Privacy Policy

1. Introduction & Scope

This Privacy Policy explains how XATZ, operated by Procyon TechnoStructure LLC ("XATZ," "we," "us"), collects, uses, shares, and protects information through the XATZ recruiting platform (the "Service"), including our website, web application, and any connected interview, assessment, and outreach tools.

XATZ is used by two kinds of people, and this policy applies to both:

• Customers: the companies and staffing agencies ("Organizations") that sign up for XATZ to run their hiring process.
• Candidates: the people who apply to, are sourced for, or are contacted about a job through an Organization's use of XATZ.

Controller vs. processor. For most candidate data, the Organization that posted the job or initiated contact is the data controller; they decide what data is collected and why. XATZ acts as a data processor / service provider on the Organization's behalf. If you are a candidate with a question about your data, you may need to contact the Organization directly; we will support them in responding to you. Where XATZ determines its own purposes for data (for example, account and billing data for our Customers, or aggregated product analytics), XATZ acts as a controller for that data.

By using the Service, you agree to the collection and use of information as described in this policy.

2. Information We Collect

We collect this information directly from you, automatically through your use of the Service, and from the Organization that is using XATZ to evaluate you.

3. How We Use Information

We use the information described in Section 2 to:

• Operate the Service: create accounts and workspaces, parse resumes, run the hiring pipeline, and display candidate profiles to Organization staff
• Provide AI-powered features: source and rank candidates, place outreach calls, conduct interviews, and generate scores and proctoring reports (see Section 4)
• Run Workflow Automation rules that an Organization has configured (e.g., advancing a candidate, sending a notification, or triggering a rejection)
• Communicate with you: service notifications, scheduling, support requests, and (for Customers) product and billing updates
• Maintain security and prevent abuse, fraud, or misuse of the Service
• Comply with legal obligations and enforce our agreements
• Improve and develop the Service, including aggregated and de-identified analysis of how features are used

We do not use candidate interview or assessment content to train general-purpose AI models outside the Service without separate, explicit consent.

4. AI Features & Automated Decision-Making

XATZ uses artificial intelligence to source and rank candidates, conduct voice and video interviews, score responses, run proctoring checks, and trigger Workflow Automation actions. This section explains how that works and what rights you have.

• What AI generates: match/fit scores, interview scores (technical, communication, problem-solving), and proctoring flags.
• Human review: AI-generated scores and flags are decision-support signals for the Organization's hiring team, not final hiring decisions made by XATZ. Organizations are responsible for how they weigh AI output in their hiring decisions.
• Your right to request human review: where required by law, a candidate subject to a decision based solely on automated processing may request that a human at the Organization review that decision. Contact the Organization you applied to, or contact us at xatzsupport@procyonts.com and we will facilitate that request.
• Proctoring flags are not automatic disqualifications. A flagged event (for example, a face-match discrepancy or a tab-switch) is surfaced for human review, not acted on automatically.
• Workflow Automation: actions like advancing a candidate's stage, sending a notification, or triggering a rejection can be configured by the Organization to fire automatically based on AI-generated scores or flags. The rule itself is written and owned by the Organization, not XATZ.
• Fairness & oversight: scoring criteria are job-specific and configured per role by the Organization. We support Organizations in monitoring AI-generated scores for consistency, and a candidate may contact the Organization to contest a score they believe is inaccurate or unfair.

We encourage every Organization using XATZ to disclose to candidates, before an AI-led interview or assessment, that they will be interacting with an AI system.

5. How We Share Information

We do not sell candidate personal information.

We share information in these circumstances:

• Within a workspace: candidate data is visible to the Organization's authorized staff, scoped by their role and permissions (see Section 7 on workspace isolation and access control).
• Agency clients: if an Organization operates in Agency Mode, candidate data related to a specific client engagement is visible to that client's authorized users, as configured by the Organization.
• Sub-processors and AI vendors: we use third-party AI model, telephony/speech-to-text, and payment processing providers (see the table below) to power features like AI outreach calls, AI scoring, and billing. These vendors process data only on our instructions and under contractual confidentiality and data-protection terms. Resume files, interview video recordings, and AI-generated results are stored on infrastructure XATZ operates and controls directly (self-hosted object storage), not handed to a separate third-party storage vendor as a data processor.
• Service providers: analytics, customer support, and payment processing vendors, under confidentiality obligations.
• Legal & safety: when required by law, subpoena, or court order, or to protect the rights, safety, or property of XATZ, our users, or the public.
• Business transfers: if XATZ is involved in a merger, acquisition, or asset sale, information may be transferred as part of that transaction, subject to this policy (or a comparably protective policy).

