1Who we are and what this policy covers
evoaxi builds and operates EVO People Finder, a recruiting tool used by companies and search firms to find, assess and guide candidates.
This policy explains what personal data we process, why, who we share it with, and how you exercise your rights. It applies to our websites and to the product.
One clarification about roles matters. When a client company uses EVO to recruit, it decides who to look for, what to assess and who to hire. In that relationship the client is the controller of candidate data and evoaxi is the processor, handling the data on the client’s instructions. For the client’s own account data and for visitors to our websites, evoaxi is the controller.
2Data we process
We separate it by type of person, because the answers differ.
- Website visitor
- If you only browse evoaxi.com or evopf.com, we process basic technical access data such as network address, browser type and pages visited, to keep the site running and understand what draws interest. If you write to us, we process whatever you send in the message.
- Product user
- Anyone using EVO has a name, email and photo coming from the account used to sign in, plus a record of what they do in the system: roles created, screening decisions, approved messages, settings. We also store the link to the organization and the roles assigned.
- Candidate
- Professional data from public profiles, such as name, title, company, education and career path; a résumé, when submitted; answers to tests, interviews and questionnaires, where applicable; and the assessments the hiring company records. Audio may be recorded when a candidate takes a language test or defends their work live, always with notice on the screen beforehand.
- Role requester and external interviewer
- Name, email and the answers the person gives through the link they received. Those accesses are token-based, time-limited, and do not create an account in the system.
3Where candidate data comes from
From three places, and the first one deserves a careful explanation.
The first is LinkedIn. EVO does not reach LinkedIn from our servers and does not store any of the recruiter’s access credentials. What browses is an application installed on the recruiter’s own machine, using the browser and the session they already opened. The data that reaches the system is what is visible to that recruiter, under their own account, as if they had opened the profile by hand.
The second is the candidate, when they apply to a role, send a résumé or take a test.
The third is the client, when they add someone by referral or import information they already had.
4What we use it for
To provide the service: analyzing fit between candidate and role, organizing the process, drafting messages and descriptions, running and grading tests, scheduling and recording interviews.
To improve the service, using aggregate data and the decisions each client records. That learning stays confined to the organization that produced it. What one client teaches the system is not used for another client.
For security and accountability, keeping records of who did what in the system.
For operational communication, such as invitation notices, process results and relevant changes to the service.
5Legal bases
We process candidate data on the legitimate interest of the recruiting party in assessing professionals for an opportunity, which is the expected purpose for someone who maintains a public professional profile. When a candidate interacts with us actively, such as by applying or taking a test, the processing rests on preliminary procedures related to a contract.
For sensitive data, such as voice recordings in a language test or answers to a behavioral questionnaire, we ask for specific and highlighted consent, and the candidate may decline without that alone removing them from the process.
Data about users and clients is processed to perform the contract and to comply with legal obligations.
6Automated decision-making
This is the part that matters most to anyone being assessed, and our position is firm: no score, rating or analysis generated by the system eliminates a candidate on its own.
Test results, behavioral profiles and fit analyses are information presented to a person, who decides. Human review is mandatory by the way the product is built, and every adjustment that person makes is recorded with author, date and previous value.
Every assessment the system produces states what it was based on. A candidate may request review of decisions supported by the system, under article 20 of the LGPD (Brazil’s general data protection law), and that request should be directed to the company running the selection process, which is the party that decides.
7Who we share it with
We do not sell personal data, we do not hand it to advertising, and we do not assemble a profile database to resell. We share only with whoever is needed for the service to work.
- Google Cloud Platform
- Application hosting, database and file storage.
- Anthropic
- Text processing by the language models that generate analyses, descriptions and messages. Content sent through the API is not used to train models.
- Google Cloud (Vertex AI)
- Audio transcription and assessment in language tests, where applicable.
- Resend
- Sending transactional email, such as invitations and notifications.
- hCaptcha
- Protection against automated submission on public forms.
- Authorities
- Where there is a legal obligation or a court order, in which case we notify the client whenever the law allows.
8International transfer
Our infrastructure is in the United States, and some of the providers above operate outside Brazil. This means personal data may be transferred and processed abroad.
Those transfers are made with contractual safeguards in place with the providers, and always limited to what the service requires. If the location of the infrastructure changes, this policy will be updated.
9How long we keep it
Candidate data stays available for as long as the client keeps the account active, because the history of assessments is precisely what lets the work be reused on future roles. The client can delete a candidate from the base at any time.
Audit records are kept for periods set according to how critical the event is, with automatic purging afterwards.
Once the contract ends, the client has a window to export the data, after which it is deleted from our systems, except for what the law requires us to keep.
10Security
Each organization’s data is separated at the database layer, not by a filter on the screen. An attempt to reach another organization’s data comes back as non-existent, without revealing that it exists. This separation is verified automatically on every change to the system, by a suite of tests that runs against a real database.
Access is controlled by roles with specific permissions. Every relevant change, security event and read of sensitive data is recorded.
No LinkedIn credential is typed, transmitted or stored by us. The token that authorizes the application installed on the recruiter’s machine is stored irreversibly and can be revoked at any time.
No security is absolute. If an incident occurs that could create relevant risk, we notify the affected clients and the competent authority within the applicable deadlines.
11Your rights
The LGPD gives you the right to confirm whether we process your data, access it, correct what is wrong, request anonymization or deletion of what is unnecessary, request portability, withdraw consent and object to processing you consider improper.
To exercise any of them, write to contato@evoaxi.com. We respond within fifteen days.
If you are a candidate and were assessed by a company that uses EVO, we will forward your request to them when the decision is theirs, and we will do whatever is within our reach right away.
12Cookies
On our websites we use only what is needed for them to work and, where there is audience measurement, tools that do not build an advertising profile of the visitor.
In the product, we use cookies to keep your session signed in and remember the active organization. Without them the system does not work.
13Children and adolescents
EVO is a professional tool, intended for people over eighteen. We do not knowingly collect data about children. If we identify any, we delete it.
14Changes to this policy
When we change something relevant, we update the date at the top and notify clients by email. Changes that expand data processing take effect only after the notice.
15Contact
Questions, requests and exercise of rights: contato@evoaxi.com.
That same channel serves as the data protection officer contact.