Privacy Policy — InterviewRelay

(operated by Instantflows B.V.)

Last updated: 22 October 2025

1) Introduction

We are Instantflows B.V. ("InterviewRelay," "we," "us"). We respect your privacy and process Personal Data in accordance with the General Data Protection Regulation (GDPR) and other applicable laws.

This Policy explains which Personal Data we use and why, how we process, store, and protect it, and which rights you have.

This Privacy Policy applies to our websites and sub-domains at https://www.interviewrelay.com (the Website) and to our AI-conducted interview platform, dashboards, APIs, and widgets (the Services).

2) Our roles under GDPR (Controller vs Processor)

Controller — We act as controller for Website data, account and seat administration, billing, security logs, support, and our own marketing.

Processor — We act as processor for interview content (audio recordings, transcripts, prompts/scripts, evaluation outputs, and related metadata) that you or your organization submit to the Services. For such data, our Data Processing Addendum (DPA) applies and your organization is the controller.

If a term in this Policy conflicts with the DPA, the DPA governs. For enterprise customers requiring a signed DPA, please contact business@instantflows.com.

3) Personal Data we process (what and why)

  • Account & Contact (controller): create / manage accounts, authenticate users, provide support. Legal basis: contract; legitimate interests (security).
  • Billing (controller): charge for Services, meet tax/accounting obligations. Legal basis: contract; legal obligation.
  • Interview Content (processor): run AI interviews, generate transcripts and outputs, enable playback/exports, deliver webhooks/SDK features. Legal basis: lawful basis determined by your organization (controller); we act under its instructions per DPA.
  • Security & Reliability (controller/processor): prevent abuse, ensure availability. Legal basis: legitimate interests (security/fraud prevention); legal obligation where applicable.
  • Marketing Attribution & Cookies (controller): measure campaigns and improve the Website, respecting consent choices. Legal basis: consent (non-essential cookies); legitimate interests (necessary cookies).

We do not sell Personal Data.

4) Recordings & Fairness

We provide tooling to capture explicit recording consent and store a timestamped record. Your organization must ensure participants are informed and that a valid legal basis exists.

InterviewRelay does not provide emotion-recognition features in employment or education contexts and does not make decisions with legal or similarly significant effects solely by automated means; human review is always required.

5) Cookies & Tracking

We use cookies and similar technologies to operate the Website, remember preferences, analyze usage, and measure marketing.

We obtain prior consent before setting any non-essential cookies/SDKs. Our banner offers Accept all / Reject all / Customize choices of equal prominence, and you can withdraw consent anytime via Cookie Settings in the footer.

We honor Global Privacy Control (GPC) and other recognized opt-out signals, treating them as requests to opt-out of sale/sharing or targeted ads.

For full details, see our Cookie Policy at https://www.interviewrelay.com/legal/cookies.

6) Sub-processors and Sharing

We share Personal Data only with service providers that help us deliver the Services, under contracts containing confidentiality, security, and GDPR clauses (hosting, storage, databases, real-time AI runtime, payments e.g. Stripe, email delivery, error monitoring).

We maintain an up-to-date list of sub-processors on our legal page and will notify customers in advance of material changes.

We may also share data if required by law or as part of a merger or acquisition.

7) Data Residency & International Transfers

Customers may choose EU or US data residency for interview projects. Where transfers occur outside the EEA/UK, we apply EU Standard Contractual Clauses (SCCs) or UK Addendum (IDTA) plus technical and organizational safeguards. Material changes to transfer mechanisms will be announced on our legal page.

8) Security

We use administrative, technical, and organizational measures including encryption in transit and at rest, role-based and row-level access controls, short-lived signed downloads, webhook signing, 2-factor authentication for staff, and continuous monitoring. Administrative actions are logged and regularly reviewed.

9) Retention

  • Interview content (processor): retained per your organization's settings and plan defaults (e.g. 90 / 180 / 360 days) and deletable via product controls or request.
  • Account, billing, security logs (controller): retained as long as necessary for the purposes above and legal obligations (e.g. tax).

Data is deleted or anonymized when no longer needed.

10) Your Rights (EU / EEA / UK)

You may have rights to access, rectify, delete, restrict, or object to processing, and to data portability.

  • If your data forms part of a customer interview project, contact the customer (controller) who invited you; we assist them under the DPA.
  • For Website, account, or billing data, contact business@instantflows.com or the address below.

We respond within one month of receipt (and may extend by up to two months for complex requests with notice).

You may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or your local authority.

11) Children

Our Website and Services are not directed to children under 16 (EU) or 13 (U.S. COPPA). If you believe a child has provided Personal Data, contact us and we will delete it.

12) Changes to this Policy

We may update this Policy from time to time. Material changes will be announced to account owners and posted on interviewrelay.com/legal/privacy with a new "Last updated" date.

13) Contact & Identification (Kamer van Koophandel)

Instantflows B.V.
KvK — Kamer van Koophandel: 96160861
Willem Hioolenstraat 3, 3065 LE Rotterdam, Netherlands
Email: business@instantflows.com
Tel: +31 6 2317 3317

14) U.S. State Privacy Notice (addendum)

Our Services and privacy program are primarily designed for the EU. If you are a resident of California or another U.S. state with privacy rights (e.g. CA, CO, CT, VA, TX, OR, DE), you may request to access, correct, or delete Personal Information and to opt out of the "sale or sharing" of personal information or of targeted advertising.

We do not sell Personal Information. If we use analytics or advertising cookies on the Website, we treat that as "sharing" and honor Global Privacy Control (GPC) signals as opt-outs.

Requests can be sent to business@instantflows.com. We will respond within 45 days (and may extend by another 45 days with notice). If we decline a request, you may appeal by email (subject "Appeal"), and we will respond within the statutory period (e.g. 45 – 60 days).

We do not knowingly collect sensitive information or biometric identifiers, and we do not combine customer data for cross-context behavioral advertising.

15) Withdrawal of Consent & Timelines (summary)

You may withdraw any consent (e.g. cookies or marketing emails) at any time without detriment. Withdrawal does not affect prior lawful processing.

For verified requests under applicable laws (GDPR or U.S. state laws) we respond within one month (EU) or 45 days (U.S.) and may extend once with notice.