Privacy policy
Last updated: 4 October 2026
This policy explains what information dontapplyai collects, why we collect it and how long we keep it. We've tried to keep it short and easy to read.
Who we are
dontapplyai is operated by dontapply.ai, Inc. We're responsible for the personal information described in this policy. When you add content to dontapplyai, such as your interview questions and notes, you're responsible for that content and we look after it on your behalf.
Information we keep about you
| Information | Why we need it | How long we keep it |
|---|---|---|
| Your email address | To sign you in and to contact you about your account | For as long as you have an account |
| Sign-in codes and sessions | To sign you in and keep you signed in | Codes work for 30 minutes and are deleted at most two days after that. Sessions last up to 30 days. |
| If your company signs you in through its identity provider: the ID it gives you there, and your name as it sends it | To sign you in through your company's identity provider | The ID until you leave your company's account or it removes the connection. Your name for as long as you have an account. |
| If your company adds you through its identity provider: your user name and ID there, your name, and whether your access is on, as it sends them | So your company's identity provider can add you, keep your details up to date and turn off your access when you leave | For as long as you have an account |
| Your IP address | To protect the service from misuse | Up to 48 hours |
| Billing records | To take payments and meet our accounting obligations | As long as the law requires |
| Your interviews: their slides, notes and marks | To run your interviews | 90 days after the interview ends, or after it was made if it never started, then deleted. An interview still running is kept until it ends. |
| Your saved questions | So you can use them again | Until you delete them, and 7 days after that |
| The candidate reference you enter, and the candidate's name if you add one | So you can tell your candidates and interviews apart | Until you delete the candidate or their interviews. Once none of their interviews is left, 90 days after the candidate was added, changed or last given an interview. |
| The candidate's email address, when the interviewer enters one or the interview asks for an email code | To send the candidate the code that opens the interview and, if the interviewer schedules the interview, the calendar invitation and any change to it | With the interview. An address the candidate typed is forgotten when the interviewer resets the link. Codes work for 30 minutes. |
| A message the candidate leaves when they cancel a scheduled interview | To pass it to the interviewer | With the interview, until the interviewer gives it a new time or the candidate's details are hidden |
| Where the candidate's pointer is on the interview page, and the size of their window | To show the interviewer the candidate's page while the interview runs | Until the interview ends, or the interviewer resets the link |
| When the candidate switched to another tab or window during the interview, and came back | To show the interviewer | With the interview |
| The candidate's browser signals: time zone, languages, platform, whether software controls the browser, screen size and count, processor cores, memory, graphics card, whether a VPN or proxy is likely and, if the interviewer turns it on, a one-way hash of the device | To show the interviewer what may need checking | With the interview. The address a STUN server saw is compared and not kept. |
| When the candidate copied, pasted into the code box, connected a second screen or likely opened developer tools during the interview | To show the interviewer | With the interview |
| What the candidate types in the code box on a code question | To show the interviewer the candidate's answer, while the interview runs and in its report | The last version, with the interview |
| The key to your applicant tracking system (ATS), if you connect one | To find the candidates who reach a stage, and to write notes to their record in your ATS | Encrypted, until you disconnect the ATS |
| Your ATS's IDs for a candidate and their application | To link an interview to the candidate's record in your ATS | Until the interview made from them is deleted, or 90 days if nobody opens its link. Deleted sooner when the candidate is deleted in your ATS. |
| If you connect your calendar: its address, and the key Google or Microsoft gives us to it | To put the interviews you run on your calendar, and to say when you're busy when someone schedules an interview for you. We see only when you're busy, never what your events are, and keep none of it. | The key encrypted, until you disconnect your calendar or leave the account |
| Which event on your calendar belongs to which interview | To change or remove the event when the interview changes | Until you disconnect your calendar, or three days after the interview is deleted |
When a company opens an account, we email what was entered on the registration form to our staff, so they know who has joined.
Information about candidates
We store the reference the interviewer enters for a candidate, such as C-4412, and, if the interviewer adds them, the candidate's name and the role and level they're interviewed for. The name is shown only in the console, to the people on the interviewer's account. It never appears on the screen the candidate sees, on the candidate's page or in our website analytics. Besides these, an interview keeps what the interviewer records while it runs: notes on each answer, which follow-up questions were asked, and marks such as "answered a decoy" or "long pause", with their times. We ask interviewers to keep names out of their notes. We don't record calls, transcribe anything or process audio or video. We don't store CVs, and we don't score or assess anyone.
