Privacy Policy

Last updated: June 24, 2026  ·  Questions: support@usegreenroom.app

1. Who we are

Greenroom (operated by Greenroom Technologies) provides two services: a candidate interview-practice tool, and a B2B AI screening platform for hiring companies. In the B2B context the hiring company is the data controller; Greenroom is the data processor. This policy covers both products. Sections marked Practice or B2B screen apply only to that product.

2. What we collect and why

Practice Candidate self-practice

• Name, email, profile picture (Google or LinkedIn sign-in)
• GitHub username, top repos, programming languages (if connected)
• Target role, company, interview date
• Session metadata: date, role, question count, feedback summary
• The text transcript, AI summary, and score of each session — saved to your account history so you can review your progress

What we store and what we don't, in the practice tool: Voice audio is processed in real time and never written to disk. Webcam video never leaves your device. The text transcript, AI summary, and score of each session are saved to your account history so you can revisit past sessions — these are auto-deleted on the schedule in Section 9 (90 days on paid, 7 days on the free tier) and you can erase them at any time by deleting your account (Section 10). We use your interview answers to improve our AI models only if you explicitly opt in (off by default — see Section 8).

B2B screen Hiring company screens

• Name and email (provided by the hiring company or entered by you)
• Voice audio recording of the full session
• Full interview transcript
• AI-generated score (1–10), sub-scores (technical, communication, role fit), and hire/no-hire recommendation
• Integrity signals: tab-switch count, fullscreen exits, paste events, response latency
• Job description provided by the hiring company

3. Lawful basis for processing (GDPR Articles 6 and 9)

For users in the EU, UK, and EEA, we rely on the following lawful bases:

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal. Email support@usegreenroom.app with the subject "Withdraw Consent."

4. Automated decision-making and AI scoring (GDPR Article 22)

When you complete a B2B screen, our AI analyses your responses and produces: an overall score (1–10), sub-scores for technical depth, communication, and role fit, a written performance summary, a hire recommendation, and any red flags.

What the AI evaluates: response content, technical accuracy, communication clarity and structure, alignment between your experience and the role, and response latency patterns. The AI does not evaluate accent, ethnicity, gender, age, or physical appearance.

The AI does not make hiring decisions. The AI output is advisory. Greenroom contractually requires all hiring companies (via our Data Processing Agreement) to ensure a human with genuine decision authority reviews AI outputs before any rejection decision is made. That human must have real authority to override the AI — not merely rubber-stamp it. Greenroom cannot guarantee the internal practices of individual companies but enforces this obligation contractually and may terminate access for companies that breach it.

Your rights under Article 22 (EU/UK candidates):

• Right to human review — request that your application be reviewed by a human without reference to the AI score. Email support@usegreenroom.app — "Human Review Request."
• Right to contest — if you believe the AI score is inaccurate or unfair, you may challenge it. We will provide the scoring rationale within 14 days.
• Right to explanation — request a plain-language explanation of what signals fed your score. Email support@usegreenroom.app — "Explanation Request."

Data Protection Impact Assessment: We have conducted a DPIA covering the nature, necessity, and risks of our AI scoring system. It is available to supervisory authorities on request.

5. Illinois Biometric Information Privacy Act (BIPA)

Pre-session written consent

If you are an Illinois resident, before your B2B screening session begins you will be presented with a separate consent screen that explicitly discloses: (a) that voice audio will be recorded, (b) the purpose of collection (candidate evaluation), (c) the retention and destruction schedule below, and (d) your right to decline and request an alternative process. That consent screen — not this policy — is your written release under BIPA. Proceeding past it constitutes your written, informed consent.

If you do not consent, email support@usegreenroom.app or contact the hiring company before your session to request an alternative selection process.

Biometric data retention and destruction schedule

Consistent with BIPA, we permanently delete voice audio at the sooner of:

• 90 days after the hiring company completes evaluation of your screen, or
• 3 years from the date of collection

Deletion is permanent — not archived, not anonymised. Transcripts follow the same schedule.

No sale or profit from biometric data

We do not sell, lease, trade, or profit from your voice recordings or any voiceprint data. We do not disclose biometric data to any third party except sub-processors delivering the service (see Section 11), each bound by equivalent protective obligations.

