object to, or receive a copy of personal information, and to appeal or complain to a regulator. Identity verification may be required before we complete a request.

If a customer organization controls the record, we may route the request to that organization or assist it in responding. You can start with our verified data-request workflow or contact us using the details below. You can manage product communications through the message or workspace preference where available.

Where India’s Digital Personal Data Protection Act 2023 applies to personal data we process as data fiduciary, you have these rights:

• Access — obtain a summary of the personal data we process about you and the processing activities, and the identities of those we have shared it with.
• Correction and erasure — have inaccurate or incomplete data corrected, completed or updated, and have data erased once it is no longer needed for the purpose it was collected for, unless the law requires us to keep it.
• Withdrawal of consent — withdraw consent where we rely on it, as easily as you gave it, without affecting processing that happened before.
• Grievance redressal — raise a grievance with us and receive a response, as described below.
• Nomination — nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

Use the verified data-request flow or email legal@itya.ai. For candidate and interview data that a hiring organization controls, that organization is the data fiduciary: we pass your request to it and help it respond.

Send a grievance about how we process your personal data to legal@itya.ai with “Grievance” in the subject line.

Tell us what the grievance is about and how to reach you; do not include passwords or unnecessary candidate information. If you are not satisfied with our response, you may complain to the Data Protection Board of India once you have used this grievance route.

We use cookies and similar browser storage that are necessary for authentication, security, locale, theme, preferences, and reliable operation. We may also use limited measurement data to understand performance and feature adoption. Browser controls can remove stored data, but disabling necessary storage may prevent parts of Itya from working.

This section applies to residents of California and of other US states with a comprehensive consumer privacy law. For personal information Trovakap processes through Itya on a customer’s behalf, Trovakap is a service provider (a “processor” in most other states) and the customer organization is the business. Requests about that data are routed to the customer.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the preceding twelve months, including for consumers under 16. We do not use or disclose sensitive personal information for any purpose beyond those permitted without a right to limit.

Categories collected. Identifiers (name, email, phone, account and device identifiers, IP address); customer records (employment and education history in a resume, professional information); professional or employment-related information (interview responses, evaluations, hiring decisions); internet activity (product usage and audit events); audio and visual information (consented interview recordings and the transcripts made from them); and commercial information (subscription and billing records). Inferences are limited to the AI-drafted evaluations a human reviews before use.

Sources. You, when you create an account or submit an application; the customer organization that entered your record; systems the customer connects at its own direction; and the service itself as you use it.

Purposes. To provide, secure, support and improve the service; to run the hiring workflow the customer configured; to bill; to detect and prevent abuse; and to comply with law. We disclose personal information for a business purpose only to the service providers named on our subprocessor list, each under a contract that restricts them to that purpose.

Your rights. Subject to verification and to the exceptions in the applicable law, you may request to know the categories and specific pieces of personal information we hold, to access a portable copy, to correct inaccurate information, to delete it, and to opt out of sale or sharing — which for us requires nothing, because neither happens. To exercise any of them, use the verified data-request flow or email legal@itya.ai. An authorized agent may act for you with written permission and proof of identity.

We answer within 45 days and may extend once by a further 45 days with notice. If we decline, we will say why and how to appeal; an appeal is decided within 45 days.

Non-discrimination. We will not deny you service, charge you a different price, or give you a lower quality of service because you exercised a privacy right. We run no financial‑incentive program tied to personal information.

Itya is a business hiring service and is not directed to children. Do not use the service to collect children’s information unless your organization has confirmed a lawful, age-appropriate process and we have agreed to support it.

We may update this policy as the service, law, or our practices change. We will update the date above and provide additional notice when a material change requires it. Contact security@itya.ai with privacy or data-protection questions, or see every way to reach Trovakap Private Limited on the contact page.