Privacy Policy

1. Information We Collect

At KafaVerify (kafaverify.com), we collect information necessary to deliver candidate assessment, job application, and talent verification services:

• Recruiter & Employer Account Information: Name, business email, organization name, company logo, phone number, and billing credentials when you create a recruiter account.
• Candidate Profile & Application Data: Full name, email address, Telegram ID and username, Telegram phone number, date of birth, country, city, target job role, experience years, passport details, driving license status, LinkedIn profile URLs, work summary, uploaded resume documents, and supporting credentials (such as certifications, license scans, and portfolio attachments) submitted when applying for job openings or managing a candidate profile.
• Candidate Authentication Credentials: When signing in via Google 1-Click Identity Services, Telegram OpenID Connect (OIDC) / Login Widget (@KafaVerifyBot), or LinkedIn, we receive your verified public identifiers (such as verified email address, Telegram ID and username, full name, and avatar picture). We verify authentic signatures using cryptographic RS256 and HMAC-SHA256 protocols and never access or store your third-party account passwords.
• Assessment & Proctoring Telemetry: Candidate submitted code solutions, answer choices, test scores, browser tab-switches, fullscreen mode flags, and optional webcam verification snapshots strictly for candidate authentication when authorized by the testing employer.
• Payment Information: All subscription payments are processed securely by regulated merchant providers (Paddle / Dodo Payments). We do not store raw credit or debit card numbers on our servers; card details are tokenized directly with PCI-DSS compliant payment gateways.
• Log & Device Data: IP addresses, browser types, session timestamps, and diagnostic error logs to maintain system performance and prevent abuse.

2. Candidate Profiles, Employer Subdomains & Data Architecture

KafaVerify operates a hybrid recruitment intelligence architecture designed to maximize candidate trust and streamline cross-employer mobility:

• In-Situ Subdomain Experience: When applying on an employer's branded subdomain (e.g. acme.kafaverify.com) or custom domain, candidates remain entirely within that branded environment. You are not forcibly redirected away to central domains.
• Company-Scoped Applications: When you submit an application to a specific job opening, your application record, resume, and assessment results are strictly scoped to that employer's workspace through multi-tenant database firewalls. Other employers cannot view your application status or scores with that employer.
• Centralized Candidate Profile: To save candidates from repeatedly entering their details across different job openings, your master candidate profile is stored centrally in KafaVerify's secured master database. When you apply to other participating employers in the KafaVerify network or take new skills assessments, you can effortlessly sign in with Google, Telegram, or Email to pre-fill your saved details.

3. Job Postings & Syndication Reach

KafaVerify enables employers to distribute career opportunities through two distinct visibility tiers:

• Public Job Board & Universal Feeds: When an employer selects "Publish to KafaVerify Public Job Board", the job description, hiring company identity, and role parameters are listed on the central KafaVerify Public Job Directory (kafaverify.com/jobs), indexed by search engines via Schema.org JSON-LD (Google for Jobs), and included in public XML/RSS distribution feeds.
• Private Subdomain-Only Postings: If an employer unchecks the public board option, the job opening is strictly restricted to their company careers subdomain and will not be displayed on the central public job directory or universal search feeds.

4. How We Use Your Information

We use collected data solely for legitimate business purposes:

• To authenticate recruiter and candidate accounts and manage technical assessment pipelines.
• To compile and score candidate test submissions using our automated execution engines.
• To deliver candidate job applications and verified scorecards to prospective employers.
• To process subscription payments and issue billing receipts through our merchant processors.
• To provide customer support and send transactional notifications (including assessment invites via Telegram & Email).
• To detect, prevent, and mitigate security threats, cheating attempts, or malicious code injections.

We NEVER sell, rent, or trade your personal data or candidate resumes to third parties or advertising networks.

5. Data Security & Encryption

We enforce enterprise-grade security standards across all layers of our application architecture:

• All data in transit is encrypted using TLS 1.3 / 256-bit SSL encryption.
• Candidate code execution runs inside isolated, sandboxed Docker containers with strict resource and network isolation.
• Database records are stored with multi-tenant company scoping, ensuring organization records are never leaked across companies.
• Access to production databases is restricted to authorized engineers under strict multi-factor authentication.

6. Cookies and Session Management

We use strictly necessary cookies and localized browser storage (such as authentication tokens in localStorage and secure HTTP session cookies scoped to .kafaverify.com) to keep candidates and recruiters securely signed in and preserve workspace settings across employer subdomains. We do not employ third-party tracking cookies or behavioral advertising trackers.

7. Candidate Rights & GDPR Compliance

Under applicable data protection regulations (including the EU GDPR and UK Data Protection Act), candidates and users possess specific legal rights:

• Right to Access: You can request a copy of the personal assessment data held in our systems.
• Right to Rectification: You can correct inaccurate personal details.
• Right to Erasure (Right to be Forgotten): You can request the permanent deletion of your assessment records and personal data.
• Right to Restrict Processing: You can request limits on how your personal data is utilized.

To exercise any of these rights, please email our Data Protection officer at privacy@kafaverify.com.

8. Third-Party Service Providers

We partner with trusted, industry-leading vendors to operate our cloud infrastructure:

• Payment & Merchant Processing: Regulated gateways (Paddle / Dodo Payments - PCI-DSS Level 1 Compliant).
• Authentication Services: Google Identity Services (OAuth 2.0) for seamless 1-click candidate sign-in.
• Cloud Hosting & Edge Delivery: Cloudflare and enterprise data centers operating under international cloud security standards.
• Transactional Communications: Enterprise email and Telegram notification gateways.

9. Contact Data Protection Officer

If you have questions or concerns regarding our privacy practices, please contact us: