Privacy Policy
Codeit Inc. (the "Company"), in providing Cayde, an AI interview platform (the "Service"), establishes and discloses this Privacy Policy in accordance with Article 30 of the Personal Information Protection Act in order to protect the personal information of data subjects and to handle related complaints promptly and smoothly.
The Company provides the Service to businesses, and a business that uses the Service is referred to as a "Customer." The personal information covered by this Policy is divided as follows.
- Personal information of individuals who create an account to use the Service or who submit inquiries or requests to the Company: processed by the Company as a personal information controller.
- Personal information of candidates who take part in a Customer's hiring process: the purposes and scope of processing are determined by the Customer, and the Company processes such information as a processor (i.e., an entrusted party under the Personal Information Protection Act) within the scope entrusted to it by the Customer. Although candidates do not enter into a service agreement directly with the Company, matters concerning candidates are also described in this Policy so that they can see how their personal information is processed.
Article 1 (Purposes of Processing, Items Collected, and Retention Periods)
(1) The Company collects and processes the minimum personal information necessary for the following purposes. Personal information is not used for any purpose other than those listed below, and if the purpose of use changes, the Company will take necessary measures such as obtaining separate consent.
(2) Personal information that the Company directly collects and processes as a personal information controller is as follows.
| Purpose of Processing | Items Collected | Retention and Use Period |
|---|---|---|
| Account creation and provision and management of the Service | (Required) Email, name, password (Optional) Profile image | Destroyed without delay upon account deletion |
| Handling adoption consultations, inquiries, and free trial requests | (Required) Email (Depending on the request or inquiry channel) Name, phone number, company name, company size, inquiry details and consultation history, referral source | 1 year after the purpose is achieved |
| Payment and settlement of fees | Information required for issuing tax invoices, payment history (For refund requests) Account holder name, account number, bank | 5 years in accordance with relevant laws such as the Framework Act on National Taxes |
| Management of Service usage records and prevention of misuse | (Automatically collected) IP address, browser and device information, cookies, Service usage records | 1 year from the date of collection |
| Sending promotional information and sales information (Optional) | Email, name, phone number, company name | Destroyed without delay upon withdrawal of consent or account deletion |
(3) Personal information that the Company processes as a processor on behalf of Customers is as follows.
| Purpose of Processing | Entrusted Items | Retention and Use Period |
|---|---|---|
| Supporting the hiring process, operating AI-based interviews, reviewing interview content and preparing evaluation reports, and preventing fraudulent test-taking | Candidate's name and email address, submitted documents (such as résumés) and information extracted from them, interview video and audio, answer transcripts generated through speech recognition, access logs and test-taking records, test environment records for preventing fraudulent test-taking, evaluation reports | 12 months from the interview date (or the invitation date if the candidate did not take the interview). However, if relevant laws prescribe a shorter period, that period applies, and if a reason for destruction arises earlier, such as a destruction request from the Customer or termination of the service agreement between the Customer and the Company, the information is destroyed at that time. |
(4) Only where the Company has obtained the candidate's own separate consent does it process personal information for its own purposes as follows, and it does so in the capacity of a personal information controller. Candidates who do not consent will not be disadvantaged in taking the interview or in the hiring process.
| Purpose of Processing | Items Collected | Retention and Use Period |
|---|---|---|
| Training and improving the performance of Cayde's artificial intelligence models | Interview video and audio, answer transcripts generated through speech recognition, evaluation reports | 3 years from the interview date. Destroyed without delay upon withdrawal of consent or a deletion request. |
Article 2 (Provision of Personal Information to Third Parties)
(1) The Company processes personal information only within the scope of the purposes set out in Article 1 and does not use it beyond that scope or provide it to third parties without the consent of the data subject. However, this does not apply where special provisions exist in relevant laws or where it is unavoidable to comply with legal obligations.
(2) The Company does not provide candidates' personal information entrusted by Customers to third parties. Entrustment of personal information processing, including overseas transfers, is governed by Article 3.
