Privacy Policy

1. Owner and Data Controller

The primary entity responsible for the collection and processing of personal data on this platform is:

2. Categories of Data Collected

Depending on whether you are an enterprise recruiter, an engineering hiring manager, or a candidate taking an assessment, we collect the following categories of information:

3. Assessment & Proctoring Telemetry

When a candidate completes a proctored technical evaluation on ConceptNinjas, the platform records specialized evaluation telemetry strictly with the candidate's explicit in-browser consent:

• Source Code & Execution History: Code submissions, test runner outputs, compiler execution logs, and submission timestamps recorded to evaluate problem-solving methodologies.
• Visual Presence Telemetry: Periodic webcam video snapshots captured to verify candidate identity, detect off-screen visual gaze anomalies, and flag multi-person presence.
• Acoustic Telemetry: Ambient audio processing in the browser to identify verbal prompts or secondary speaker voices during assessment sessions.
• Environment Flags: Browser tab-switching, fullscreen exits, second monitor attachments, and clipboard copy-paste events recorded for the hiring panel's audit trail.

4. Legal Bases for Processing (GDPR Article 6)

We process personal information under the following recognized legal grounds:

5. Purpose of Processing

We process your personal information exclusively for specified, legitimate business purposes:

• Providing, maintaining, and enhancing our cloud compilers and assessment sandboxes.
• Generating objective evaluation scorecards and benchmark percentiles for hiring organizations.
• Verifying candidate identity and maintaining academic integrity during tests.
• Synchronizing candidate scorecards with employer Applicant Tracking Systems (ATS).
• Preventing malicious activities, automated scraping, or denial-of-service attacks.

6. Data Retention & Deletion

Personal Data is retained strictly as long as necessary to fulfill the operational purpose for which it was collected or as contracted with the hiring organization:

• Candidate Proctored Recordings: Video snapshots and proctoring telemetry are retained for 90 days by default (or according to employer retention policies) after which they are permanently purged.
• Account & Billing Data: Retained for the active duration of the customer contract plus applicable statutory tax retention periods.
• Candidate Anonymization: Once purged, candidate performance data is retained strictly in aggregate, anonymized statistical forms to calibrate benchmark percentiles.

7. Subprocessors & International Transfers

We engage trusted third-party cloud infrastructure providers that adhere to rigorous data protection standards (SOC-2 Type II, ISO 27001, GDPR Data Processing Agreements):

• Cloud Infrastructure: Amazon Web Services (AWS) and Google Cloud Platform for secure container execution and database storage.
• Media CDN: Cloudinary for encrypted proctoring video and snapshot streaming.
• Security & Bot Defense: Google reCAPTCHA Enterprise for form security and brute-force mitigation.

Where cross-border data transfers occur, we implement European Commission Standard Contractual Clauses (SCCs) to ensure equivalent data protection safeguards.

8. Candidate & User Rights

Under applicable data protection frameworks (including GDPR, CCPA, and India DPDP Act), you possess fundamental rights regarding your data:

To exercise any of these rights, contact our Data Protection Officer at info@conceptninjas.com. We respond to all verified requests within 30 days.

9. Security Safeguards

ConceptNinjas implements industry-standard technical and organizational security measures to protect your data against accidental loss, unauthorized access, or destruction:

• Encryption in Transit: TLS 1.3 encryption across all web traffic and API endpoints.
• Encryption at Rest: AES-256 encryption applied to all databases and snapshot storage volumes.
• Sandbox Isolation: Code execution occurs inside isolated, non-privileged Docker micro-containers with strict network egress controls.
• Role-Based Access Control (RBAC): Strict internal access controls with multi-factor authentication enforced on all production administrative environments.

10. Policy Updates & Inquiries

We reserve the right to modify this Privacy Policy to reflect platform enhancements, operational changes, or legal requirements. Material updates will be posted with an updated revision date on this page.