Privacy Policy

1. Introduction

This Privacy Policy describes how Yolex Labs ("Yolex Labs," "we," "us," or "our") collects, uses, stores, and shares personal information when you access or use our website and any related services, software, or applications (collectively, the "Services").

This Privacy Policy applies to business users (such as employers, recruiters, or hiring managers) using the Services, and individuals participating in assessments or simulations conducted through the Services ("Candidates").

By using the Services, you acknowledge that you have read and understood this Privacy Policy.

If you have questions or concerns, please contact us at: support@yolexlabs.com

2. Roles and Scope of Processing

Yolex Labs operates primarily as a service provider to business customers who use the Services to conduct talent assessments, simulations, and evaluations.

For candidate data processed through an assessment, Yolex Labs acts as a data processor on behalf of the business customer, who is the data controller. Yolex Labs acts as a data controller only for limited operational purposes: platform security, fraud prevention, billing, and aggregate usage statistics that do not identify any individual.

Candidates should first contact the organization that invited them to an assessment or simulation for requests related to hiring decisions or deletion of application data.

Candidates taking an assessment are governed by the Candidate Privacy Notice presented in the assessment platform before the assessment begins. That notice is the operative document for candidate data and describes retention, biometric handling, and jurisdiction-specific rights in full detail. Where this policy and the Candidate Privacy Notice differ, the Candidate Privacy Notice governs.

3. Information We Collect

3.1 Information Provided by Business Users

We may collect personal information provided by business users, including name and contact information; company information; job descriptions, position requirements, and hiring criteria; intelligence briefs and assessment configurations; resumes and application materials uploaded to the Services; and communications with Yolex Labs.

All information provided must be accurate and lawful to share.

3.2 Candidate and Assessment Information

As part of providing AI-powered assessment and simulation services, we collect and process audio and video recordings of simulations and assessments; transcripts of candidate interactions; responses to assessment scenarios and simulation prompts; resumes and application materials; and AI-generated assessments, evaluations, and analytical outputs.

Assessment content is evaluated on what a candidate says and produces: the substance of their work against the criteria defined by the business customer.

The following are outside the scope of our AI systems and are not analyzed, inferred, or scored:

• Tone of voice, prosody, accent, or manner of speaking
• Facial expressions, emotional state, mood, engagement, or confidence
• Any behavioral or biometric characteristic, and any inference from ambient audio
• How a candidate looks or presents during the assessment

Session recordings are captured for integrity verification and are reviewed by the business customer's hiring team. They are not processed or analyzed by AI.

Yolex Labs does not perform facial recognition and does not generate biometric identifiers for identification purposes. Session recordings may nonetheless constitute biometric information under certain state laws, including the Illinois Biometric Information Privacy Act and the Colorado Privacy Act. Where those laws apply, recordings are handled under the notice and consent requirements described in the Candidate Privacy Notice, and are never sold, leased, or traded.

3.3 Information Automatically Collected

When you access or use the Services, we may automatically collect IP address; device and browser information; operating system; usage activity; pages visited and timestamps; and approximate location derived from IP address.

This information is used for security, analytics, and service improvement purposes.

3.4 Cookies and Tracking Technologies

This website is static and sets no cookies. It loads one privacy-friendly analytics script (Plausible), which uses no cookies, collects no personal information, and does not track visitors across sites or over time. It loads no advertising or cross-site tracking scripts.

The assessment and employer platforms set only strictly necessary cookies: those required to keep you signed in and to protect the session. We do not use advertising or cross-site tracking cookies anywhere in the Services.

3.5 Information from Minors

The Services are not intended for individuals under the age of eighteen (18). We do not knowingly collect personal information from minors.

4. How We Use Personal Information

We process personal information to provide and operate the Services; conduct and analyze assessments and simulations; generate AI-based insights, evaluations, and candidate assessments; maintain platform security and prevent fraud; process payments; communicate with users and provide support; send administrative communications; produce aggregate usage statistics that do not identify any individual; and comply with legal obligations.

We do not use candidate assessment data to train AI models. See Section 5.

5. AI Processing and Model Training

We do not train AI models on candidate data. Assessment recordings, transcripts, responses, resumes and evaluation outputs are not used to train, fine-tune, or improve any Yolex Labs or third-party model. Our AI providers process this data solely to return a result for that assessment, under contractual terms that prohibit training on it.

