Privacy Policy

1. Introduction

Kyvora Technologies LLC (“Company,” “Kyvora,” “we,” “us,” or “our”) operates an AI-powered recruiting coordination platform (“Platform”). This Privacy Policy explains how we collect, use, disclose, and protect information about you when you use our Platform, including as an organizational customer (“Customer”) or as a candidate whose information is processed by a Customer through our Platform (“Candidate”).

By using the Platform, you acknowledge the collection and use of information as described in this Policy.

For Candidates, Kyvora generally processes personal information on behalf of and at the direction of the recruiting organization, staffing agency, or other Customer that initiated the outreach. Customers generally determine the purposes for which Candidate personal information is processed and are responsible for their own obligations relating to that information under applicable law.

2. Information We Collect

2.1 Information Customers Provide

We may collect information provided by Customers and their authorized users, including:

Account registration information, such as name, email address, and organization name
Billing and subscription information; payment card information is processed by our payment provider, and Kyvora does not store complete payment card numbers
Candidate contact data uploaded or otherwise provided by Customers, such as name, phone number, email address, and professional details
Job descriptions, screening criteria, and screening question content
AI coordinator configuration and settings

2.2 Information Generated Through Platform Use

We may collect or generate information through use of the Platform, including:

Conversation transcripts between Candidates and AI coordinators
AI-generated Candidate scores, summaries, and assessments
Platform usage logs, audit trails, and activity records
Device and browser information, such as IP address and user agent
Information relating to campaign activity, message delivery, responses, opt-outs, and other Platform interactions

Kyvora may support Candidate communications through SMS, email, or other communication channels made available through the Platform from time to time. The availability of particular channels may vary by feature, Customer, plan, configuration, or stage of Platform development. References in this Policy to a particular channel describe how information is processed when that channel is enabled, and do not indicate that the channel is available to all Customers.

2.3 Candidate Information

Candidates may interact with the Platform through recruiting outreach initiated by Customers. Candidate responses to screening questions and other messages are captured and processed through the Platform.

Candidate information may be obtained from the Customer that initiated the recruiting activity, directly from the Candidate through communications with the Platform, or generated through the Candidate's interaction with the Platform.

Candidates who wish to exercise applicable privacy rights may contact us at privacy@kyvoratech.com. Because Kyvora generally processes Candidate information on behalf of a Customer, we may refer a Candidate to the recruiting organization, staffing agency, or other Customer responsible for the relevant information and will assist Customers with privacy requests as required by applicable law.

Candidates may opt out of SMS communications at any time by replying STOP.

2.4 Sources of Personal Information

Depending on how you interact with Kyvora, we may receive personal information:

Directly from Customers and their authorized users
From Customers about Candidates they are recruiting or considering for employment opportunities
Directly from Candidates through SMS or other communications with the Platform
Automatically through use of Kyvora's website or Platform, such as device, browser, IP address, and usage information
From service providers that support operation, security, billing, communications, and administration of the Platform

2.5 Sensitive Personal Information

Kyvora does not generally require Candidates to provide sensitive personal information unless such information is requested by a Customer for a lawful recruiting or employment-related purpose.

Because Customers may configure screening questions and Candidates may communicate through free-text responses, Customers or Candidates may nevertheless provide information that qualifies as sensitive personal information under applicable law. Kyvora processes such information as necessary to provide the Platform and generally on behalf of the applicable Customer.

Kyvora does not use Candidate sensitive personal information for Kyvora's own advertising or marketing purposes.

3. How We Use Information

We use personal information as reasonably necessary to:

Provide, operate, maintain, secure, and improve the Platform and its features
Process Candidate screening conversations on behalf of Customers
Generate AI-assisted Candidate scores, summaries, and assessments
Facilitate recruiting coordination and related Platform functionality
Send transactional notifications, such as notifications that screening criteria have been met or screening is complete
Support messaging compliance, including processing and honoring applicable opt-out requests
Detect and prevent fraud, abuse, unauthorized access, and security incidents
Maintain audit logs for security, legal, and compliance purposes
Provide customer support and troubleshoot technical issues
Administer subscriptions, billing, and credits
Comply with applicable legal obligations and enforce our agreements

We do not sell personal information.

We do not share personal information for cross-context behavioral advertising.

We do not use Candidate data for Kyvora's own advertising or marketing purposes.

4. Data Sharing and Third Parties

We disclose information to service providers and other parties only as reasonably necessary to operate the Platform, fulfill Customer requests, protect Kyvora and its users, or comply with law.