6. Data Retention

XATZ does not currently run automated deletion (TTL) sweeps for most data categories. The table below reflects current practice, not a target retention schedule:

7. Data Security

We apply technical and organizational safeguards appropriate to the sensitivity of the data we handle, including:

• Encryption in transit: enforced via TLS/SSL across our API gateways, WebRTC video connections, and object storage (MinIO with SSL enabled).
• Encryption at rest: System credentials are encrypted, but candidate records and files are not natively encrypted by the application itself.
• Workspace (tenant) isolation, so one Organization's data is not visible to another
• Role-based access control, limiting internal and Organization-staff access to what a role requires
• Access logging: every database record is stamped with the user who created or last modified it, and a dedicated activity-log system tracks specific events (for example, viewing or deleting a document, modifying a candidate, or removing a client) tied to the user who performed them.
• Vendor security review for AI and infrastructure sub-processors
• An incident response process for investigating and notifying affected parties of a security incident as required by law

No method of transmission or storage is 100% secure. If you believe your account or data has been compromised, contact us immediately at xatzsupport@procyonts.com.

8. Your Rights & Choices

Subject to applicable law, you may have the right to:

• Access the personal information we (or an Organization, via us) hold about you
• Correct inaccurate or incomplete information
• Delete your information, subject to legal retention requirements
• Port your data to another service in a structured, machine-readable format
• Object to or restrict certain processing, including profiling used in hiring decisions
• Withdraw consent where processing is based on consent (for example, a recorded call or video interview)
• Opt out of sale/sharing: XATZ does not sell candidate personal information, so there is nothing to opt out of in that regard; residents of California and other states may still submit a request to confirm this.
• Appeal an automated decision, as described in Section 4

How to exercise these rights: if you are a candidate, we recommend contacting the Organization you applied to first, since they generally control the underlying data. You can also contact us directly at xatzsupport@procyonts.com, and we will route your request to the relevant Organization or respond directly where XATZ is the controller. We will respond within the timeframe required by applicable law (for example, 30 days under GDPR, 45 days under the CCPA).

9. Video, Voice & Biometric Data

• Video interviews & assessments: we record video and/or audio of AI-led interviews to generate transcripts, scores, and proctoring reports. Candidates are notified before a session begins and, where required by law, must provide explicit consent before the recording starts.
• Outreach & screening calls: our AI Voice Outreach agent does not record or store audio of its calls. It generates a text transcript of the conversation in real time (via our speech-to-text provider), which is what gets saved to the candidate's record; the call itself is placed through our telephony provider (see Section 5). Generating a transcript still involves processing the call's audio, which may trigger call-recording consent requirements under two-party/all-party consent laws in some states and countries (e.g., California, Florida), even though no audio file is retained afterward. The Organization is responsible for ensuring the required disclosure/consent is given before the call; XATZ provides tooling to support that disclosure. If an Organization separately records calls through its own tools outside of XATZ's AI Voice Outreach agent, that recording is not covered by this section.
• Proctoring & face-match data: during a proctored assessment, we may capture facial verification signals (to confirm the candidate's identity matches their profile), along with screen-share and tab-focus events. This may qualify as biometric information under laws such as the Illinois Biometric Information Privacy Act (BIPA), Texas's CUBI, Washington's biometric law, and similar statutes, which typically require specific written notice, consent, and a published retention/destruction schedule.

We do not use facial or voice data to make an identity determination for any purpose beyond verifying the person taking the assessment is the candidate on file.

10. Cookies & Tracking Technologies

Our marketing website and web application use cookies and similar technologies to:

You can control non-essential cookies through our cookie banner (on the marketing site) and through your browser settings. Disabling essential cookies may prevent the Service from working correctly.

11. International Data Transfers

XATZ's primary infrastructure (application servers, database, and self-hosted object storage) is physically hosted in Berlin, Germany, meaning most candidate data is, by default, stored within the European Economic Area (EEA). Some of our sub-processors are based outside the EEA, most notably our AI/LLM provider, which is based in the United States (see Section 5). Where we transfer personal information out of the EEA, the UK, or Switzerland, including to that AI provider or to XATZ staff located outside the EEA, we rely on appropriate safeguards such as Standard Contractual Clauses, unless the destination has been recognized as providing an adequate level of protection.

XATZ's self-hosted object storage (MinIO) runs on infrastructure provided by IONOS SE, physically located in Berlin, Germany.

12. Children's Privacy

The Service is intended for use by working-age adults applying for or hiring for jobs. It is not directed to children, and we do not knowingly collect personal information from anyone under the age of 16. If you believe a child has provided us with personal information, contact us at xatzsupport@procyonts.com and we will delete it.

13. Changes to This Policy

We may update this policy from time to time. If we make material changes, we will notify Customers by email and post a notice on the Service before the changes take effect. The "Last updated" date at the top of this policy reflects the most recent revision.

We will keep prior versions of this policy available on request so you can review what changed.

14. Contact Us

If you have questions about this Privacy Policy or want to exercise your rights, contact us at:

If you are not satisfied with our response, you may have the right to lodge a complaint with your local data protection authority.