We may use aggregate, de-identified statistics about platform usage (counts, durations, error rates) to operate and improve the Services. This never identifies a candidate or a customer and is never sold.

5.1 AI outputs are advisory, and a human decides

AI-generated outputs, including candidate assessments and simulation evaluations, are decision-support tools only. They are probabilistic, they can be wrong about an individual, and they are not guaranteed to be accurate or complete.

AI output must not be the sole basis for any hiring decision. Meaningful human review is required before a candidate is advanced, rejected, ranked, or excluded from consideration, and in a number of jurisdictions that review is a legal obligation rather than a best practice. The platform does not auto-advance, auto-reject, or hide a candidate from a human reviewer. The business customer's hiring team is responsible for every decision about an application.

Automated transcription is imperfect and its error rates are not uniform across accents and speech patterns. Human reviewers are instructed to verify quoted material against the underlying recording before it counts against a candidate.

6. Legal Bases for Processing (EEA and UK Users)

Where applicable, we process personal information based on performance of a contract; legitimate business interests, including improving our Services; consent where required; compliance with legal obligations; and protection of vital interests.

7. Sharing of Personal Information

We share personal information with the sub-processors listed below, each of which processes data solely on our instructions to operate the Services:

• Hetzner and Google Cloud Platform — cloud infrastructure, hosting, databases, and storage
• OpenAI, Anthropic and Google Gemini — AI inference for generating assessment content and evaluating written responses
• SendGrid — candidate and recruiter email
• Microsoft Identity — authentication
• Plausible Analytics — cookieless website traffic statistics for this marketing site. It receives no candidate data and no account data.
• Stripe — payment processing for business customers. Stripe does not receive candidate data.

The list above is the current and complete set of sub-processors. We will update this policy when it changes.

We may also disclose personal information to legal or regulatory authorities where required by law, and to a successor in connection with a merger or sale of substantially all assets.

We do not sell personal information and do not share personal information for cross-context behavioral advertising.

8. International Data Transfers

Our databases are primarily located in the European Union. Certain third-party service providers or AI systems may process data outside the EU, including in the United States.

Where personal data is transferred from the EEA or UK to a third country without an adequacy decision, we implement Standard Contractual Clauses approved by the European Commission, together with additional technical and organizational measures where necessary. Details of the transfer mechanisms in place are available on request at support@yolexlabs.com.

9. Data Retention

We operate fixed retention windows and delete automatically. A daily sweep enforces them, and each deletion is recorded in an audit log.

• Session recordings stored by Yolex Labs — deleted within 30 days of the conclusion of the hiring process.
• Assessment transcripts, responses and evaluation outputs — deleted within 90 days of the conclusion of the hiring process.
• Recordings stored by the business customer on its own infrastructure — the business customer is the controller and is responsible for retention and deletion.
• Aggregate, de-identified usage statistics — may be retained indefinitely. These do not identify any individual.

Business-account records are retained while the account is active and for as long as needed to meet legal, tax and accounting obligations.

Where earlier deletion is requested and legally permissible, data will be deleted or anonymized.

10. Security Measures

We implement reasonable technical and organizational measures designed to protect personal information. However, no method of transmission or storage can be guaranteed to be completely secure, and use of the Services is at your own risk.

11. Your Privacy Rights

Depending on your location, you may have rights to access your personal information; request correction or deletion; restrict or object to processing; withdraw consent where applicable; and request data portability.

Candidates should first contact the employer or organization that initiated the assessment or simulation. Requests may also be submitted to: support@yolexlabs.com

12. California Privacy Rights (CCPA / CPRA)

If you are a California resident, you may have rights to know what personal information we collect and use; request deletion of personal information; request correction of inaccurate information; opt out of sale or sharing of personal information; limit use of sensitive personal information; and not be discriminated against for exercising privacy rights.

Yolex Labs does not sell or share personal information for cross-context behavioral advertising.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by a revised "Last Updated" date. Continued use of the Services after updates constitutes acceptance of the revised policy.

14. Contact Us

If you have questions about this Privacy Policy or your personal information, contact support@yolexlabs.com