Skip to main content
← Back to Yojivo

Privacy Policy

Last updated: September 23, 2026 · Version 1.3

1. Who We Are

Yojivo ("we", "us", "our") is a B2B SaaS platform that helps consulting firms manage their workspaces, hiring, projects, and team operations. This policy explains how we collect, use, and protect your personal data in accordance with the EU General Data Protection Regulation (GDPR), the Australian Privacy Act 1988 (including the Australian Privacy Principles), and other applicable data protection laws.

2. Data We Collect

We collect the following categories of personal data:

  • Account data: Name, email address, phone number, job title, department, bio, timezone, avatar photo
  • Company data: Company name, billing information
  • Usage data: Activity logs, IP addresses, browser user-agent strings
  • Hiring data (if applicable): Candidate names, emails, phone numbers, resumes, interview transcripts, AI-generated scores and evaluations
  • Communication data: Discussion posts, comments, notifications
  • AI interaction data: Chat session content processed by AI assistants

3. How We Use Your Data

We process your personal data for the following purposes:

  • Service delivery: Providing and maintaining the Yojivo platform
  • Authentication: Verifying your identity and managing access
  • Communication: Sending service-related emails (verification, invitations, notifications)
  • AI processing: Resume analysis, candidate scoring, voice interview evaluation (with your organization's consent)
  • Security: Detecting fraud, preventing abuse, maintaining audit logs
  • Improvement: Analyzing aggregated, anonymized usage patterns to improve the platform

4. Legal Basis for Processing

  • Contract performance: Processing necessary to deliver our services (GDPR Art. 6(1)(b))
  • Legitimate interests: Security, fraud prevention, service improvement (GDPR Art. 6(1)(f))
  • Consent: Marketing communications, optional analytics (GDPR Art. 6(1)(a))
  • Legal obligation: Tax and financial record-keeping (GDPR Art. 6(1)(c))
  • Explicit consent: Processing of special category data (diversity demographic information) for equal opportunity monitoring (GDPR Art. 9(2)(a))

5. Automated Decisions and AI

Some decisions in Yojivo are made, or largely shaped, by computer programs, including AI. This section explains which ones, as required by Australian Privacy Principles 1.7 and 1.8 and GDPR Articles 13, 14 and 22. It covers two services:

  • Hiring for our customers: a company using Yojivo to hire you. That company decides how these features are set up for its roles, and it makes the hiring decision.
  • Yojivo Interviews for individuals: a structured interview you book and pay for yourself. Here Yojivo sets the rules.

5.1 Personal information these programs use

  • Hiring for our customers: your name and contact details, current employer, years of experience, expected salary, notice period, cover note, resume, answers to screening questions, the job description, and the recording and transcript of any AI voice interview.
  • Yojivo Interviews for individuals: the job description and resume you upload, the recording and transcript of your interview, how and when your call ended, your past attempts for the same job, and your payment and email verification status.
  • Account security: sign-in attempts, IP address, and the number of requests made from your account or device.

5.2 Decisions made by a program alone

These decisions happen without a person reviewing them first.

Yojivo Interviews for individuals

  • Whether your attempt meets the benchmark. AI rates your answers for each competency. A fixed rule then compares those ratings with the published benchmark for the rubric version shown before you book.
  • Whether a Yojivo Interview Record is issued. A record is issued only when the benchmark is met.
  • Whether a paid interview is given back. If a call ends early because of a technical fault, or you do not start it within 7 days, the interview is credited back automatically. If it is not clear why a call ended, a person reviews it before anything is decided.
  • Whether you can book another attempt. Up to 3 completed attempts per job, at least 7 days between attempts, and one open booking at a time.

Hiring for our customers (set up by the hiring company, which can change or turn these off for each role)

  • Whether you are invited to an AI voice interview. By default, applicants whose AI resume score is 60 or more are invited automatically. Applicants below that score are not rejected. They stay in the process for the hiring team to review.
  • Whether an interview invitation expires. An invitation that is not booked within the scheduling window (48 hours by default) expires.

Account security

  • Sign-in is paused for 15 minutes after 5 failed attempts, requests above our rate limits are blocked, and privacy requests need a 6-digit code sent to your email.

5.3 Decisions where a program helps and a person decides

In hiring for our customers, programs produce information that the hiring team uses:

  • An AI resume score from 0 to 100, with reasons.
  • After an AI voice interview, an AI evaluation of each area assessed, an overall rating, and a recommended result (pass, hold or fail) saved on the interview record. Your overall AI score is then updated using both the resume and the interview.
  • A pass or fail result for screening questions that have a pass mark.

