Privacy Policy

Effective date: 9 August 2026

Entity: Axys Platforms LLC, doing business as Axys Analysis (“Axys Analysis”, “we”, “us”, “our”)

Section 1 — Who we are

Axys Platforms LLC provides a B2B SaaS cognitive screening and structured candidate assessment platform. We are the data controller for information collected through our platform and marketing site for account/billing purposes. For candidate assessment data, see Section 2.2 and Section 8A.

Section 2 — Information we collect

2.1 Account and organisation data

Name, work email address, job title, organisation name, billing information.

2.2 Candidate data (collected on behalf of our customers)

Name, email address, assessment responses, behavioral signals captured during assessments (including time spent on questions, assessment focus such as tab changes and focus shifts, how much of a written answer was pasted rather than typed, and how quickly written answers appeared), scored results, and any automated integrity flags raised from those signals. Integrity flags are advisory and do not change the candidate's assessment score. Axys does not make hiring decisions — a hiring manager decides how to use them, and our customers are required to apply human review. We act as a data processor for candidate data. The hiring organisation using our platform (the “Customer”) is the data controller for its candidates, including where a Customer has authorised a staffing or recruiting agency to access the platform on its behalf — see Section 2.2A.

2.2A — Agency access

A Customer may authorise a staffing or recruiting agency to access and use the platform on its behalf. Where this occurs, the agency's personnel may access candidate data as an extension of the Customer's own access — the Customer remains the data controller, and is responsible for that authorisation. See our Terms of Service, Section 5A, and our Data Processing Agreement for further detail.

2.3 Usage data

Feature interaction events, page views, session metadata. Collected via PostHog. Anonymised before storage.

2.4 Technical data

IP addresses, browser type, request metadata. Collected by Vercel and Sentry for security and error monitoring purposes.

Section 3 — How we use your information

To provide, operate, and improve the platform
To process payments and manage subscriptions (via Stripe)
To send transactional emails (via Loops) — account alerts, billing notices, assessment notifications
To monitor platform health and diagnose errors (via Sentry)
To understand feature usage and improve the product (via PostHog)
To generate assessment questions from job descriptions submitted by customers (via Anthropic). Job description text is sent to Anthropic's API for this purpose.
To orchestrate background processing including scoring, ATS delivery, and retention enforcement (via Inngest)
To comply with legal obligations

Section 4 — Data retention

We retain candidate data only as long as necessary for the purposes described in this policy, and no longer.

While a job is open

Candidate data (including assessment results) remains available to the hiring team for as long as the job remains open in the platform.

When a job closes

Candidates who did not complete their assessment (including those who started but did not finish) are deleted immediately upon job closure. No record of their individual responses is retained.
Candidates who completed their assessment are retained for 30 days after job closure, after which their personal data (name, email, and other identifying fields) is redacted. Composite scores, dimension-level scores, and the hiring team's own review notes on the recommendation remain associated with the job record after redaction, to support the hiring team's ability to review past hiring rounds. Detailed open-ended answer text, our AI's written rationale for individual answer scores, and free-text notes are removed at the same time, as they are not necessary once the individual has been de-identified.

If a job never closes

Candidate data — including for candidates who did not complete their assessment — is retained for a maximum of 12 months from the date of the assessment, after which the same redaction described above applies automatically, regardless of job status.

Declined candidates

Deleted after 60 days, or immediately upon job closure, whichever is earlier.

Candidate-initiated deletion

A candidate may request deletion of their data at any time via /candidate-rights. This request is processed using the same standard of redaction described above and is actioned as soon as the request is confirmed.

Backups

In addition to the retention periods above, we maintain encrypted, off-site backups of our production systems for disaster recovery purposes, retained on a rolling 30-day basis. Data included in a backup taken before a deletion event may persist in that backup for up to 30 additional days after the corresponding live-system deletion, until that backup is itself rotated out.

Aggregated, de-identified benchmark data

We maintain an aggregated statistical dataset (dimension performance by role type, seniority, and industry) that contains no candidate name, email, job identifier, or organisation identifier, and is only included once a sufficient sample size exists to prevent identification of any individual. This aggregated dataset is retained indefinitely to support platform benchmarking features.

Personal data (account holders, not candidates): retained for up to 24 months from the date of collection, or until you request deletion, whichever is earlier.
Billing records: retained as required by applicable law.
Contact form submissions and waitlist signups: retained for 24 months, then deleted.
Legal consent records (signup agreements): retained for the duration of your account plus 3 years after account termination, as required for compliance documentation.
Deletion request records: retained for 3 years from the date of the request for audit and compliance purposes, then deleted.

Section 5 — Sub-processors

We use third-party sub-processors to deliver our services. A full list is available at /legal/sub-processors. We will provide at least 30 days notice before adding or replacing any sub-processor that processes personal data.

Section 6 — Data sharing

We do not sell personal data.

We do not share personal data with third parties except:

Sub-processors listed at /legal/sub-processors, under contractual obligations
Where required by law or valid legal process
In connection with a merger, acquisition, or sale of assets, with notice to users

Section 7 — Cookies and tracking

We use cookies for authentication session management and product analytics (PostHog). We do not use advertising cookies or sell data to advertisers. You may opt out of analytics tracking by contacting us at privacy@axysanalysis.com.

Section 8 — Your rights

Depending on your location, you may have the right to:

Access the personal data we hold about you
Request correction of inaccurate data
Request deletion of your data
Object to or restrict certain processing
Data portability

To exercise any of these rights, submit a data deletion request. We will respond within 30 days.

Candidates: your rights regarding assessment data should be directed to the hiring organisation that administered your assessment. We will assist our customers in responding to candidate rights requests.

Section 8A — Automated decision-making

Our platform uses AI-generated assessments to produce scored evaluations of candidates. These scores are one input into hiring decisions and are not used as the sole basis for any employment decision. The platform may also raise automated integrity flags from behavioral signals (for example unusual paste or typing-speed patterns). Those flags are advisory and do not change the assessment score.

You have the right not to be subject to decisions based solely on automated processing that produce legal effects or similarly significant effects. Our customers (hiring teams) are required by our Terms of Service to use assessment results and any integrity flags alongside other evaluation methods and to apply human review before making hiring decisions. Axys does not make hiring decisions.

If you believe an automated decision has been made about you without appropriate human involvement, contact the hiring organisation that administered your assessment. You may also contact us at privacy@axysanalysis.com and we will assist in resolving your concern.

Section 9 — Security

We use industry-standard security measures including encryption in transit (TLS), encryption at rest, access controls, and rate limiting. We conduct regular security reviews. In the event of a data breach affecting your personal data, we will notify affected parties as required by applicable law.

Section 10 — Children

Our platform is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors.

Section 11 — Changes to this policy

We will post any changes to this policy on this page with an updated effective date. For material changes, we will notify customers by email at least 30 days before the change takes effect.

Section 12 — Contact

Axys Platforms LLC (d/b/a Axys Analysis)

5534 Saint Joe Road

Fort Wayne, IN 46835

EIN: 42-3381322

privacy@axysanalysis.com

/legal/sub-processors (sub-processor list)