Privacy Policy

Kula Staffing & Consulting B.V. operates the Roobiks platform. For the personal data described in this policy we act as the controller, except where we process candidate data on a customer’s documented instructions — in which case that customer is the controller and we are the processor (see Section 9).

Controller details

• Company: Kula Staffing & Consulting B.V. (“Roobiks”)
• Country of incorporation: the Netherlands
• Registered address: [TO BE COMPLETED: registered address]
• Chamber of Commerce (KvK) number: [TO BE COMPLETED: KvK registration number]
• VAT number: [TO BE COMPLETED: VAT identification number]
• Privacy contact: privacy@roobiks.com
• Data Protection Officer or privacy contact person: [TO BE COMPLETED: DPO name and contact address, or a statement that no DPO is required under GDPR Art. 37]

We are established in the European Union, so no GDPR Article 27 representative is required for EU processing. If we later process the personal data of individuals in the United Kingdom or another jurisdiction that requires a local representative, those details will appear here: [TO BE COMPLETED: UK / non-EU representative details, if and when one is appointed].

Data you give us directly

• Identity and contact details — your name, email address and, where the inviting company asks for it, your phone number.
• Video and audio recordings — the answers you record in your browser in response to each Prompt. These contain your image, your voice, and whatever you choose to say.
• Any other content in your answers — anything visible in your camera frame or audible in your recording, and any text you type into the recorder.

Data we generate from your recordings

• Transcripts — a machine-generated, word-timed text transcript of each answer, plus caption (VTT) files used for accessibility.
• Summaries — a short AI-written summary of each answer.
• Signals — AI competency evaluations. Each competency is scored on a 0–3 scale with one or two evidence bullets citing the specific Prompt the evidence came from. Insufficient evidence is an allowed and normal outcome. The competencies assessed are Self-Awareness, Collaboration, Adaptability, Accountability and Motivation.
• Technical metadata about the recording — such as duration and a still thumbnail frame.

Data collected automatically

• Device and technical data — IP address, browser and device type, camera and microphone capability checks, and error diagnostics needed to make recording work and to keep the platform secure.
• Usage and audit data — records of status changes, share-link creation and revocation, and video downloads, so that access to your recording is traceable.
• Consent records — the fact that you gave consent, the moment you gave it, and the version of the consent text you were shown.

Customer and reviewer data

• Work contact details and account credentials for the recruiters and reviewers who use the console, plus their ratings, comments, and activity within the platform.

A video recording of you is not an ordinary piece of paperwork. It carries your face, your voice, your accent, and often visual cues about your home, your health, or your background that you never intended to disclose. We recognise that this makes interview recordings biometric-adjacent and unusually revealing, and we apply stricter handling to them than to ordinary contact details.

To be clear about what we do not do: Roobiks does not perform biometric identification. We do not build a faceprint or a voiceprint, we do not attempt facial recognition, we do not match you against any database of faces or voices, and we do not use your recording to identify you anywhere other than in the Submission you deliberately created. We also do not run emotion detection, personality inference, or any analysis that attempts to infer a protected characteristic such as your race, ethnicity, health, disability, age, sex, sexual orientation, religion, or trade union membership.

Please do not volunteer special-category information (for example about your health, religion, or political views) in a recording unless it is genuinely relevant and you are content for it to be processed. If you disclose something you would rather withdraw, contact us and we will work with the inviting company to remove the affected answer.

• To let you record, review, re-record where permitted, and submit your answers.
• To deliver your Submission to the company that invited you, so its reviewers can watch and evaluate it.
• To generate transcripts, captions, summaries and Signals that help reviewers assess your answers consistently and with cited evidence.
• To send you transactional email — your invitation, reminders, and confirmation that your Submission was received.
• To keep the platform secure and available: authentication, abuse and rate-limit protection, error diagnosis, backups.
• To maintain audit records of who accessed a Submission and when.
• To comply with our legal obligations.

We do not sell personal data. We do not use your recordings, transcripts or Signals to train AI models, and our AI providers are engaged on terms that do not permit them to train on your data.

