Last updated 2026-10-29
Who is responsible
Gearlay provides Rankr. For interviewer accounts, Gearlay is the controller. For candidate data, the organization that invited the candidate is the controller and Gearlay is its processor, acting on the data processing terms. Candidates with questions about their data should ask the organization that invited them; it can see, export and erase everything about them.
What we process about interviewers
- Email address and name, to sign you in and show who did what.
- Organization membership, role and team.
- The audit log of membership, team, role, domain and erasure changes you make.
- Billing contact and payment status. Card details never reach us; Stripe holds them.
- Server logs with IP address, time and the page requested, kept for thirty days for security and debugging.
What we process about candidates
- Name and email, entered by the interviewer.
- A CV, if the interviewer attaches one, and the summary a model reads from it.
- Everything the candidate does in an exercise: files viewed, comments, answers, rankings, verdicts, the prompts they send the assistant and its replies, and timestamps.
- The drafted and finalized score, the interviewer's recommendation and notes, and the pipeline stage.
We do not collect protected characteristics, video, audio or keystroke data, and the scorer never receives the candidate's name, email or CV.
Why
To run the exercises the organization asks for, score them, show the results to the organization, bill the organization, keep the service secure, and meet legal duties. For interviewers the legal basis is the contract with your organization and our legitimate interest in running a secure service. For candidates the basis is the one the inviting organization relies on, usually its legitimate interest in assessing applicants or the steps taken at the candidate's request before a contract.
Who else sees data
- Model providers. Anthropic and OpenAI receive exercise material, the candidate's work in a session, and short CV summaries for tailored exercises, through their APIs, which do not use the content for training. Never the CV itself for scoring.
- Stripe processes payments and holds billing details.
- The hosting and database provider stores the data, encrypted at rest.
- The email provider delivers sign-in links, invitations and candidate links.
We do not sell data and do not share it with anyone else unless the law requires it. Where a provider is outside your region, the transfer rests on standard contractual clauses or an equivalent mechanism.
How long
- Candidate data stays until the organization erases the candidate, closes, or reaches the retention period its admins set, after which closed candidates are erased automatically.
- Interviewer accounts stay until removed from every organization and deleted on request.
- Backups are kept for up to thirty days and then overwritten.
- Billing records are kept as long as tax law requires.
Your rights
Depending on where you live you can ask for access, correction, erasure, restriction, portability, and object to processing. Interviewers write to rankr@localhost. Candidates ask the inviting organization, which can export or erase their data from the candidate's profile in one step; if that fails, write to us and we will help. You can also complain to your data protection authority.
Cookies
Rankr sets only the cookies needed to keep you signed in and to remember your active organization, plus a browser setting for the theme. There is no advertising and no third-party tracking.
Changes
We update this policy when the service changes and note the date above. Material changes are announced to organization owners by email.