Candidate data and AI processing

What information does Decision Agent process?

Assessment data can include a candidate’s name and email, CV information, questionnaire answers, scenario responses, voice recordings, transcripts and report findings. Recruiters and connected systems can also supply role information and recruitment context. The information involved depends on the modules and integration used.

Decision Agent is the recruitment-assessment service of Featuring You Limited, company number 15449301.

Who controls candidate data?

For assessments run by a hiring organisation, that organisation generally acts as the controller and Decision Agent acts as its processor. Decision Agent is a controller for its own account, billing and business-relationship information. An RPO arrangement needs to specify the responsibilities of the RPO and its client.

Ask to review the proposed Data Processing Addendum during procurement. The customer agreement should cover instructions, security, sub-processors, rights requests, return or deletion, and any agreed additional requirements.

Why do we keep assessment evidence?

We retain responses and assessment evidence so recruiters can read reports, check findings and return to the underlying work. Retained information can also support hiring optimisation where permitted by the customer agreement. The permitted purpose and the customer’s instructions matter; retaining data does not give us unrestricted permission to reuse it.

Our aim is to help teams learn which assessment evidence is useful in their hiring process. Linking it to later hiring or performance outcomes requires the relevant data and an agreed use. This is separate from claiming that today’s scores are validated predictions of job performance.

Which providers receive information, and where?

We use external services for hosting, database and storage, email, monitoring, AI inference and voice processing. AI inference means processing an input to produce a response or finding; it is different from training a model. OpenRouter routes model requests, while voice and transcription services have their own processing paths.

The sub-processor list names the services and processing locations. Primary application data is hosted in the UK; some suppliers also process information in the United States or other countries. Ask us to confirm any required regional arrangement before using the service.

The Privacy Policy describes international-transfer safeguards. If a procurement review requires provider agreements or transfer-assessment information, include that in the request.

Do providers keep data or use it for training?

Provider-side retention, provider training and Decision Agent’s own storage are separate questions. A provider can exclude training while retaining information for another purpose. Zero retention at an inference endpoint would not delete the assessment evidence stored by Decision Agent.

We cannot give a blanket assurance today that every provider and feature has zero retention or excludes provider training. Voice services can retain recordings and transcripts. Ask us to confirm the specific providers, settings and contractual protections for your proposed workflow. Do not assume a protection applies to a fallback model or transcription service simply because it applies to another model.

Customer agreements can impose stricter limits on training and improvement. Those restrictions must be considered alongside our public service terms and candidate terms.

How long is information kept, and how is it deleted?

Retention depends on the data, service and customer agreement. We do not publish one fixed period covering all responses, recordings, logs, backups and supplier copies. Procurement should establish the agreed periods, what a deletion request covers and when backup copies expire.

Customer agreements can provide for return or deletion at the end of the service. Candidates can contact info@decision-agent.ai about their rights; where the hiring organisation is the controller, its involvement may be needed. The Privacy Policy says we respond to verified rights requests within 30 days or as required by applicable law. A response deadline is not a guarantee that every backup is erased on that date.

Can assessments contain health or other sensitive information?

Our Privacy Policy instructs users not to upload special-category or sensitive information, including health information, into assessments. A realistic healthcare scenario should not use identifiable patient records. Do not assume that a supplier’s healthcare certification makes a particular Decision Agent workflow suitable for sensitive data.

Discuss an exceptional requirement before collecting the information. An assessment brief or an individual candidate’s agreement does not by itself establish the processing arrangement.