Privacy Policy

1. Who we are

This policy explains how Omniteam.ai B.V. ("Omniteam", "we") handles personal data on our website (omniteam.ai) and in our platform (app.omniteam.ai). Omniteam.ai B.V. is registered with the Dutch Chamber of Commerce (KVK) under number 97929689, with its registered office at Valeriusstraat 70-2, 1071 MN Amsterdam, the Netherlands. For privacy questions, contact [email protected].

2. Our two roles

We act in two different roles. (a) We are the controller for personal data we process for our own purposes: website visits, contact and demo requests, user accounts of our customers' staff, billing, and support. This policy covers that processing. (b) We are a processor when an employer uses Omniteam for its recruitment. The employer is then the controller for the data of its candidates and interviewers, such as CVs, applications, interview recordings, transcripts and evidence summaries. We process that data only on the employer's documented instructions, under a data processing agreement (GDPR Art. 28). Section 4 explains what this means for candidates.

3. What we process as controller, why, and on which basis

(a) Contact and demo requests: name, work email, company, company size and your message, to answer you. Basis: your request and our legitimate interest in responding (GDPR Art. 6(1)(b) and (f)). Kept for up to 12 months after our last contact.

(b) User accounts: name, work email, role and sign-in data, to provide and secure the service. If you sign in with Google or Microsoft, we receive your name and email address from that provider. We are controller for account administration, sign-in, billing, usage limits and security of the service. Activity in your organisation's workspace (audit log, visit log, assistant chats) is processed for your organisation as processor. Basis: our legitimate interest in providing the service your organisation has contracted for and keeping it secure (Art. 6(1)(f)); if you contract with us yourself, performance of that contract (Art. 6(1)(b)). Kept for the term of the customer agreement. You need to provide your name and work email to use an account.

(c) Billing: billing contact and invoice details. Basis: legal obligation (Art. 6(1)(c)). Kept for 7 years as required by Dutch tax law.

(d) Website analytics and advertising measurement: only with your consent (Art. 6(1)(a)); see section 5.

(e) Security and abuse prevention: technical logs. Basis: legitimate interest (Art. 6(1)(f)). Kept for up to 30 days (application telemetry) and 180 days (visit log), longer only while needed to investigate a specific incident.

(f) Support requests: name, email, message and attachments, to answer and resolve your request. Basis: legitimate interest (Art. 6(1)(f)). Kept for 24 months after the request is closed.

We do not take decisions about you based solely on automated processing. We do not sell personal data.

4. If you are a candidate

If you applied for a job or took part in an interview with an employer that uses Omniteam, that employer decides why and how your data is used and how long it is kept. In the Omniteam service, the employer chooses how long interview data is kept, from 1 to 36 months, based on the rules that apply to it, and is responsible for that choice; the default is 36 months. Your CV and candidate profile are not deleted automatically; the employer decides when to delete them. Please read the employer's privacy statement and send requests about your data (access, correction, deletion, objection) to the employer. If you contact us, we forward your request to the employer and help them answer it.

On the employer's behalf we may process your CV and application, interview audio recordings, transcripts, and AI-assisted summaries that quote and link to their sources. AI helps organise this material; people at the employer review it. Depending on the employer's settings, an AI interviewer may conduct the interview (it says it is an AI), AI may suggest follow-up questions to a human interviewer during the interview if the interviewer switches this on for that interview (live suggestions), and earlier applicants may be shown for a new vacancy with a keyword match percentage. When an employer approves an application, or imports candidates from its applicant tracking system, the candidate is added to that employer's talent pool; the employer decides whether to keep candidates there and removes them. People make every decision. Omniteam does not reject candidates automatically.

We do not use candidate data to train or improve AI models or our own services. Omniteam does not use the audio to identify or infer emotions, personality or intentions, and no such output is produced or stored. The AI interviewer's speech model processes the audio only to understand the answer and respond. The service does not analyse facial expressions.

5. Cookies and tracking

This section covers our website, omniteam.ai; the Omniteam platform at app.omniteam.ai shows its own cookie banner. We use optional cookies and similar technologies only with your consent. When you accept optional storage via our consent banner, Google Analytics 4 (GA4) may analyse site usage, Google Ads may measure campaign conversions, and Microsoft Clarity may provide heatmaps and masked session recordings. If you refuse or make no choice, no Google measurement tags load and nothing is sent to Google. You can change or withdraw your choice at any time via Manage preferences in the site footer. The Calendly booking widget on the demo page loads only when you click "Load scheduler". Our Cookie Policy has the details. Analytics data is kept according to the providers' settings (Google Analytics: 14 months; Microsoft Clarity: 30 days).

6. Recipients and subprocessors

For the website we use: Web3Forms (contact form delivery), Google (Analytics 4 and Ads), Microsoft Clarity, Calendly (demo booking) and Stripe (pricing data and billing; we do not handle payment-card data on this website). For the platform we use Microsoft Azure for hosting, storage, email and AI processing; LiveKit for the live audio and video of interviews held in Omniteam's own interview room (AI interviews and live interviews with an interviewer); and, if an employer uses the meeting notetaker, Recall.ai. The current list of platform subprocessors, with their purpose and location, is published on our Subprocessors page (omniteam.ai/en/subprocessors). The terms under which we process data for employers are in our Data Processing Agreement (omniteam.ai/en/dpa).

7. Where data is processed and international transfers

Platform data is hosted by Microsoft Azure in the Netherlands and Ireland (EU): the application and files in the Netherlands (Azure West Europe) and the database in Ireland (Azure North Europe). AI processing uses Azure OpenAI deployments in Microsoft's EU Data Zone.

LiveKit, Inc. and Recall.ai (Hyperdoc Inc.) are US companies. LiveKit carries the live audio and video of interviews held in Omniteam's own interview room through its EU region and processes service telemetry in the US. For LiveKit we rely on the European Commission's Standard Contractual Clauses (module 3) in LiveKit's data processing addendum and a transfer impact assessment; LiveKit is also certified under the EU-US Data Privacy Framework (non-HR data). Recall.ai runs in its EU region (Frankfurt) and records meeting audio only; access from the US is possible, under the Standard Contractual Clauses in Recall.ai's data processing addendum. LiveKit and Recall.ai process limited data about the use of their own service (account and service telemetry data) as independent controllers under their own terms.

Website services: Google (Analytics 4 and Ads), Microsoft (Clarity), Calendly and Stripe may transfer data to the US under the EU-US Data Privacy Framework. Web3Forms, which delivers our contact form, states that it operates from India; transfers to it take place under the provider's data processing terms, which refer to the Standard Contractual Clauses.

8. Security

We protect personal data with encryption in transit and at rest, role-based access, separation of customer data per organisation, audit logging and EU hosting. If a personal data breach occurs, we follow the GDPR notification rules and inform affected customers without undue delay.

9. Your rights

You have the right to access your personal data, to have it corrected or deleted, to restrict its processing, and to data portability. Where we rely on your consent, you can withdraw it at any time without affecting earlier processing.

Right to object: you can object at any time to processing based on our legitimate interests (section 3 (a), (b), (e) and (f)).

To exercise these rights, email [email protected]. We answer within one month; for complex requests we may extend this by two months and will tell you why. Candidates: see section 4. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or the authority in your EU country.

10. Changes to this policy

We may update this policy. The date at the top shows when it last changed. If a change materially affects how we process your data as controller, we will inform account holders by email.

11. Contact

Omniteam.ai B.V., Valeriusstraat 70-2, 1071 MN Amsterdam, the Netherlands. Email: [email protected].