6. NYC Local Law 144 (Automated Employment Decision Tools)

Greenroom is an Automated Employment Decision Tool (AEDT) under NYC Local Law 144. Hiring companies using Greenroom to screen candidates for NYC-based roles must comply with LL144 independently. Greenroom supports compliance as follows:

Annual bias audit

We conduct an annual independent bias audit of Greenroom's scoring system, evaluating selection and scoring rates across sex and race/ethnicity categories. The most recent audit summary — including audit date, data source, selection rates, and impact ratios — is published at /compliance/nyc-local-law-144 and updated annually.

Candidate notice obligation

Hiring companies are responsible for providing candidates at least 10 business days' notice before a Greenroom screen is used, identifying the AEDT and the job qualifications it evaluates. Greenroom provides template notice language to hiring companies in our onboarding materials.

Right to alternative process

Candidates being evaluated for NYC-based roles may request an alternative selection process not involving the AI. Contact the hiring company directly. Hiring companies are contractually required to accommodate such requests.

Data available on request

Within 30 days of a written request we will provide: types of data collected, data source, and retention policy. Email support@usegreenroom.app.

7. California residents (CCPA / CPRA)

We do not sell personal information. With your opt-in consent we use Google Analytics for conversion measurement of our own advertising (see Section 14); apart from that we do not share personal information for cross-context behavioural advertising. We honour Global Privacy Control (GPC) signals — when GPC is present, analytics and any such sharing are disabled automatically and no consent banner is shown.

Automated Decision-Making Technology (ADMT)

Greenroom uses ADMT to produce hire/no-hire recommendations. Before your session begins, you will receive a pre-use notice describing how the system works, what personal information it uses, the outputs it generates, and how those outputs influence hiring decisions. You may request an alternative selection process by contacting the hiring company or emailing support@usegreenroom.app. We will not retaliate against you for making this request.

Categories of personal information collected (past 12 months)

• Identifiers: name, email address
• Audio recordings (B2B screens only)
• Internet or electronic network activity: session logs, integrity signals
• Professional or employment-related information: role, company, interview responses
• Inferences: AI scores and hire recommendations drawn from the above

California residents may exercise all rights in Section 10. Responses within 45 days of a verifiable request.

8. India — Digital Personal Data Protection Act, 2023 (DPDPA)

Notice and consent (DPDPA Section 5)

Before or at the time we collect your personal data, we provide notice of: what personal data we collect (Section 2 above), the purpose of collection, your rights under this section, and how to file a complaint with the Data Protection Board of India. Where we rely on your consent, that consent is free, specific, informed, unconditional, and unambiguous, given through a clear affirmative action (for example, the pre-session consent screen for B2B screens). You may withdraw consent at any time as easily as you gave it — email support@usegreenroom.app — "Withdraw Consent." Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Use of your answers to improve our models (opt-in)

We do not use your interview answers to train or improve our AI models unless you have explicitly opted in. This consent is off by default, separate from the consent required to run your session, and you can grant or withdraw it at any time in your account settings (or by emailing support@usegreenroom.app). Withdrawing stops all future capture; to also erase answers already captured while you were opted in, delete your account (Section 10), which removes them. This applies to all users, not only those in India, and reflects our commitment in Terms of Service Section 9.

Children's data

DPDPA defines a "child" as anyone under 18. Greenroom does not knowingly collect personal data from anyone under 18 and requires all users to confirm they are 18 or older (see Terms of Service, Eligibility). We do not process a child's personal data on the basis of verifiable parental consent — if you believe a user under 18 has provided us personal data, email support@usegreenroom.app and we will delete it.

Your rights as a Data Principal

• Right to access a summary of personal data processed and the processing activities undertaken (Sec. 11)
• Right to correction and erasure of inaccurate, incomplete, or no-longer-necessary personal data (Sec. 12)
• Right to grievance redress — see Grievance Officer below (Sec. 13)
• Right to nominate another individual to exercise these rights on your behalf in the event of death or incapacity (Sec. 14)

To exercise any of these rights, email support@usegreenroom.app. See Section 10 for response timelines.

Grievance Officer (DPDPA Section 13)

Greenroom has designated a Grievance Officer to address complaints from Data Principals in India. Contact: support@usegreenroom.app (subject line "Grievance — DPDPA"). We will acknowledge your grievance within 7 days and aim to resolve it within 30 days. If unresolved, you may escalate to the Data Protection Board of India.

