Privacy Policy

matchaskill evaluates technical talent through AI video interviews and competency scoring. This policy explains what personal data we process, why, for how long, and what rights you have over it.

It is governed by Peru's Law No. 29733 on Personal Data Protection and its Regulation approved by Supreme Decree No. 016-2024-JUS, in force since March 30, 2025. Where we process data of people in the European Economic Area, Regulation (EU) 2016/679 (GDPR) applies as well.

Who is responsible

Controller: matchaskill, Lima, Peru. Privacy contact: privacidad@matchaskill.com.

Two roles matter here, because they decide who you should address:

• Customer data (whoever opens an account and runs hiring processes): we act as the controller.
• Candidate data: we act as a processor on behalf of the company that invited you. That company is the controller and decides why you are evaluated and how long your data is kept.

What we process

• Account data: name, work email, company and authentication data of the people using the dashboard.
• Application data: name, email, identity document where the role requires it, form and screening answers, and the file or repository you submit for the technical challenge.
• Interview data: the audio and video of the session, its transcript, and the competency scoring derived from it. Voice and image are handled with particular care and only with your prior, informed and express consent.
• Usage data: technical logs, device and browser type, IP address, and the usage events described below.

We neither request nor want additional sensitive data — health, racial or ethnic origin, religious beliefs, union membership, sex life or political opinions. Do not ask for it in your questions or mention it in the interview.

Purposes and legal bases

• Delivering the service — running the interview, transcribing it and generating the competency report: performance of the contract with our customer and, for the candidate, prior, informed, express and unambiguous consent given before the interview starts.
• Authenticating users and protecting accounts: legitimate interest in service security.
• Measuring product usage to improve it: legitimate interest, on aggregated and pseudonymised data.
• Complying with legal obligations and responding to lawful requests.

We do not sell personal data and we do not use it to train third-party models.

Automated decisions: what we do and what we don't

This is the most important section of this policy, so we will be blunt: matchaskill rejects no one. The system produces a score and a recommendation; the decision to advance or discard is always taken by a person at the hiring company.

The Regulation to Law 29733 recognises the right not to be subject to decisions based solely on automated processing that produce legal effects or significantly affect the data subject, including employment decisions. Article 22 of the GDPR says the equivalent. Therefore:

• You are told before you start that an AI conducts the evaluation.
• The result is an input for a human, never an automatic rejection.
• You may request human intervention, express your point of view and contest the outcome, by writing to us or to the company that evaluated you.
• We contractually require our customers to keep that human review. Using the score as the sole ground for rejection is prohibited by our Terms.

First-party analytics, no cookies, no vendors

We measure usage with our own system, on our own infrastructure. We use no Google Analytics and no third-party tool, and we set no analytics cookies — which is why you will not see a cookie consent banner.

• We store a random identifier in your browser's local storage. It contains no name or email and you can remove it by clearing site data.
• We record which pages are visited, where you arrived from (campaign parameters or referring site) and which buttons are pressed.
• We record the kind of device (phone, tablet or computer), the browser and operating system family, the timezone your browser reports and your language preference. We never store your IP address, and we never store the full browser identification string, which would be enough to single you out.
• We record relative coordinates of taps and clicks — proportional position on screen, never absolute pixels and never the text of the element — to see where interface use concentrates.
• None of this is recorded during the interview. That surface is excluded from analytics by design.
• These events carry no name and no email. If an account is deleted, the events linked to it lose that link automatically and survive only as anonymous counts, which is what lets us compare one month against another without keeping anything that points back at a person.
• You can turn it off. The switch below stops the measurement in this browser and removes the identifier that was stored. It applies to this site: the dashboard and the application portal each keep their own preference, because a browser never lets one site read another's storage.

We do use strictly necessary cookies to keep your session signed in. Without them the dashboard cannot work.

Processors and providers

We share data only with the providers we need in order to operate, always under a data-processing agreement and never for their own purposes:

• Cloud infrastructure: hosting, database and file storage.
• Language and speech model providers, to conduct and score the interview.
• Real-time audio and video infrastructure.
• Authentication and identity provider.
• Transactional email provider.
• Competent authorities, where the law requires it.

International transfers

Our infrastructure and several providers operate in the United States, so data is transferred outside Peru. Where the destination country lacks an adequate level of protection, we rely on standard contractual clauses and the safeguards required by the Regulation to Law 29733. You can request a copy of those safeguards at the contact address.

Retention

• Account data: while the account is active and up to two years after closure.
• Application, interview and scoring data: for the period the hiring company configures, and deleted sooner on request where no legal retention duty applies.
• Usage events: kept while the service operates, so one period can be compared against another. They hold no name or email, and the link to an account disappears with the account.
• Security and audit logs: twelve months. These record administrative actions on our infrastructure — who signed in to the cloud account and what they changed — not your activity in the product.
• Operational server logs: fourteen days. Errors, restarts and response times, kept only long enough to diagnose an incident.

Your rights

You may exercise the rights of access, rectification, cancellation and objection (ARCO under Peruvian law), plus portability, restriction of processing, withdrawal of consent and not being subject to solely automated decisions.

To exercise them write to privacidad@matchaskill.com stating your name, the right you are exercising and a document proving your identity. We answer within the deadlines set by Peruvian law — ten business days for objection, for example. If you are a candidate, contact the company that invited you first, since it is the controller; if you get no answer, write to us and we will help.

If you believe your request was not handled properly, you may complain to Peru's National Authority for Personal Data Protection at the Ministry of Justice and Human Rights, or to your national supervisory authority if you are in the European Union.

Security and incidents

We encrypt data in transit and at rest, apply least-privilege access control and log relevant activity. No system is infallible: if a security incident affects personal data we will notify the National Authority and the affected people within a maximum of 48 hours of becoming aware of it, in plain language, explaining what happened and what to do.

Children

The service is intended for professional hiring and is not directed to minors. We do not knowingly collect data from children; if we find that we have, we delete it.

Changes to this policy

We may update this policy. The date in the header marks the current version and we will tell customers about any material change before it takes effect.

Contact

For any privacy question or to exercise your rights, write to privacidad@matchaskill.com.