Privacy Policy

Noder Studio is a platform where companies build interviews and candidates take them online. The service is run by Noder Studio, Berlin, Germany ("we", "us").

This policy explains how we handle personal data on noder.studio and in the Noder Studio app. If anything here is unclear, write to us at privacy@noder.studio.

Three groups of people use Noder Studio, and our role is different for each:

• Company users: the recruiters and team members who build interviews and review results. For their account data we decide how it is used, so we are the controller.
• Candidates: the people who take an interview. The company that invited them decides why the interview happens and what it asks, so the company is the controller of the answers. We process them on the company's behalf, under a data processing agreement with that company.
• Members: candidates who create their own Noder Studio account to keep track of their sessions. For the account itself we are the controller.

Account details

• Your name, email address, role, and the organization you belong to.
• Your password, stored only in a protected (hashed) form. Nobody at Noder Studio can read it.
• Your profile picture, if you add one or sign in with Google or LinkedIn.

Interview answers

• What you write or choose: text, choices, rankings, code, and any other answer a question asks for.
• Voice and video recordings, only for questions that ask you to answer by voice or video.
• Files you upload, such as a CV.
• When you started and finished, and how long each question took.

Monitoring signals

Some interviews are monitored to keep them fair. In that case we show you the full list and ask you to agree before the interview starts. We record:

• Leaving the interview, for example switching tabs, windows, or apps.
• Copying and pasting.
• How you type, for example text arriving faster than a person types.
• Your mouse leaving the interview page.
• Your browser window and screens: size, zoom, position, and whether you have more than one screen.
• Panels opened next to the interview, such as developer tools, and signs of an automated browser.

We do not watch you through your camera, and we do not record your screen.

Browser and device details

Each time an interview is opened we save your IP address, time zone, language, browser, and operating system. This helps the company check that the interview was taken in a normal way, and helps us fix problems.

What the company adds

The company can add notes and scores to a session, and edit a score if they disagree with it.

We use personal data only for these purposes. Under the GDPR each one needs a legal reason, which we list next to it:

• To run your account and the service you asked for. Signing in, showing your sessions, and running an interview. Reason: the contract with you, or with the company you work for (Art. 6(1)(b) GDPR).
• To run interviews for a company. Showing questions, saving answers, scoring them, and showing the results to the company. Reason: we act on the company's instructions (Art. 28 GDPR). The company has its own legal reason for the interview.
• To monitor an interview, when the company turns it on. Reason: your agreement on the consent screen, and the company's interest in a fair process.
• To keep the service safe and working. Stopping abuse, finding bugs, and protecting accounts. Reason: our legitimate interest in a secure service (Art. 6(1)(f) GDPR).
• To send emails you need. Invitations, password resets, and account messages. We do not send marketing emails without asking first.

Noder Studio uses AI models from other companies (listed in the next section) to:

• Turn voice answers into text.
• Read questions aloud, when a company chooses a voice for its interview.
• Score answers against the criteria the company set, and write a short summary.
• Help company users write questions and build interviews.

AI does not make the hiring decision. Its scores are a starting point for people at the company, who can read every answer, change any score, and decide for themselves. If you think a score about you is wrong, you can ask the company to review it.

We send these providers only what the task needs, and we use them under terms that do not let them train their models on your data.

We never sell personal data. We share it only with:

• The company that invited you. It sees your answers, recordings, scores, and monitoring signals for its own interviews.
• People the company shares a result with. A company can create a link to one result, choose which parts it shows, and set when it expires.
• Service providers who help us run Noder Studio, and only for that:
  • Amazon Web Services: hosting, file storage, and email.
  • OpenAI, Anthropic, and Google (Gemini): AI scoring, summaries, and writing help.
  • OpenAI (Whisper) and Deepgram: turning voice into text.
  • ElevenLabs and OpenAI: reading questions aloud.
  • Google and LinkedIn: only if you choose to sign in with them.
• Authorities, only when the law makes us.

Some of these providers are based outside the European Union, mostly in the United States. When data leaves the EU, we rely on the protections the GDPR allows, such as the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

We use two cookies, and both only keep you signed in: access_token and refresh_token. They are needed for the service to work, so we don't ask for consent first.

Your browser also remembers a few display choices, like how a chart is shown. They stay on your device and are not sent to us. We use no advertising or tracking cookies.

• Account details: for as long as your account is open. When you delete your account, we delete them.
• Interview data: for as long as the company keeps the session. A company can delete a session at any time, and when it does, its answers and recordings are deleted too.
• Logs and backups: for a short time, to keep the service safe, and then deleted.

Under the GDPR you can ask to:

• See the personal data we hold about you, and get a copy.
• Correct data that is wrong.
• Delete your data.
• Limit how we use it, or object to a use.
• Take back your agreement, where we asked for it. This does not undo what happened before.

If you are a member, you can change your details and delete your account yourself in your settings. For anything else, write to privacy@noder.studio. We answer within one month.

If you took an interview for a company, that company decides about your answers. You can ask the company directly, or ask us and we will pass your request on and help them answer.

You can also complain to a data protection authority. Ours is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

All traffic is encrypted with HTTPS. Sign-in cookies can't be read by scripts on the page, and the sign-in token is short-lived and renewed while you use the app. Each company sees only its own data, and inside a company, access follows each person's role.

No system is perfectly safe. If a breach puts your data at risk, we will tell you and the authority as the law requires.

Noder Studio is not meant for anyone under 16. If you think a child has given us personal data, write to us and we will delete it.

When we change this policy, we update the date at the top of the page. If a change matters for how we use your data, we will also tell you by email or in the app before it takes effect.

Noder Studio, Berlin, Germany
Email: privacy@noder.studio