Privacy Policy

This policy covers the recordings BlindSpots makes during an interview, which applies to candidates, and the Google user data We access when a recruiter connects a Google account or uses Our Google Calendar add-on.

Interview Recordings

When You take part in an interview through the Service, We capture recordings of that interview session. This is the core function of the Service and Your recruiter or prospective employer has arranged for it.

What We capture

• Camera images and video. Still images and video from Your device's camera during the interview session.
• Screen recording. A recording of the display You select when You begin the session. Depending on which display You choose to share, this may include content other than the interview itself, including other applications and windows open on that display, and the video of the meeting You are attending.

When We capture it

Recording takes place only during an interview session, only after Your browser has asked for Your permission, and only after You have granted it. Your browser will show its own indicator for as long as Your camera or screen is being accessed, and You can end that access at any time through Your browser or by leaving the session.

Why We capture it

To verify that the person attending the interview is the candidate the interview was arranged with, and to give the organisation conducting the interview a record of the session.

What We do not do

We do not perform facial recognition, face matching, or any other automated biometric identification on these recordings. We do not sell them, and We do not share them for advertising or marketing.

If We introduce automated identity matching in future, We will update this Privacy Policy and obtain any consent required by applicable law before that processing begins.

Who can see it

Recordings are available to the organisation that arranged Your interview and to Our personnel where necessary to operate and support the Service. They are not made public and are not shared with any other party.

How long We keep it

Interview recordings are retained for as long as necessary for the purposes described above. You may ask Us how long a particular recording will be kept by contacting Us at the address below.

Your choices

Recording is required to take part in an interview through the Service. If You prefer not to be recorded, You may decline — Your browser will not grant access without Your permission — and You should contact the organisation that arranged Your interview to make alternative arrangements.

You may request a copy of, or the deletion of, Your recordings at any time by contacting Us at hadi@lab352.com.

Google User Data

This section applies to recruiters and other users who connect a Google account to the Service, either by selecting “Connect Google” on Our setup page or by installing the Lab352 Interviews add-on for Google Calendar. It describes exactly what We access from Google, how We use it, and how We protect it.

What Google user data We access

• Your Google account email address, and a basic account identifier, when You sign in with Google on Our setup page (the openid and email permissions).
• OAuth access and refresh tokens that Google issues when You grant that permission.
• Through the Google Calendar add-on: Your Google account email address and the identifier of the calendar event on which You choose BlindSpots as the video conferencing option (the calendar.addons.execute, userinfo.email and userinfo.profile permissions). The profile permission is required by Google for add-ons; We do not read or store Your name or profile photo.

We do not access Your Gmail, Google Drive, contacts, or the contents of Your calendar events, such as titles, descriptions, attendees or times.

How We use Google user data

We use it only to provide the features You set up:

• Your email address identifies Your account, links Your Google connection to the interview settings You configured on Our setup page, and tells Us which recruiter an interview belongs to.
• The calendar event identifier lets Us create a BlindSpots interview link and attach it to that event as its conferencing details, so that You and Your candidate can join from the calendar invitation.
• OAuth tokens are used only to keep Your connection working and to confirm Your account with Google.

Limited use of Google user data

BlindSpots' use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide and improve the user-facing features described above, and for no other purpose.
• We do not sell Google user data, and We do not use or transfer it for advertising, including personalised, retargeted or interest-based advertising.
• We do not transfer Google user data to third parties, except as necessary to provide the features You use, to comply with applicable law, or as part of a merger or acquisition with Your notice.
• We do not use Google user data to determine creditworthiness or for lending purposes.
• We do not use Google user data to develop, improve or train generalised artificial intelligence or machine learning models.
• No person at BlindSpots reads Your Google user data unless You ask Us to, for example in a support request; it is needed for security purposes, such as investigating abuse; or it is required by law.

How We protect Google user data

• Encryption in transit. All data exchanged between Your browser, Google and Our servers is sent over HTTPS (TLS). Our servers talk to Google only over encrypted connections.
• Restricted storage. Your email address and OAuth tokens are stored on Our servers in a private location that is not publicly accessible and is excluded from source control.
• Access control. Access to Our servers is limited to authorised personnel. Tokens are never shown in the product, sent to Your candidates, or written to logs.
• Minimal permissions. We request only the Google permissions listed above and do not ask for broader calendar or account access.
• Request forgery protection. The Google sign-in flow is protected by a one-time state value, and conferencing requests from the Calendar add-on are authenticated with a shared secret.

Retention and deletion

We keep Your Google email address and tokens for as long as Your Google account remains connected to the Service. You can revoke Our access at any time from Your Google Account permissions page, or by uninstalling the Calendar add-on. To have Your stored Google user data deleted, email hadi@lab352.com; We will revoke Our tokens with Google and delete the data within 30 days.

Contact

Questions about this policy, or requests about Your data, go to hadi@lab352.com.