Privacy Policy
Last updated: 21 March 2026
1. Information We Collect
We collect information in the following categories:
Account Information
When you create an account, we collect your email address, display name, and a hashed version of your password. Passwords are stored using industry-standard one-way hashing and are never stored in plain text.
Candidate Data
When CVs are uploaded to the platform, we extract and store structured information including:
- Personal details (name, email address, phone number)
- Employment history (job titles, employers, dates, responsibilities)
- Educational qualifications
- Skills and competencies
- