Introduction
Our privacy policy details our commitment to protecting personal information in line with global data protection standards, emphasising our role as a data processor.
At the core of our security measures, we employ AES-256 encryption—the same caliber used by banks worldwide. Notably, we leverage advanced technologies for processing, with stringent measures to redact personal and company-specific information before processing wherever that is practical. Voice notes are an exception, described in the Voice Notes section below.
Our partnerships with leading cloud service providers, AWS and Microsoft Azure, enhance our capabilities in securely handling and processing data at scale. We also use OpenAI, solely to transcribe voice notes. Data is stored locally in Sydney, Australia via AWS, ensuring compliance with local data protection regulations. Voice note recordings are processed outside Australia for transcription, as described in the Voice Notes section below.
Empathix Engineers are currently undertaking the new IAPP AI Governance Professional training certification. You can see more here: IAPP Certification.
Collection and Processing of Personal Information
Empathix temporarily processes personal information necessary for matching candidates with job opportunities. This information is obtained through third-party sources such as job boards and Applicant Tracking Systems (ATS).
Separately, we collect and store personal information from you if explicitly asked and authorised by you; this information is stored in our database similarly to how an ATS operates, with the added assurance that it is stored locally on AWS servers in Sydney, Australia. This local storage aligns with our commitment to adhere to Australian data protection laws and provides an additional layer of security.
Google User Data (OAuth)
Empathix offers optional Google integrations. You may choose to:
- Sign in with Google, and/or
- Connect Google Calendar (availability + scheduling), and/or
- Enable Gmail sending (sending interview emails on your behalf)
Each integration is optional and can be enabled or disabled at any time.
Data Accessed
Depending on what you connect, Empathix may access the following Google user data:
Google Sign-In
- Email address (Google userinfo.email)
- Basic profile information (such as name and profile photo, if provided)
Google Calendar
- Read-only calendar access (calendar.readonly): calendar events and availability information for scheduling
- Calendar event access (calendar.events): create and update interview events, including adding Google Meet links
Gmail
- Gmail sending permission (gmail.send): send emails on your behalf that you initiate or approve through Empathix
- Empathix does not request access to read your Gmail messages and does not access your inbox
How We Use Google User Data
Empathix uses Google user data only to provide the features you enable:
- Authentication: Create and authenticate your Empathix account using Google Sign-In
- Scheduling: Check calendar availability and schedule interviews
- Calendar Invites: Create or update calendar events and attach Google Meet links
- Email Sending: Send interview-related emails (e.g., invitations, confirmations, reschedules) from your Gmail account when you choose to use the email feature
We do not use Google user data for advertising, retargeting, marketing, or analytics unrelated to delivering the Empathix service.
Data Sharing
We do not sell or share Google user data with third parties for advertising purposes.
Google user data may be processed by approved infrastructure providers (sub-processors) solely to operate Empathix securely, including:
- AWS (Sydney, Australia) for hosting and storage
- Google APIs for Calendar and Gmail functionality
We do not provide employers or recruiters direct access to your Google account data. Calendar invites or emails are only sent when you enable these features and initiate/approve the action.
Data Storage & Protection
- OAuth tokens are encrypted and stored securely
- Data is stored in AWS infrastructure located in Sydney, Australia
- All data is protected using industry-standard encryption in transit (TLS) and encryption at rest
- Access is restricted to authorised systems and personnel following least-privilege principles
Data Retention & Deletion
- We retain Google user data only while your Empathix account is active and the integration is enabled
- You can disconnect Google integrations at any time via Settings → Integrations, which revokes access and deletes stored OAuth tokens
- To request full deletion of your Empathix account and associated data, email olivia@empathix.xyz
Purpose of Collection
The purpose behind collecting personal information is to efficiently match candidates with suitable job opportunities and to provide employers with valuable insights to support fair and unbiased hiring decisions. Our use of advanced technology, with redaction of identifiable information wherever that is practical, underscores our dedication to privacy and ethical data use.
Use of Personal Information
Empathix processes data within secure environments, ensuring the protection of personal information with bank-level encryption and robust security measures. Our AI is utilised for:
- Matching candidates with job opportunities
- Offering analytical insights into hiring practices to employers
Third-Party Sharing and Sub-processors
In our role as a data processor, we engage with third-party subprocessors, including AWS and Microsoft Azure for the temporary processing of data, and OpenAI solely for voice note transcription. Our use of technology involves ensuring that these subprocessors comply with our strict data protection and privacy standards, particularly regarding the redaction of personal and company-specific information before processing where that is practical.
International Transfers and Data Anonymisation
Empathix employs advanced technologies to process data in a manner that enhances our recruitment services. To uphold the highest standards of privacy and data protection, personal and identifiable information is redacted before AI processing wherever that is practical. Voice notes are the exception: a recording cannot be redacted before it is transcribed, so it is processed as recorded, as described in the Voice Notes section below.
Where data has been anonymised in this way, the data processed by Empathix and its technology partners, including any engagement with cloud-based AI services, does not constitute personal data in the context of international data protection regulations. Our commitment to this practice underscores our dedication to safeguarding privacy while leveraging the capabilities of global technological infrastructure to deliver our services.
Voice Notes
Recruiters and candidates can exchange short voice recordings through Empathix Connect. Each person records their own voice note knowingly, and a candidate agrees to the recording before making one. Recordings from both sides are transcribed. Recordings are stored on AWS servers in Sydney, Australia, alongside the rest of the conversation.
So that voice notes can also be read as text, each recording is transcribed by an AI transcription service, currently provided by OpenAI. The recording is sent as recorded, because it cannot be redacted before it is transcribed. OpenAI processes recordings in the United States and potentially other countries where it or its providers operate, so voice notes are transferred outside Australia for transcription. Under OpenAI's API terms, recordings are not used to train its models and may be retained for up to 30 days for abuse monitoring and then deleted, unless OpenAI is legally required to keep them longer.
The transcript is stored with the recording and is used only to show the voice note as text. It is visible to the people who can already open that conversation, the candidate and the recruiters who work on that job, and to authorised Empathix personnel where needed to operate or support the service.
Storage and Protection of Personal Information
Consistent with our role, Empathix stores personal information in a secure manner after processing, similar to an ATS, with stringent data protection measures, including data encryption and access controls, employed during the processing phase to safeguard information according to international standards.
Changes to the Privacy Policy
We are committed to transparently communicating any changes to this privacy policy, with updates available through our website.
Contact Information
For any privacy-related queries or concerns, please reach out to our CEO, Olivia, via the provided email address: olivia@empathix.xyz.