Privacy Policy

This policy explains what DeftBench collects, why, how long we keep it, and the choices you have. It covers two groups: customers (companies running assessments) and candidates (people taking them).

Candidates: if a company invited you to an assessment, that company decides what the assessment measures and how the result is used in their hiring process. We process your data on their instructions. Questions about their decision should go to them; questions about the data itself can come to us.

1. What we collect

From customers

• Account and organization details, user names, email addresses, and roles.
• Billing information, processed by our payment provider.
• Product usage and diagnostic logs.

From candidates

• Identifying information — name, email address, and any reference the inviting company attaches.
• Session telemetry— the prompts you write, the AI agent's responses, tool and MCP calls, code edits, and which suggestions you accept or reject. This is the core of the assessment. It may contain anything you type, so please don't enter personal information you don't want recorded.
• Session artifacts — snapshots of the code you produce and its version history.
• Screen recording— only where the inviting company has enabled it for that assessment, and only after you consent. Every recording is stored with a reference back to the consent that authorized it. If you decline, the company's policy determines what happens next; declining may mean you cannot take a proctored assessment.

We do not collect webcam video, audio, facial-recognition data, or government ID images.

2. How we use it

• To run the assessment and provision your workspace.
• To generate an evaluation report for the inviting company, linking each part of the assessment back to specific moments in your session.
• To operate, secure, support, and improve the service.
• To meet legal and contractual obligations.

We do not sell personal information, and we do not use candidate session data to train our own models. Where we send data to third-party model providers to run the assessment, we seek zero-retention and no-training terms; see §6.

3. Automated processing and AI

DeftBench uses AI to help evaluate assessments, and the resulting scores inform employment decisions. Two things we design for:

• A human decides. The automated score is decision support. It does not by itself reject a candidate.
• Every score is traceable. Scores link to the specific session events they came from, so they can be reviewed and challenged rather than taken on trust.

Depending on where you live, you may have additional rights regarding automated decision-making, including the right to request human review. See §7, and contact the company that invited you as well — they control the hiring decision.

[BRACKETED: counsel to confirm AEDT notice wording per market — NYC LL144 requires specific candidate notice and a published bias audit; the EU AI Act classifies recruitment tools as high-risk. Neither is addressed here yet.]

4. Retention

Customers configure retention windows for recordings, telemetry, and candidate information. When a window expires, the data is deleted.

[BRACKETED: the scheduled hard-delete job is not yet built (DATA_HANDLING.md §3). Either ship it before this policy goes live, or have counsel word this section to match what the system actually does today. Do not describe deletion that does not happen.]

5. Security

• Encrypted in transit and at rest.
• Each assessment runs in an isolated, single-use container.
• Access to recordings and personal information is role-restricted and logged.
• Credentials and keys are held in a managed secrets vault.

6. Sub-processors

We use third parties for authentication, cloud hosting, AI model inference, email, and payments. [BRACKETED: publish the named list with entity, purpose, and region — confirm against signed contracts before listing anyone.]

7. Your rights

Depending on your jurisdiction you may have the right to access, correct, delete, export, or restrict processing of your personal information, and to object to certain processing.

To make a request, email hello@deftbench.com. If a company invited you to an assessment, we may need to route your request to them as the controller of that data. We respond within the period the applicable law requires.

8. International transfers and residency

Enterprise customers can request that data be stored and processed in a specific region. [BRACKETED: counsel to specify default processing regions and the transfer mechanism relied on — SCCs or equivalent.]

9. Changes

We'll update this page when our practices change and revise the date above. Material changes will be communicated to customers directly.

10. Contact

hello@deftbench.com

[BRACKETED: add legal entity name, registered address, and — if required — an EU/UK representative and DPO contact.]