Our key service providers include:

Vercel: Application hosting and serverless-compute provider. Vercel runs every page, API route, webhook handler, and scheduled job that makes up the Platform, so Candidate/Customer data carried in an ordinary request (including inbound SMS webhooks and dashboard page loads) transits Vercel's compute as part of being processed. Vercel is not the system of record for this data — Supabase is (see below).
Twilio Inc.: SMS delivery provider. Candidate phone numbers and message content are transmitted to Twilio to send and receive SMS messages.
Anthropic PBC: AI model provider. Conversation transcripts, Candidate responses, job context, and related screening information may be transmitted to Anthropic's Claude API to generate AI-assisted messages, summaries, and Candidate scores. Anthropic processes this information subject to applicable contractual and technical safeguards. Kyvora does not permit its AI providers to use Customer or Candidate data to train public models where Kyvora's agreements or provider settings allow Kyvora to restrict such use.
Resend: Email delivery provider. When email functionality is enabled or used through the Platform, Candidate email addresses, message content, and related delivery information may be transmitted to Resend to send and manage email communications.
Supabase: Database and infrastructure provider. Platform data is stored within Supabase's infrastructure subject to applicable data-processing terms and safeguards.
Stripe: Payment processor. Billing information and subscription data are transmitted to Stripe to process payments. Kyvora does not store complete payment card numbers.
PostHog: Product analytics provider. PostHog is used across the Kyvora website and product, including before signup, for activities such as public-page views and submissions of certain forms, as well as within the authenticated dashboard used by signed-in Customer and staff users. For signed-in users, PostHog receives Kyvora account ID, organization ID, role, and product-usage events, but not the user's name or email address. For visitors who have not signed in, PostHog receives standard page-view information and, when applicable, information submitted through certain website forms together with associated technical information such as IP address. Candidates who interact with Kyvora through recruiting messages are not identified to PostHog through those Candidate interactions. Kyvora does not use PostHog session recording or automatic click/text capture. Analytics collection can be managed through Kyvora's cookie-preferences mechanism. See our Cookie Policy for additional information.
Sentry: Error tracking and application-monitoring provider. Sentry may receive application error details, stack traces, and operational context, including internal organization, user, conversation, campaign, or contact identifiers, to help Kyvora diagnose and resolve technical issues. Kyvora does not intentionally send request bodies or user profile information to Sentry, and PII patterns such as email addresses and phone numbers are redacted before transmission where technically feasible.
Upstash: Rate-limiting and abuse-prevention provider. Upstash may receive IP addresses and, for certain rate limits, email addresses used as short-lived counters to detect excessive request volume. Kyvora does not use Upstash to store Candidate conversation content, screening data, or account records.
Cloudflare (Turnstile): Bot/abuse-screening provider used only on organization sign-up. Cloudflare may receive a visitor's IP address and standard browser/device signals inherent to completing a Turnstile challenge. Not used anywhere Candidates interact with Kyvora.
Google: Calendar-integration provider (Google Calendar API), used only when a Customer's recruiter chooses to connect their own Google Calendar for native interview scheduling. Google may receive a Candidate's first name and email address on calendar events Kyvora creates, and the connecting recruiter's own calendar free/busy time blocks. Kyvora does not read the details of a recruiter's existing calendar events.

We may also disclose personal information:

To professional advisers and service providers where reasonably necessary to operate, secure, support, or administer Kyvora
When required by law, subpoena, court order, or governmental authority
When reasonably necessary to protect the rights, safety, security, or integrity of Kyvora, our Customers, Candidates, service providers, or others
In connection with a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar business transaction, subject to appropriate confidentiality and legal protections

We do not share mobile phone numbers, SMS opt-in data, or messaging consent records with third parties for their own marketing or advertising purposes.

5. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including to provide the Platform, comply with legal obligations, resolve disputes, maintain security, prevent fraud and abuse, and enforce our agreements.

We will process account-data deletion within 90 days of a verified account-closure request submitted to support@kyvoratech.com.

Candidate conversation data is deleted upon a Customer's written deletion request unless retention is required or permitted by law or necessary for applicable compliance, security, dispute-resolution, or legal purposes.

Audit logs are retained for 7 years for legal and compliance purposes.

Opt-out records, including STOP history and suppression records, may be retained indefinitely as necessary to honor and document opt-out requests.

Customers may request deletion of other data by contacting support@kyvoratech.com.

We may retain information longer where required or permitted by law or reasonably necessary to maintain suppression lists, resolve disputes, enforce agreements, prevent fraud or abuse, comply with legal obligations, or maintain security and audit records.