An interviewer can send the candidate a link to the interview, which opens a page in the candidate's own browser. The link works until the interview ends, and the interviewer can replace it with a new one at any time, which stops the old one working. Before the questions appear, the page checks the candidate's browser and tells us the browser's name and version, the operating system, whether the browser can protect the screen, and whether the window is large enough to read a question. It also checks whether any browser extension on our list of AI assistants is installed, and tells us only which of those it found. It looks for no other extension. It also reads, without asking the candidate: the candidate's time zone and languages, the platform their browser names, whether software says it is controlling their browser, the size and colour depth of their screen and whether a second screen is connected, the number of processor cores, the memory and the graphics card their browser reports. We compare their time zone with the one their connection's address suggests. Unless the interviewer turns it off, the page also asks a STUN server for the address the browser reaches the internet from, which we compare with the connection's address to tell the interviewer whether a VPN or proxy is likely, and don't keep. Under the same switch, we look the connection's address up on public lists of VPN servers and Tor exits and tell the interviewer which lists it is on. If the interviewer turns it on, the page also sends a one-way hash of the device, and we tell the interviewer whether it opened their account's other interviews. We keep this, and when the candidate opened the link and said they were ready, with the interview, so the interviewer can see that the candidate is ready and the names of any extensions found, and we delete it with the interview. While the interview runs, the page also tells us the size of the candidate's window, where their pointer is on the page, and when they switch to another tab or window and come back. The interviewer sees the pointer on a copy of the page, with a map of where it went on each question. We keep the pointer positions only until the interview ends, and the times the candidate switched away and came back with the interview, which we delete with it. On a code question, the page also tells us the text the candidate types in the code box under the question, about once a second while it changes, and nothing else about their typing. The page also tells us when the candidate copies from the page, when a second screen is connected and, unless the interviewer turns these off, when they paste into the code box and when developer tools likely open, but never what was copied or pasted. We keep these times with the interview. The interviewer sees it as it arrives. We keep the last version with the interview as the candidate's answer, and delete it with the interview. Unless the interviewer turns it off, the page also asks the candidate to confirm their email address with a 6-digit code we email them, so that someone else with the link cannot open the interview. The address is the one the interviewer entered or, if they entered none, the first one typed on the page. We use it only to send the code and, if the interviewer schedules the interview, the calendar invitation and any change to it. We show it in full only to the people on the interviewer's account, and delete it with the interview. The invitation has a link the candidate can use to cancel until the interview starts, with a message for the interviewer. The page it opens sets no cookie. To protect the service from misuse, we also keep a one-way hash of the address for up to 48 hours. The candidate interview terms set out what the candidate agrees to. When the candidate uses the page, we also keep their IP address for up to 48 hours, to protect the service from misuse.
The page may ask whether the candidate has a visual impairment, such as colour blindness. Before the candidate answers, the page says that the answer is sent to the interviewer, who may arrange another way to interview them, such as face to face. We keep the answer with the interview, show it only to the people on the interviewer's account, and delete it with the interview. It never reaches our website analytics.
Unless the interviewer turns it off, the page may also ask for the location of the candidate's browser. It asks only when the candidate clicks Allow, and their browser asks them first. If they allow it, the page sends us the latitude and longitude rounded to two decimal places, about 1 km, and how accurate the browser says it is, never the browser's own figures. If they refuse, the page tells us so and the interview goes on. We keep the location, or that it was refused, with the interview, show it only to the people on the interviewer's account, and delete it with the interview. The page doesn't use a camera or microphone, doesn't record the screen or the call and doesn't use website analytics. It sets one cookie, which keeps the candidate's browser on the interview's link for a day.
If the interviewer's company connects an applicant tracking system (ATS), we keep only the ATS's IDs for the candidate and their application, never their name or contact details, even when the ATS sends them to us. When an interview from the ATS ends, we write the interviewer's marks to the candidate's record there, with the interviewer's view if they give one, and the view again if they give, change or clear it later. The company's own retention rules apply to that record. When the candidate is deleted or anonymised in the ATS, we delete these IDs and remove the reference from their interviews.
If an interviewer connects their Google or Microsoft calendar, we put each interview they run on it, with the interview's title, the candidate reference and the links to the interview and the call. We never put the candidate's name or email address there. The interviewer's calendar provider then holds the event under its own terms.
dontapplyai doesn't make automated decisions about candidates. Whether a candidate is using AI is always for the interviewer to judge.
Payments
Payments are handled by Stripe. Your card details go straight to Stripe and never reach us. We keep the Stripe customer and subscription references, so we know which plan you're on. For a free trial we also keep the fingerprint Stripe gives the card, which tells one card from another without its number, so that each card gets one free trial.
Your questions and our testing
We never send your questions to a third-party AI service. To test our designs, we use a fixed set of sample questions written for that purpose, never customer content.
How your information is stored
Your information is stored by our hosting provider. Backups are kept for seven days.
Three other companies help us provide the service: our hosting provider, which runs the service and stores its data; Stripe, which handles payments; and an analytics provider in the EU, which tells us how our website is used.
Cookies
We use six cookies, all our own. One keeps you signed in: it's set when you sign in and removed when you sign out. One ties a sign-in code to the browser that asked for it, and lasts thirty minutes. One ties a sign-in through your company's identity provider to the browser that started it, and lasts ten minutes. One lets you finish the registration form once your address is confirmed, and lasts thirty minutes. One remembers the affiliate link you arrived by, for 90 days, so the person who shared it is credited. One keeps a candidate's browser on the interview link it opened, for a day. We don't use advertising cookies or anyone else's cookies, which is why you won't see a cookie banner on our site.
Website analytics
An analytics provider in the EU tells us how our website and console are used. It sets no cookies and stores nothing in your browser. It records the pages you visit and some of the steps you take, such as asking for a sign-in code, starting a checkout or creating an interview, with your browser, your type of device and your approximate location, which it works out from your IP address. On our public pages it also records where you click and scroll, with anything typed into a form hidden.
It never receives your email address, your interviews, your questions or the candidate references and names you enter, and we don't use it to identify you. The pages candidates see during an interview don't use it at all.
Your rights
You can ask for a copy of your information, ask us to correct or delete it, or object to how we use it. To do any of these, email us at support@dontapplyai.com or use our contact form.
If a candidate asks you to delete an interview that mentions them, end it if it is running, then delete it in the console. Its slides, notes, marks and candidate reference are deleted, and they drop out of our backups within seven days. We keep only a record that an interview took place, so it still counts towards that month's plan. An admin can also delete all of a candidate's interviews at once in the console, which deletes the candidate's name and reference with the last of them.
If you're unhappy with how we've handled your information, please tell us first. You also have the right to complain to your local data protection authority.