• Consent (GDPR Art. 6(1)(a)) — for making the video and audio recording itself. Before your browser is asked for camera or microphone access, the recorder shows you an explicit consent statement that you must actively tick. We store the timestamp and the version of the consent text you accepted. You are never recorded before you have given that consent.
• Steps prior to entering a contract, and contract (GDPR Art. 6(1)(b)) — processing your application data as part of the recruitment process you asked to take part in, and providing the platform to our customers under our agreement with them.
• Legitimate interests (GDPR Art. 6(1)(f)) — running a fair and evidence-based hiring process, securing the platform against abuse, keeping audit logs, and improving the product. We balance these interests against your rights and freedoms, and you can object at any time (see Section 10).
• Legal obligation (GDPR Art. 6(1)(c)) — where we must retain or disclose data to comply with the law.

Withdrawing your consent

You can withdraw your consent to the recording at any time, and it is as easy to withdraw as it was to give. Email privacy@roobiks.com from the address you were invited on, or contact the company that invited you. When you withdraw consent we stop processing the recording and delete it, together with the transcript, summary and Signals derived from it, unless we are required by law to keep a record.

Withdrawing consent does not make our earlier processing unlawful, and it may mean the company that invited you cannot continue considering your application — because it will no longer have the interview it asked for. You will not be penalised for withdrawing; you may ask the inviting company for an alternative format such as a live interview.

AI-assisted, human-decided. Roobiks uses AI to help reviewers read a Submission faster and more consistently. It does not make hiring decisions. No candidate is advanced, rejected, ranked out, or filtered out of a process automatically by our AI. A human reviewer at the inviting company watches the video and decides.

What the AI actually does

• Transcription — the audio of each answer is sent to a Google Gemini model, routed through OpenRouter, which returns a word-timed transcript and caption file.
• Summaries — an Anthropic Claude model, routed through OpenRouter, writes a two-to-three sentence summary of each answer.
• Signals — the same Claude model scores each competency from 0 to 3 and must cite the Prompt number that each piece of evidence came from. Where an answer does not contain enough evidence, the model is required to return insufficient evidence rather than guess. Absent and negative findings are permitted.

Safeguards

• Signals are indicative, not determinative. They are presented to reviewers as decision support alongside the video, never as a verdict.
• Every Signal shows the evidence behind it, so a reviewer can check the claim against what you actually said.
• Low-confidence and insufficient-evidence outputs are surfaced for human attention rather than converted into a score.
• The AI scores answers to job-related Prompts. It is not instructed to assess, and must not be used to assess, personal characteristics unrelated to the job.
• A customer can switch Roobiks AI off entirely for its account. When disabled, responses are not transcribed, summarised, or evaluated.

Because a human always makes the decision, we do not consider this to be a decision based solely on automated processing under GDPR Article 22. You nonetheless retain the right to ask how AI output was used in your case, to express your point of view, to request human review, and to contest the outcome — contact us or the inviting company using Section 13.

The company that invited you

Your Submission, transcript, summary and Signals are made available to the company whose Interview you recorded for, and to the reviewers it authorises. That company may also create a time-limited public share link so a hiring manager outside the platform can watch your Submission; share links can be revoked and every create, revoke and download event is logged.

Sub-processors

We use the following sub-processors, each under a written data processing agreement. Our production data is stored in the European Union.

• Supabase (EU region) — our database, authentication, and storage of the video and audio recordings. Candidate data is stored in Supabase’s EU region.
• OpenRouter — routes our AI inference requests to the transcription and evaluation models described in Section 6. It receives the audio and transcript of your answers for the purpose of producing that output.
• Resend — sends transactional email such as your interview invitation and reminders. It receives your name and email address.
• Vercel — hosts the Roobiks web application and serves it to your browser.

We may also disclose personal data to professional advisers, to regulators or law enforcement where we are legally required to, and to a successor entity in the event of a merger, acquisition or reorganisation. We will tell affected individuals where the law requires it.

Our database, storage and application hosting are configured to keep production personal data in the European Union. Some sub-processors — in particular the AI inference route and elements of our email and hosting providers’ support operations — may involve processing outside the European Economic Area. Where that happens we rely on an appropriate GDPR Chapter V transfer mechanism, normally the European Commission’s Standard Contractual Clauses together with supplementary technical measures, or an adequacy decision where one applies.