Article 3 (Entrustment of Personal Information Processing)
(1) The Company entrusts personal information processing as follows in order to provide the Service, and manages and supervises the entrusted parties so that they process personal information securely in accordance with relevant laws.
| Entrusted Party | Purpose of Entrusted Work | Personal Information Entrusted |
|---|---|---|
| NAVER Cloud Corp. (CLOVA Speech) | Speech recognition (STT) of interview audio | Interview audio |
| Channel Corporation (Channel Talk) | Responding to and consulting on customer inquiries | Name, email address, inquiry details and consultation history |
(2) The Company transfers personal information overseas as follows for entrustment and storage necessary to conclude and perform contracts with data subjects (Article 28-8(1)(3) of the Personal Information Protection Act). The information is transferred via information and communications networks at the time the Service is used (including remote access for system maintenance), and the recipients retain and use the personal information until the purpose of the entrustment is achieved or the entrustment agreement ends.
| Entrusted Party | Country of Transfer | Contact | Personal Information Transferred | Purpose of Entrustment |
|---|---|---|---|---|
| Amazon Web Services, Inc. | United States (personal information is stored in the Republic of Korea region) | aws-korea-privacy@amazon.com | All personal information listed in Article 1 | Provision of cloud infrastructure and sending emails |
| OpenAI, LLC | United States | privacy@openai.com | Candidate's name, interview audio, answer transcripts, information extracted from submitted documents | Speech recognition (STT), conducting AI interviews, and generating evaluation reports |
| ElevenLabs, Inc. | United States | legal@elevenlabs.io | Candidate's name, interview audio, answer transcripts, information extracted from submitted documents | Speech recognition (STT), conducting AI interviews, and generating evaluation reports |
| Google LLC (Gemini) | United States | googlekrsupport@google.com | Candidate's name, interview audio, answer transcripts, information extracted from submitted documents | Speech recognition (STT), conducting AI interviews, and generating evaluation reports |
| TypeSafe AI, Inc. | United States | privacy@typesafe.ai | Candidate's name, answer transcripts, information extracted from submitted documents | Conducting AI interviews and generating evaluation reports |
| Sentry, Inc. | United States | compliance@sentry.io | IP address, device and browser information | Monitoring Service errors |
| Amplitude, Inc. | United States | privacy@amplitude.com | IP address, device and browser information, Service usage records | Analyzing Service usage behavior |
(3) ElevenLabs, Inc. subcontracts part of its large language model processing to the following sub-processor in order to conduct AI voice interviews.
- Sub-processor: Google LLC (country of transfer: United States; contact: googlekrsupport@google.com); sub-entrusted work: processing interview conversations using large language models via Vertex AI.
(4) Data subjects may refuse the overseas transfer of their personal information. However, if they refuse, the AI interview cannot be provided and participation in the hiring process may be limited. A candidate's refusal is received through the Customer conducting the hiring.
(5) If the details of the entrusted work or the entrusted parties change, the Company will disclose the change through this Policy, and notice to Customers will be given as set out in the Terms of Service.
Article 4 (Evaluation Using Artificial Intelligence)
(1) To support hiring processes conducted by Customers, the Company uses artificial intelligence to conduct interviews, analyzes their content to generate evaluation reports, and provides those reports to Customers.
(2) Evaluations are based on what the candidate says in the interview and are performed by producing item-by-item evaluation results and their rationale according to evaluation criteria set by the Customer. If the candidate has submitted documents, they are also used to design interview questions and to verify answers.
(3) Evaluation reports are reference materials that assist in hiring decisions, and the hiring decision is made by the Customer. Candidates who wish to exercise their rights regarding automated decisions under Article 37-2 of the Personal Information Protection Act must make the request to the Customer conducting the hiring, and the Company will cooperate with any necessary measures at the Customer's request.
Article 5 (Training of Artificial Intelligence Models)
(1) The Company uses a candidate's interview data to train its artificial intelligence models only where it has obtained that candidate's own consent under Article 1(4), and does not use the data of candidates who have not consented for training.
(2) The Company does not use candidates' interview data to train artificial intelligence models on the basis of a Customer's consent or a contract with a Customer.
