Privacy policy

Overview

Vertana, Inc. ("Vertana", "we", "us", "our") is committed to protecting and respecting your privacy. This privacy policy, and any documents referred to in it, sets out the basis on which we collect and process your personal data when you use our website and our hiring-assessment platform.

By visiting vertana.io (the "Site") or using our services or apps (the "Services") — whether as a member of a hiring team or as a candidate taking an assessment — you accept the practices described in this policy. Please read it carefully to understand our views and practices regarding your personal data and how we treat it.

Please note: this policy does not apply to data we process on behalf of a hiring organization as their data processor. Where a hiring team uses Vertana to assess candidates, that organization is the controller of the candidate data and this policy describes how we handle data as their processor only in that context. The organization's own privacy notice governs its collection and use of candidate data.

Data controller and our role

For the purposes of the EU General Data Protection Regulation (GDPR), the UK GDPR, and other applicable data protection laws (together, "Data Protection Law"), Vertana, Inc. is the data controller for personal data we collect about visitors to our Site and members of hiring teams who register for and administer accounts.

For personal data submitted by candidates during an assessment — such as answers, scores, timing, and any proctoring media — the hiring organization that created the assessment is the controller and Vertana acts as their processor, handling that data on their documented instructions. Our processor terms are set out in our Data Processing Agreement.

Legal basis for processing

We only use your personal data when the law allows us to. We rely on one or more of the following bases, depending on the activity:

• Performance of a contract — to register and administer accounts, deliver the Services, and process payments.
• Legal obligation — to comply with tax, accounting, and other legal requirements.
• Legitimate interests — to run, secure, and improve our business and Services, provided your interests and fundamental rights do not override those interests.
• Consent — for candidate proctoring, certain marketing, and any purpose where we ask for it in advance. You can withdraw consent at any time.

Personal data we collect

Personal data means any information from which an individual can be identified. It does not include anonymized or aggregated data. We collect and process the following categories:

• Identity data — first and last name, and for candidates the name associated with an assessment or certificate.
• Contact data — email address, and any billing contact details you provide.
• Financial data — payment card and billing information, processed by our payment provider (Stripe); we do not store full card numbers.
• Professional data — job title, company name, and role or skill areas relevant to an assessment.
• Assessment data — tests, questions, and scoring settings you create, and candidate submissions including answers, code, scores, timing, and dispositions.
• Integrity and proctoring data — tab-focus and tab-switch events and, where camera proctoring is enabled and consented to, webcam snapshots and screen recordings, plus the stored consent record (text, version, and IP address).
• Technical data — IP address, login and authentication data, browser type and version, operating system, and device information.
• Usage data — how you interact with the Site and Services, including pages viewed, feature use, and email open and click events used to build the invite funnel.
• Marketing and communications data — your marketing preferences and communication choices.

Special category data

When a candidate takes a proctored assessment with camera proctoring enabled, webcam snapshots or screen recordings may incidentally capture special category data — for example, information that could reveal race or ethnicity, or religious or philosophical beliefs from the candidate's appearance or environment. We only collect and use such data where the candidate has given explicit consent before the assessment begins, and it is used solely for integrity review by the hiring organization.

If you fail to provide personal data

Where we need to collect personal data by law or under a contract with you and you do not provide it when requested, we may be unable to perform that contract — for example, to provide access to the Services. We will notify you if this is the case.

How personal data is collected

We collect data in the following ways:

• Direct interactions — when you register an account, create tests, invite candidates, contact support, or otherwise correspond with us.
• Candidate assessments — when a candidate follows an assessment link and provides an email address, answers, and (where enabled and consented) proctoring media. Candidates access assessments by token link and are not required to create an account.
• Camera and screen captures from proctored tests — where camera proctoring is enabled and the candidate consents, periodic webcam snapshots and, on eligible plans, screen recordings are captured for integrity review. This media is automatically deleted 60 days after the assessment.
• Automated technologies — as you use the Site and Services we collect technical and usage data using cookies, server logs, and email tracking pixels. See the cookies section below.
• Third-party sign-in — where you choose to sign in with Google, we receive basic profile information from that provider to authenticate you.

Cookies and similar technologies

We use cookies and similar technologies to distinguish you from other users, keep you signed in, remember your preferences, and understand how the Services are used. The categories we use are:

You can set your browser to refuse some or all cookies, but parts of the Site or Services may not function correctly as a result. We do not respond to browser "Do Not Track" signals.

• Strictly necessary — authentication and session cookies that keep you signed in and protect against cross-site request forgery. These are required for the Services to work.
• Functionality and preferences — remember choices such as filters and dismissed onboarding prompts, stored in your browser's local or session storage.
• Analytics and performance — help us understand usage, diagnose errors, and improve the Services.