The current, per-provider transfer position and a copy of the relevant safeguards: [TO BE COMPLETED: confirmed transfer mechanism and processing locations for each sub-processor, verified against their current DPA]. You may request this information from us at any time.

Each customer company has a configurable retention setting in Roobiks that controls how long Submissions are kept. When a Submission passes that window, an automated retention job deletes the video, its transcript, its summary and its Signals. The platform default is 12 months from the date of the Submission, and a company may set a shorter or longer window within the limits the platform allows.

The retention period Kula Staffing & Consulting B.V. commits to as a matter of policy, and any exceptions to it: [TO BE COMPLETED: confirmed default retention period and any legal-hold exceptions, agreed with counsel].

We keep some records for longer where we must: consent records and audit logs are retained to evidence compliance, and account and billing records are retained for the period required by Dutch law. Where we no longer need to identify you, we delete or irreversibly anonymise the data.

When a customer uses Roobiks to run its own hiring, that customer decides which roles to advertise, whom to invite, what to ask, how long to keep the results, and whom to hire. For that candidate data the customer is the controller and Roobiks is the processor, acting only on the customer’s documented instructions. The customer’s own privacy notice governs how it uses your data, and you can direct any request to it. If you send us a request that belongs to a customer, we will forward it and help the customer respond.

You have the right to:

• Access — obtain confirmation of whether we process your data and receive a copy of it, including your recordings, transcripts and Signals (Art. 15).
• Rectification — have inaccurate data corrected and incomplete data completed (Art. 16).
• Erasure — have your data deleted, including your recordings, where the grounds in Art. 17 apply.
• Restriction — ask us to pause processing while a dispute about accuracy or lawfulness is resolved (Art. 18).
• Portability — receive the data you gave us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible (Art. 20).
• Objection — object to processing based on our legitimate interests, on grounds relating to your particular situation (Art. 21).
• Withdraw consent — at any time, as described in Section 5 (Art. 7(3)).
• Human intervention — request human review of, express your view on, and contest any evaluation that affected you (Art. 22 safeguards).
• Complain to a supervisory authority — see below.

Exercising these rights is free and we will respond within one month, a period we may extend by two further months for complex requests, telling you if we do. We may need to verify your identity before acting.

Complaints

If you are unhappy with how we handle your data you can lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with the supervisory authority in the EU member state where you live or work. We would appreciate the chance to resolve your concern first, but you are not required to come to us before complaining.

• Encryption in transit — all traffic to the platform, including video upload, runs over TLS.
• Encryption at rest — the database and the video storage bucket are encrypted at rest by our EU infrastructure provider.
• Row-level access control — every table enforces row-level security so a company’s data is reachable only by that company’s authorised users. Public recorder and share routes go through token-checked server handlers; the browser is never given broad database access to candidate data.
• Time-limited signed video URLs — recordings are not publicly addressable. Playback uses a signed URL that expires within 15 minutes, so a copied link stops working.
• Audit logging — status changes, share-link creation and revocation, and video downloads are recorded.
• Rate limiting on all public endpoints, and least privilege for internal access.

No system is perfectly secure and we do not claim otherwise. If a personal data breach occurs we will notify the Autoriteit Persoonsgegevens within 72 hours where the GDPR requires it, and notify affected individuals where the breach is likely to result in a high risk to their rights.

To exercise any right, ask a question, or raise a concern, email privacy@roobiks.com. Please tell us the email address you were invited on and, if you can, the company whose Interview you recorded, so we can find your Submission.

Postal address for data protection correspondence: [TO BE COMPLETED: registered postal address for Kula Staffing & Consulting B.V.]

See also our Terms of Service.

The Services are intended for people of working age. We do not knowingly collect data from children. If you believe a child has recorded a Submission, contact us and we will delete it.

We use only what the platform needs to work: cookies and local storage for signing you in, keeping your recording session alive if your connection drops, and protecting against abuse. These are strictly necessary and cannot be switched off without breaking the Services. We do not use advertising cookies and we do not sell or share data with ad networks.

If we add optional analytics we will ask for your consent first, and list what we use here: [TO BE COMPLETED: final cookie inventory, and consent-banner behaviour if optional analytics are introduced].

We may update this policy. We will revise the “Last updated” date and, where a change materially affects you, tell you directly. Where a change requires fresh consent we will ask for it rather than assume it.