When you apply for a job through a TopCandidate application link, we collect — with your consent, recorded with a timestamp and the version of the notice you saw:
All of this exists for one purpose: helping the employer you applied to assess your application. Scores are AI-assisted signals for human reviewers, and monitoring is flagged for human review — it is not "cheat-proof". Two things happen automatically: an assessment test is submitted when its time runs out, and an AI interview ends if you keep leaving the interview tab or pasting answers after a warning (that interview is then not scored). The final hiring decision is always made by people.
| Data | Kept for | How deletion is enforced |
|---|---|---|
| CV PDF file | 30 days from upload | Automatic database expiry (TTL) |
| Camera/screen snapshots from interviews and proctored tests (≤12 still images each) | 30 days | Automatic database expiry (TTL) |
| Interview transcript | 12 months | Automatic database expiry (TTL) |
| Written interview answers | 12 months | Automatic database expiry (TTL) |
| Emails sent to you via the platform | 12 months | Automatic database expiry (TTL) |
| Email delivery records (your address and the message content, for sending and retrying) | Address and content: 90 days. After that, a record that an email was sent — with a keyed fingerprint of your address (explained below) instead of the address, and no content: 12 months | Daily automated purge removes the address and content; automatic database expiry (TTL) removes the record |
| Do-not-email list — if an email to you bounces or you mark it as spam, a keyed fingerprint of your address, not the address itself | Kept indefinitely, so we never email that address again | Removed on request (email privacy@topcandidate.pro) |
| Assessment answers, per-question timing and activity log | 12 months | Daily automated purge removes them from the application record |
| Parsed CV profile and contact details (your name, email, phone and CV file name) | 12 months | Daily automated purge removes them from the screening and application records |
| Screening and assessment scores, and hiring outcome | Retained for the employer's records | Personal details above are stripped from them after 12 months |
| A one-way fingerprint (hash) of your CV file — not the file itself, and it cannot be turned back into your CV — used only to stop a duplicate application to the same job | Retained with the application record | Removed with the application when you request deletion |
All periods run from when the record was created, not from when you ask.
Keyed fingerprints. Where we keep a fingerprint of your email address instead of the address (the do-not-email list and old delivery records), it is an HMAC-SHA256 value made with a secret key that only our server holds. We can check whether a given address matches; someone who obtained the stored fingerprints without our key could not turn them back into addresses. This is not anonymous: because we hold the key, a fingerprint is still linked to you, and it is treated as your personal data — including for deletion requests.
Backups. The database is backed up nightly (each backup kept 14 days) and monthly (each archive kept 12 months). Backups are used only to restore the service, but it means data deleted from the live system — on schedule or on request — can remain inside a monthly archive until that archive expires: up to about 24 months from when the data was created.
Email privacy@topcandidate.pro from the address you applied with, naming the role or company, or ask the employer directly. The employer's workspace owner then runs a full erasure: your application (including assessment answers and score), CV file, parsed profile, interview transcript and scores, snapshots, written answers, and email history are permanently deleted across the whole system.
The only thing kept is an anonymized record that an application existed and was deleted on a given date — with no name, email, or any other personal data — so hiring audit trails stay honest.
Only the hiring team of the employer you applied to, inside their own isolated workspace. Your CV text is processed by an AI model (OpenAI) to produce the parsed profile and scores; it is not used to train models. Emails to you — such as an interview invitation — are delivered by our email provider, Resend, which processes your name and email address to send them. We do not sell candidate data.