Cross-border transfer

Personal data of Indian users may be transferred to and processed by sub-processors located outside India (see Section 11). The Indian government has not currently restricted transfer to any of the countries in which our sub-processors operate. We will comply with any future restrictions notified by the Indian government.

Security and breach notification

We apply the safeguards in Section 13 to personal data of Indian users. In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals as required under the DPDPA, in addition to our general 72-hour breach notification commitment (Section 13).

9. Data retention

The following periods are exact commitments, not approximations. The longer retention for AI scores is a legal obligation under NYC LL144 and CCPA ADMT regulations (Art. 6(1)(c) GDPR basis), which overrides GDPR's data minimisation principle for those specific records.

10. Your rights

11. Sub-processors and data sharing

We do not sell your data. We share data only with the sub-processors below, each bound by a data processing agreement. We will notify affected customers at least 30 days before adding or replacing a sub-processor.

Copies of applicable Standard Contractual Clauses for US-based transfers are available on request: support@usegreenroom.app.

12. B2B hiring companies — your obligations as data controller

When your company uses Greenroom, you are the data controller. Greenroom is your data processor. A Data Processing Agreement (DPA) governing this relationship is available at /dpa and is incorporated into our Terms of Service by reference. EU customers requiring a countersigned DPA should email support@usegreenroom.app.

As data controller you are responsible for:

• Providing candidates at least 10 business days' notice before a Greenroom screen is used (NYC LL144)
• Publishing Greenroom's bias audit summary on your careers website (NYC LL144)
• Providing a functional path for candidates to request an alternative selection process
• Ensuring a human with genuine decision authority reviews AI recommendations before rejection (GDPR Art. 22)
• Obtaining BIPA written consent from Illinois-resident candidates before their session begins — Greenroom's pre-session modal satisfies this if you use our hosted screen link; if you embed Greenroom via API, consent collection is your responsibility
• Including Greenroom in your own privacy policy sub-processor list
• Appointing a Data Protection Officer if required by GDPR Article 37

13. Security

• Data in transit: TLS 1.3
• Data at rest: AES-256
• Audio files: encrypted object storage, access-controlled signed URLs, time-limited
• Internal access: role-based, MFA enforced
• Payment data: handled by Stripe / Razorpay — we never store card details
• Security incidents: we will notify affected users within 72 hours of confirmed breach (GDPR Art. 33 standard). For Indian users, we will also intimate the Data Protection Board of India as required under the DPDPA.

14. Cookies and tracking

We use the following cookies and similar technologies:

Analytics are off until you opt in. Google Analytics and PostHog do not load and set no cookies unless you accept them in the consent banner shown on your first visit. If you decline (or take no action), no analytics or session-replay technology runs. You can change your choice at any time via the cookie banner (reopen it from any page) — declining stops future analytics; clearing your browser storage resets the choice.

We honour Global Privacy Control (GPC) signals: if your browser sends GPC, analytics are treated as declined automatically and the banner is not shown. The authentication cookies above are strictly necessary to log you in and are not used for tracking.

15. EU representative (GDPR Article 27)

Greenroom Technologies does not have an establishment in the EU or UK. As required by GDPR Article 27, we are in the process of appointing a designated EU representative. Until that appointment is complete, EU and UK data subjects may direct queries and complaints to support@usegreenroom.app. We will update this section with the representative's name and contact details upon appointment.

16. Changes to this policy

Material changes will be communicated by email to registered users and by updating the date above. Continued use of Greenroom after the effective date constitutes acceptance. For changes to BIPA-specific processing, we will obtain fresh written consent before the change takes effect.

17. Contact and complaints

Privacy questions: support@usegreenroom.app — we aim to respond within 3 business days.

EU / UK residents: if unsatisfied with our response, you may lodge a complaint with your local supervisory authority (ICO in the UK: ico.org.uk; or your EU member state's DPA).

Illinois residents: complaints regarding BIPA compliance may be submitted to the Illinois Attorney General or via private right of action under 740 ILCS 14/20.

California residents: complaints may be submitted to the California Privacy Protection Agency (CPPA).

Indian residents: grievances should first be raised with our Grievance Officer (Section 8). If unresolved, you may file a complaint with the Data Protection Board of India.