Data processing

You are the controller. You decide to interview someone, write the questions and the criteria, receive the result, and make the hiring decision. We are your processor. We run the interview and the scoring on your instructions and we do not decide what a role asks for or who gets hired.

Practically: notice to candidates, lawful basis, and answering “why was I interviewed” are yours. What we hold, for how long, and who can reach it are ours, and are described below.

Candidate name and email address as you supply them; the audio and video of the interview; the transcript; on a coding screen the code written, what it produced when it ran, and the record of any assistant use; on a take-home assessment a recording of the candidate’s screen and webcam for the length of the assessment; the evaluation and the quotes it rests on; technical call-quality data; and a resume where the candidate uploads one.

Take-home proctoring warrants a line of its own, because it is the only capture that reaches a candidate’s own machine rather than a call they joined, and because it is required rather than optional: the task is withheld until the recording is running. Candidates are told in full what is captured before their browser is asked for anything, the browser names what is being shared and lets them share a single window rather than the desktop, and stopping it part-way is recorded on the timeline rather than silently shortening the video. If you run assessments in a jurisdiction that requires separate notice or consent for monitoring, that notice is yours to give as controller, and the disclosure we show sits at getlarpy.com/hiring/privacy.

Only to provide the service to you. Not to train models, not to build a candidate database, not for advertising, and not to improve the product in any way that involves a human reading your candidates’ interviews without your instruction.

We process on your documented instructions, which in practice means the roles, criteria and settings you configure in the product.

Two instructions we will refuse. We will not screen on a protected characteristic: criteria touching immigration status, health, age, sex, family status, race, religion, accent or criminal record are refused when written, with the protection named. That refusal is a filter in code, not a request in a prompt. And we will not reject a candidate automatically. The system can advance someone who clears your own bar; every other outcome waits for a person.

Recordings are held in private object storage that is not publicly readable, and reached only through links minted for one viewer that expire in minutes. Interview content is written only by our own backend, never by a browser. Candidate code executes in a sandbox on an isolated host reachable only over our private network. Each customer sees only their own roles and candidates, enforced at every query rather than checked afterwards.

Access to production data inside Larpy is limited to the people who operate it. Administrative actions against candidate records are written to an audit log, including every override of a recommendation and every read of the bias-audit figures.

We do not currently hold SOC 2 or ISO 27001. Saying so here is more useful to your review than discovering it later.

Recordings are deleted after 90 days, interview and take-home proctoring alike, and transcripts and evaluations after 12 months, by a job that runs nightly. These are ceilings, not minimums: you or the candidate can delete sooner, and a deletion removes the file itself rather than the pointer to it. If a file cannot be removed we report a failure rather than confirm a deletion that did not happen.

The twelve months on text is deliberate: it is the standard applicant-record period, so your own obligations are met without keeping the video to meet them.

Named individually, with what each one receives and where it is processed, at larpy.com/hiring/subprocessors (last updated September 17, 2026). We will tell you before a new one begins handling candidate data. Each is bound to use it only to provide their service to us.

Processing happens in Canada, the United States and Germany. If you need candidate data confined to one jurisdiction, that is a conversation to have before you start rather than after.

A candidate can destroy their recording, transcript and evaluation themselves, from the link you sent them, without going through either of us. Where you receive a request we will help you answer it; where we receive one directly for data we hold on your behalf, we act on the deletion and tell you.

We will tell you without undue delay after becoming aware of a breach affecting your candidates, with what we know, what we are doing, and what we do not yet know. We will not wait for a complete picture before the first message.

On request, we delete every candidate record we hold for you, within 30 days and usually the same day, or return it first if you ask. That is one operation, not a manual sweep: recordings are removed from storage before the rows that point at them, and if any file cannot be removed the whole thing stops and reports rather than completing on a deletion that did not happen.

We do not delete automatically when an account goes quiet. An unpaid invoice is not a deletion instruction, and destroying a customer’s hiring records because a card expired would be the wrong default in both directions.

Backups age out on their own schedule and are not restored to serve anyone.

You may ask us to demonstrate compliance with this agreement, and we will answer reasonable questions in writing and walk through the system with your reviewer. For on-site or third-party audit rights, ask: we would rather agree the shape of that in your contract than have it arrive as a surprise obligation.