(3) Candidates may withdraw the consent in paragraph (1) at any time in the manner set out in Article 7. Upon withdrawal, the Company will exclude the candidate's data from processing for training purposes without delay and destroy it. However, it is technically impossible to remove the influence of individual data from models whose training was completed before the withdrawal.
(4) Candidates' interview data transferred overseas by the Company under Article 3 is not used to train the recipients' artificial intelligence models.
Article 6 (Destruction of Personal Information)
(1) The Company destroys personal information without delay when it is no longer needed, such as when the retention period has elapsed or the purpose of processing has been achieved.
(2) Notwithstanding paragraph (1), the Company retains books and supporting documents related to transactions (including payment history and information required for issuing tax invoices) for 5 years in accordance with the Framework Act on National Taxes and the Corporate Tax Act, and in such case stores and manages that personal information separately from other personal information.
(3) Personal information in electronic file form is permanently deleted in a manner that makes it impossible to restore, and other records and printouts are destroyed by shredding or incineration.
(4) The destruction of candidates' personal information entrusted by Customers is governed by Article 1(3).
Article 7 (Rights of Data Subjects and How to Exercise Them)
(1) Data subjects or their legal representatives may request access to, correction or deletion of, suspension of processing of, and withdrawal of consent regarding their personal information processed by the Company.
(2) Requests under paragraph (1) may be made using the contact information in Article 10, and data subjects who have an account may view and edit their information directly within the Service. Upon receiving a request, the Company will take necessary action within the period prescribed by relevant laws and notify the data subject of the result.
(3) Requests under paragraph (1) regarding candidates' personal information processed on behalf of Customers (Article 1(3)) must be made to the Customer conducting the hiring, and the Company will take necessary action at the Customer's request.
(4) Requests under paragraph (1) regarding personal information that the Company processes as a personal information controller with the candidate's own consent (Article 1(4)) may be made directly to the Company in the manner guided by the Company or using the contact information in Article 10.
Article 8 (Operation of Devices That Automatically Collect Personal Information)
(1) The Company uses cookies to maintain login and interview sessions, save language settings, and analyze Service usage records.
(2) Data subjects may refuse the storage of cookies through their web browser settings. However, if they refuse, the use of some services, such as logging in and taking interviews, may be limited.
Article 9 (Measures to Ensure the Security of Personal Information)
(1) In accordance with Article 29 of the Personal Information Protection Act, the Company takes the following measures to ensure the security of personal information.
- Administrative measures: establishing and implementing an internal management plan, minimizing the number of personnel who handle personal information, and providing regular training
- Technical measures: managing access rights to personal information processing systems, storing important information such as passwords in encrypted form, encrypting data in transit, and implementing measures to block unauthorized external access
- Physical measures: servers that store personal information are located in data centers operated by cloud providers, and physical security, such as access control to those facilities, is performed by the cloud providers
Article 10 (Chief Privacy Officer and Department Handling Complaints)
(1) The Company has designated the following Chief Privacy Officer to take overall responsibility for personal information processing and to handle complaints and provide remedies to data subjects.
- Chief Privacy Officer: Younghoon Kang
- Department: Product Team
- Email: privacy@codeit.com
(2) Data subjects may contact the department in paragraph (1) regarding inquiries, complaints, and remedies related to personal information protection, including requests for access to personal information, and the Company will respond and handle them promptly.
(3) The exercise of rights and the handling of complaints regarding candidates' personal information are governed by Article 7.
Article 11 (Remedies for Infringement of Rights)
Data subjects may apply to the following organizations for dispute resolution or consultation to obtain remedies for infringement of personal information.
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office Cyber Investigation Division: 1301 (www.spo.go.kr)
- Korean National Police Agency Cyber Investigation Bureau: 182 (ecrm.cyber.go.kr)
Article 12 (Duty to Notify)
If there are any additions, deletions, or modifications to this Policy, the Company will give notice from 7 days before the effective date through means that data subjects can easily check, such as the Service screen. However, if there are material changes to the rights of data subjects, such as the collection and use of personal information or its provision to third parties, notice will be given from 30 days before the effective date.
Announcement Date: October 1, 2026
Effective Date: October 8, 2026