How we use personal data

We use personal data to register and administer accounts; deliver assessments and score and rank submissions; surface integrity signals and provide reporting to the hiring team that created a test; process payments and manage billing; provide support and communicate with you; secure and improve the Services; and comply with our legal obligations.

We will not sell or rent your personal data. We only use it for the purposes for which it was collected, unless we reasonably consider another purpose is compatible with the original one, or where the law requires or permits it.

Sharing and disclosure

We share personal data with service providers who process it on our behalf under contract, and with others where the law allows. This includes:

• Hosting, database, authentication, and file storage providers that run the platform.
• Email delivery providers used to send invitations, reminders, and account communications.
• Payment and billing providers that process subscriptions, credits, and invoices.
• AI and code-execution providers used to generate questions and run and grade candidate code.
• Professional advisors, and tax or other authorities, where required by law.
• A buyer or successor, if we sell or transfer all or part of our business or assets, in which case data held about you may be one of the transferred assets.

Subprocessors

We engage a limited set of subprocessors to provide the Services, including Supabase (hosting, database, authentication, and storage), Vercel (application hosting and scheduled jobs), Brevo (transactional email), Stripe (payments and billing), OpenAI (AI question generation), and Judge0 (code execution). Each is bound by contract to process data only as needed to provide their service. A current list is available to Custom-tier customers on request as part of our Data Processing Agreement.

International transfers

Our Services are global, and your personal data may be stored and processed in countries outside your country of residence, including outside the European Economic Area, the UK, and Switzerland, where data protection rules may differ.

Where we transfer personal data across borders, we take steps reasonably necessary to ensure it is treated securely and in line with this policy — for example by transferring to a country recognized as providing adequate protection, or by relying on Standard Contractual Clauses or other approved safeguards.

Data security

We maintain administrative and technical safeguards appropriate to the risk. Data is stored on secure infrastructure, transmissions are encrypted using TLS, and we support multi-factor authentication for accounts. We limit access to personal data to those who need it to provide the Services, and they are subject to a duty of confidentiality.

We have procedures to deal with any suspected personal data breach and will notify you and any applicable regulator where we are legally required to do so. No transmission over the internet is completely secure, so any transmission is at your own risk.

Candidate consent and proctoring

Proctoring is optional and always disclosed up front. Before a proctored assessment begins, candidates see exactly what will be monitored — tab and focus activity, and, where enabled, webcam snapshots and screen recording — and must agree to proceed. The consent copy is versioned, and a snapshot of the text, version, and IP address is stored with each attempt.

Your rights

Subject to Data Protection Law, and free of charge, you have the right to request:

Where Vertana acts as a processor for candidate data, we will refer requests to the relevant hiring organization (the controller) or assist them in responding. We will respond to requests within the timeframes required by law, though complex requests may take longer, in which case we will keep you updated.

• Access to your personal data.
• Rectification of inaccurate data.
• Erasure of your data.
• Restriction of, or objection to, certain processing.
• A portable copy of your data in a structured, machine-readable format.
• Withdrawal of consent at any time, where processing is based on consent.

Marketing communications

We may use your identity, contact, technical, usage, and profile data to decide which products, services, and offers may be relevant to you. We will send you marketing emails only where you have opted in or where you have purchased from us and have not opted out. We will obtain your express opt-in consent before sharing your data with any third party for their marketing.

You can opt out of marketing at any time using the "unsubscribe" link in any marketing email. We will still send you service-related messages about billing, security, and support.

Data retention

We retain personal data for as long as reasonably necessary to fulfil the purposes for which it was collected, including to satisfy legal, tax, accounting, or reporting requirements, and to resolve disputes or enforce our agreements.

Proctoring media is retained for a fixed 60 days after the assessment and is then automatically deleted. Assessment data is retained while the associated account remains active or as needed to provide reporting; hiring teams can delete tests and results, and candidates can request removal of their submissions and self-remove any public certificate. We may keep anonymized information indefinitely for research and statistical purposes.

Age of users

The Site and Services are not intended for and must not be used by anyone under the age of 16.

Changes to this policy

Any changes we make will be posted on this page and, where appropriate, notified to you within the Services or by email. This policy is effective from the date shown above and replaces any previously applicable version. Please check back regularly for updates.

Complaints and contact

If you have any concerns about how we handle your personal data, we encourage you to contact us first so we can address them. You also have the right to lodge a complaint with your local data protection supervisory authority.

Questions, comments, and requests regarding this policy can be sent to [email protected]. To exercise your data protection rights specifically, you can also contact [email protected].