Privacy Policy

This Privacy Policy explains how [LEGAL_ENTITY_NAME] (“we”, “us”), the operator of iVerse and the EVA platform, collects, uses, stores, and protects personal information. It applies to visitors to evaandcompany.com, candidates who complete assessments on assess.evaandcompany.com, and recruiters using recruit.evaandcompany.com. If you have questions after reading this, email privacy@evaandcompany.com.

1. Data controller

The data controller is [LEGAL_ENTITY_NAME], company number [COMPANY_NUMBER], registered at [STREET_ADDRESS], [CITY]. Where required, we can be reached through our contact address above for questions about this policy or requests under the GDPR, UK GDPR, CCPA, or Israel's Protection of Privacy Law.

2. What we collect

We collect three broad categories of information:

• Candidate profile data — name, email, professional history, links to public work, and any other information you submit when registering or applying through EVA.
• Assessment data — your responses to structured evaluations, timing and completion metadata, and any files or work samples you upload. These are the core artefacts that make matching possible.
• Technical data — IP address, browser and device information, and basic analytics (pages visited, referral source). We use privacy-respecting analytics and do not sell this information.

3. Legal basis

We process candidate data on the basis of your consent (given when you register) and on the legitimate interest of matching your profile to relevant opportunities. We process employer and recruiter data on the basis of the contract we hold with the corresponding organisation.

4. Retention

Candidate profile and assessment data are retained for as long as your account is active, plus a maximum of 24 months after your last login, after which the data are deleted or fully anonymised. You can request earlier deletion at any time by emailing privacy@evaandcompany.com. Server logs are retained for 90 days.

5. Sub-processors

We rely on a small number of infrastructure and service providers to operate the platform. Each is bound by a data-processing agreement:

• Amazon Web Services — application hosting, storage, and email delivery (Amazon SES). Region: US East (N. Virginia).
• Microsoft 365 — corporate email and productivity for iVerse staff.
• Cloudflare — DNS management for our domains.
• Anthropic, OpenAI, and other LLM providers — used for automated evaluation scoring and content generation, only when a specific assessment requires it. Candidate PII is redacted from prompts wherever possible.

6. Your rights

You have the right to access, correct, export, and delete your personal information, to withdraw consent, and to object to specific processing. Send requests to privacy@evaandcompany.com. We will respond within 30 days.

7. Security

Assessment data are encrypted at rest and in transit. Access is restricted to authenticated staff on a need-to-know basis and audited. Details of our security posture are on the Security page.

8. Changes to this policy

We update this policy when our practices change. Material changes are announced by email to registered users. The date at the top of this page reflects the latest revision.