6. Your Privacy Rights

Depending on your location and applicable law, you may have rights concerning your personal information, including:

The right to request access to personal information about you
The right to request correction of inaccurate personal information
The right to request deletion of personal information, subject to applicable exceptions
The right to opt out of the sale or sharing of personal information where applicable
The right to exercise applicable privacy rights without unlawful discrimination
The right to opt out of SMS communications by replying STOP at any time

To exercise applicable privacy rights, contact us at privacy@kyvoratech.com.

We may take reasonable steps to verify your identity before completing a request.

Because Kyvora generally processes Candidate information on behalf of a Customer, we may refer a Candidate to the recruiting organization, staffing agency, or other Customer responsible for the relevant information and will assist Customers with responding to privacy requests as required by applicable law.

7. Security

We implement commercially reasonable administrative, technical, and organizational safeguards designed to protect personal information.

These safeguards include measures such as encryption in transit, encryption at rest, database access controls, audit logging, access restrictions, and regular security reviews.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If a security incident involving personal information triggers notification obligations, Kyvora will notify affected Customers, individuals, and/or regulatory authorities as required by applicable law.

8. International Data Transfers

Kyvora is based in the United States. Information we process may be transferred to, stored in, or accessed from the United States and other countries where Kyvora or our service providers operate.

These countries may have privacy laws that differ from those in your jurisdiction.

Where required by applicable law, we use appropriate safeguards for international transfers of personal information.

9. Legal Bases for Processing

Where GDPR, UK GDPR, or similar laws apply, Kyvora's legal bases for processing personal information may include:

Performance of a contract
Legitimate interests
Consent
Compliance with legal obligations

Where Kyvora processes Candidate information on behalf of a Customer, the Customer is generally responsible for establishing the applicable lawful basis for its recruiting and employment-related processing.

10. Business Transfers

If Kyvora is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, personal information may be disclosed or transferred as part of that transaction, subject to applicable confidentiality obligations and legal protections.

11. Subprocessors and Service Providers

Kyvora uses third-party service providers to help operate, secure, support, and administer the Platform.

These providers may process personal information only as necessary to provide their services to Kyvora or as otherwise permitted by applicable agreements and law, and are subject to contractual obligations designed to protect personal information.

Key providers are identified in Section 4.

12. Age Restrictions

Platform accounts are intended for use by individuals who are at least 18 years of age. Kyvora does not knowingly permit individuals under 18 to create or use a Customer or staff Platform account.

If we learn that a Platform account has been created or used by someone under 18 in circumstances where this is not permitted, we will take appropriate steps to address it.

If you believe an individual under 18 has created or used a Customer or staff account on the Platform, contact privacy@kyvoratech.com.

13. California Privacy Rights

To the extent applicable, California residents may have rights under California privacy law, including:

Right to Know: You may request information about the categories and specific pieces of personal information collected about you, the categories of sources from which it was collected, the purposes for which it is used, and the categories of third parties to which it is disclosed.
Right to Delete: You may request deletion of personal information about you, subject to applicable exceptions.
Right to Correct: You may request correction of inaccurate personal information maintained about you.
Right to Opt Out of Sale or Sharing: Kyvora does not sell personal information and does not share personal information for cross-context behavioral advertising.
Right to Non-Discrimination: Kyvora will not unlawfully discriminate against you for exercising applicable California privacy rights.

SMS Data: Kyvora does not share mobile phone numbers, SMS opt-in data, or messaging consent records with third parties for their own marketing or advertising purposes. SMS opt-in and messaging information is used to facilitate recruiting communications initiated by Customers, operate the Platform, honor opt-outs, and comply with applicable requirements.

To exercise applicable California privacy rights, contact privacy@kyvoratech.com. We will respond to verified requests within the time required by applicable law. Where the CCPA applies, this is generally within 45 days, subject to permitted extensions.

Because Kyvora generally processes Candidate information on behalf of Customers, certain requests concerning Candidate information may need to be directed to or handled in coordination with the Customer responsible for that information.

14. Do Not Track and Analytics Preferences

Some browsers offer a “Do Not Track” (“DNT”) setting. There is no universally accepted standard governing how websites should respond to DNT signals, and Kyvora does not currently change its behavior in response to browser DNT signals.

Kyvora does not use advertising cookies and does not use personal information for cross-site behavioral advertising.

Kyvora uses PostHog for its own website and product analytics as described in this Policy and our Cookie Policy.

You can manage analytics collection through Kyvora's cookie-preferences mechanism.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to the Platform, our practices, legal requirements, or other operational needs.

When we update this Policy, we will revise the “Last updated” date at the top of the Policy.

Where required by applicable law, we will provide additional notice of material changes.

16. Contact

For privacy-related inquiries or applicable privacy-rights requests:
privacy@kyvoratech.com

For general support:
support@kyvoratech.com

Kyvora Technologies LLC
San Francisco, CA 94114
United States