Privacy Notice

How we handle personal information, protect it and help you exercise your rights.

Effective 23 October 2026 · Last updated 23 October 2026

On this page

Who operates QAVetted

QAVetted, an Indian sole proprietorship, operates the service. QAVetted's registered business address is E-703, Palash 2E, Wakad, Pune, Maharashtra 411057, India. Its business telephone is +91 99228 72272. General questions can be sent to support@qavetted.com. Privacy and data-rights requests can be sent to data-protection@qavetted.com.

The roles we play

Candidate assessment data: the hiring company that invites a candidate decides why and how that candidate's assessment data is used. It acts as controller, and QAVetted processes the data on its instructions to deliver the assessment service.
QAVetted's own prospect, client-account, support-administration, website, and billing purposes: QAVetted decides why and how this information is used and acts as controller. Client-controlled assessment data accessed to provide support remains covered by the processor role.
Payments: Stripe acts as a separate controller for the payment data it processes for its own purposes, under its own privacy policy.

The Data Processing Agreement sets out QAVetted's contractual duties when processing personal data on a client's behalf.

Information we process

Public website visitors

The public website does not use an account login, contact form, advertising trackers, analytics, or non-essential cookies. Cloudflare processes basic request and security information, such as IP address, requested URL, user-agent, and time, to deliver and protect the website and the application.

Trial requests

The application's free-trial request form collects the requester's name, work email, company, company size, and role. QAVetted reviews each request and records its outcome; an approved request becomes the new client account.

Prospects and support correspondents

When someone emails QAVetted, we receive the sender's name and email address, organization and role information they provide, message content, attachments, and correspondence history. People should not send passwords, candidate content, card numbers, identity documents, or other unnecessary sensitive information.

Client accounts

For an approved client, QAVetted may process account identity, work email, organization, role, the record of accepting the Terms of Service, assessment configurations, billing state, subscription and usage records, support history, security events, and account-administration actions. Stripe handles complete payment-card details; QAVetted does not store full card numbers.

Candidates

On behalf of the hiring company, QAVetted may process:

name, email address, and the invitation with its timing and status;
which version of the Assessment Terms the candidate accepted, and when;
answers to multiple-choice questions, written responses and their saved drafts, practical work, workspace files, test runs, and test output;
conversations with the AI assistant, when the hiring company offers it;
the activity records described below;
scores, cited evidence, summaries, integrity results, the hiring recommendation, and comparisons with other candidates of the same assessment;
for a Live Interview, its schedule, meeting link and participants, and the private notes each interviewer keeps; and
the hiring company's decision.

Assessment activity records

To support fair review, an assessment records:

when the candidate leaves the assessment for another browser tab or program, and when they return;
copy, cut and paste in the assessment and its workspace, with the length and type of the content but not the content itself; and
long periods of inactivity, judged only from whether the keyboard or pointer is in use, never from which keys are pressed, what is typed or where the pointer is.

The assessment page and the separate window it can open for the application under test count as one assessment, so switching between them is not leaving. Copied text is held only in the browser's memory and is used only to recognize text copied within the assessment. Some copy actions inside the workspace are not observed, so a paste with no matching recorded copy is not by itself evidence that the text came from outside the assessment.

QAVetted never accesses a candidate's camera, microphone or screen, records which keys they press, sees their browsing history or what they do in other tabs or programs, or collects biometric data.

Before starting, a candidate sees a short summary of what the assessment records, with a link to this notice, and agrees to the Assessment Terms. The same records are made during a Live Interview. They give authorized people at the hiring company context for their review and never reject a candidate automatically.

Live Interviews

During a Live Interview, the interviewers the hiring company assigns can watch the candidate's code editor and the application under test as the candidate works, and can type and click in them to work with the candidate. Each interviewer can also keep private notes about the interview. Audio and video take place outside QAVetted, through a meeting link the hiring company provides.

Why information is used

to respond to product, support, privacy, and contractual inquiries;
to review trial requests and administer approved organization accounts;
to configure, deliver, secure, evaluate, and support candidate assessments and Live Interviews;
to provide clients with reviewable results and contextual evidence;
to operate trials, subscriptions, usage metering, invoices, refunds, and financial records;
to prevent abuse, investigate incidents, maintain reliability, and comply with legal obligations; and
to establish, exercise, or defend legal claims when necessary.

For candidate assessment data, the hiring company decides the purposes and the lawful basis. The activity records rely on the hiring company's legitimate interests in the integrity and fairness of its assessments.

For QAVetted's own processing, where UK GDPR or EU GDPR applies, the basis may be performance of a contract, steps requested before a contract, legal obligation, or legitimate interests in operating and securing an access-approved business assessment service.

QAVetted makes no hiring decision. Clients agree not to use its results as the sole automatic basis for a hiring or rejection decision, and their people make every decision.

AI processing

QAVetted uses Anthropic's API for these kinds of processing:

writing and checking assessment questions;
evaluating submitted practical work against the task's criteria, which decides its score;
reviewing activity records for possible integrity concerns;
reviewing the AI assistant conversation, when there is one, as part of the evaluation;
writing summaries for the hiring company and helping prepare a hiring recommendation; and
running the AI assistant, when the hiring company offers it.

Multiple-choice answers are marked against a fixed answer key. The AI Notice explains AI processing to candidates. QAVetted does not use candidate or client personal data to train general-purpose AI models.