No program rejects you, moves you to a different hiring stage, or sends you a rejection. A person on the hiring team does that. The hiring company is responsible for its hiring decisions, and its own privacy policy also applies.

5.4 Your choices and rights

  • When you apply for a job, you are asked to consent to AI screening and AI interviews. You can ask the hiring company for a review by a person instead.
  • For Yojivo Interviews, the benchmark is shown before you pay, and your report shows each competency's rating against the threshold it needed.
  • You can ask for a person to review any decision in section 5.2 that affects you, give your point of view, and contest it. Email hello@yojivo.com.
  • Under GDPR Article 22, you have the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on you, except where the law allows it with safeguards such as the review described above.

6. Data Sharing & Third Parties

We share personal data with the following categories of third-party processors:

  • AI providers: For resume analysis, candidate evaluation, and voice interview processing
  • Voice interview providers: For conducting and recording AI-powered voice interviews
  • Payment processors: For billing and payment processing
  • Cloud infrastructure providers: For hosting, storage, and delivery of uploaded files
  • CRM integrations (optional): For syncing candidate data with your existing tools

We require Data Processing Agreements (DPAs) with our sub-processors and implement appropriate safeguards for international data transfers. For details about our sub-processors, DPA arrangements, or to request a copy of our Data Processing Agreement, please contact us at hello@yojivo.com.

Your personal data may be transferred to and processed in countries outside of your country of residence, including the United States and Australia. Where we transfer data outside the European Economic Area, we implement Standard Contractual Clauses (SCCs) approved by the European Commission and other appropriate safeguards. Under Australian Privacy Principle 8, we take reasonable steps to ensure overseas recipients handle your data consistently with the Australian Privacy Principles.

7. Data Retention

  • Activity logs: Automatically purged after 90 days
  • Audit logs: Automatically purged after 365 days
  • AI chat sessions: Automatically purged after 90 days
  • Voice recordings: Recording URLs cleared after 90 days
  • Yojivo Interviews for individuals: Interview recordings and transcripts deleted 365 days after the interview
  • Rejected candidate data: Anonymized after 180 days
  • Account data: Retained while your account is active; anonymized upon deletion

8. Your Rights

Under GDPR, you have the following rights:

  • Access (Art. 15): Request a copy of your personal data
  • Rectification (Art. 16): Correct inaccurate personal data via your profile settings
  • Erasure (Art. 17): Delete your account and personal data
  • Portability (Art. 20): Export your data in machine-readable format (JSON)
  • Objection (Art. 21): Object to processing based on legitimate interests
  • Withdraw consent (Art. 7): Withdraw marketing consent at any time

You can exercise your right to data export and account deletion directly from your account Settings page. For other requests, contact our Data Protection Contact.

Australian Privacy Principles

If you are located in Australia, you also have rights under the Australian Privacy Principles (APPs), including the right to access your personal information (APP 12) and request correction of inaccurate information (APP 13).

9. Security

We implement appropriate technical and organizational measures including:

  • TLS/SSL encryption for all data in transit
  • Argon2 password hashing
  • JWT token rotation with 15-minute access token lifetime
  • Brute-force protection (account lockout after 5 failed attempts)
  • Rate limiting on all API endpoints
  • Encrypted storage of integration credentials

10. Contact

For privacy-related inquiries or to exercise your data rights, contact our Data Protection Contact:

Email: hello@yojivo.com

If you are not satisfied with our response, you have the right to lodge a complaint with:

  • Your local EU/EEA data protection supervisory authority
  • The Office of the Australian Information Commissioner (OAIC) at oaic.gov.au

11. Special Category Data

Where our hiring features include voluntary demographic surveys for diversity monitoring, we collect special category data (such as gender, ethnicity, disability status, and Indigenous status) only with your explicit consent under GDPR Article 9(2)(a). This data is:

  • Entirely voluntary — declining has no effect on your application
  • Stored separately from your application, linked only by a one-way hash
  • Never visible to individual hiring managers
  • Used only in aggregate form, with groups smaller than 5 suppressed
  • Subject to a defined retention period and automatic deletion

For candidates identifying as Aboriginal or Torres Strait Islander, we acknowledge the cultural significance of this data and handle it with care, guided by the principles of the AIATSIS Code of Ethics for Aboriginal and Torres Strait Islander Research.