Parties that receive information and how disclosure occurs

QAVetted discloses only the information required for the recipient's service or authorized purpose. Information is transferred through encrypted network connections, authenticated provider integrations, or controlled account access.

Hiring company: its authorized people receive their invited candidates' submissions, evaluation, activity records, and AI assistant conversations through their access-controlled QAVetted accounts, and its interviewers watch a Live Interview as it happens.
Amazon Web Services: application hosting, file storage, transactional email, and operational logs in the London region.
Supabase: database and authentication services in the London region.
Cloudflare: delivery and security of the public website and the application.
Stripe: payment processing, subscription billing, invoices, eligible refunds, and payment-risk controls.
Anthropic: the AI processing described above, through its API.
Sentry: application error information in its European region, without contact details, secrets, authentication data, or conversation content.
Google Workspace: delivery and storage of business email when someone contacts QAVetted.
Cal.com: scheduling information only when a person chooses to use a booking link.
Professional and public authorities: limited disclosure to advisers, auditors, banks, tax or regulatory authorities, courts, or law enforcement when reasonably necessary and lawfully authorized.

QAVetted does not sell personal data or disclose it for third-party advertising.

Cookies and browser storage

The public website sets no cookies of its own. QAVetted's cookies keep client users signed in to the application and let a candidate, an interviewer or a client user previewing a challenge open their workspace. The application also keeps some information in the browser of the device in use: interface preferences, the open challenge and layout of an assessment, and copies of written responses and question selections, so work survives a reload. Those copies are cleared from that browser after a successful submission, when it shows the completion page, or when a client user signs out. None of this is used for advertising or analytics.

International transfers

The operator is based in India and the primary application infrastructure is located in the United Kingdom. Some providers operate globally, including in the United States and European Union. Hosting in the United Kingdom does not mean that all processing or access takes place there. Transfers must meet the requirements of the applicable data-protection law. The Data Processing Agreement sets out the restrictions on transferring client-controlled data; publishing it does not itself establish a transfer safeguard.

Retention

Information	Normal retention
Security records of the public website and the application	Kept by Cloudflare under its service settings and legal obligations
Trial requests	Kept while under review; an approved request stays with the client account, and a declined request becomes eligible for deletion 12 months after the decision
Prospect and ordinary support correspondence	Kept for as long as needed to answer and follow up the request, and longer only where the law requires
Demo booking details	Kept in QAVetted's scheduling and email accounts for as long as needed to arrange and follow up the call
Candidate assessment records: invitation, work, answers, evaluation, AI assistant conversations, Live Interview details and notes, and decisions	Kept while the client account exists, and deleted at verified account closure or earlier when a deletion request is granted
Raw assessment activity records	Eligible for deletion 90 days after the assessment ends, or deleted earlier with the candidate's other data; the integrity result derived from them stays with the assessment result
Saved drafts of answers and written responses	Removed when the challenge is submitted or the assessment ends
Client-account data	Retained until verified account closure and completion of required deletion; a client user's sign-in account remains while they belong to another organization
Billing, tax, and financial records	At least six years after the account closes
AI cost and runtime records	Kept for cost analysis and runtime evidence, without any link to a person once that person's data or the account is deleted
Records of privacy requests	Six years after the request closes
Operational logs	Normally 30 days unless a security incident requires a limited, documented hold

QAVetted keeps no disaster-recovery backups of its databases or stored submissions. Providers keep some copies under their own terms: an address the email provider stops sending to after a bounce or complaint stays on that list until a granted erasure removes it, a delivered email cannot be recalled, and error reports, provider logs and the AI provider's copies follow those providers' retention terms. A confirmation of deletion states what was deleted and never claims that a provider copy was deleted.

Security practices

QAVetted encrypts information while it is sent and stored. Client data is separated by organization, access is limited by role, and sensitive credentials are protected. Security records are kept only as long as needed. This public website does not request access to a visitor's camera, microphone, location, or payment information.

A suspected security or privacy incident should be reported to data-protection@qavetted.com without including passwords, tokens, or unnecessary personal data.

Rights and choices

Subject to the law that applies, a person may request access, correction, deletion, restriction, objection, portability, or information about processing. Where processing relies on consent, a person may withdraw that consent at any time. We may verify identity and authority before disclosing or changing personal data.

Candidates can send a request to the hiring company that invited them or to data-protection@qavetted.com. QAVetted forwards a candidate's request about their assessment data to the hiring company without undue delay; the hiring company decides it, and QAVetted helps it respond. Clients, prospects, and website correspondents can contact data-protection@qavetted.com. Requests about Stripe's own payment processing go to Stripe.

Where UK GDPR applies, a person may complain to the UK Information Commissioner's Office. Where EU GDPR applies, a person may complain to the competent supervisory authority. Rights under applicable Indian law remain available as its provisions take effect.

Children

QAVetted is a business hiring service and is not directed to children. A client must not invite a person below the legally permitted working or assessment age without first establishing an appropriate lawful basis and obtaining QAVetted's written agreement.

Changes and contact

If the information collected, purpose, recipient, retention, or legal context changes, this page and its effective date are updated. Material changes affecting an existing client are communicated before they take effect where reasonably practicable.

General contact: support@qavetted.com. Privacy and rights requests: data-protection@qavetted.com.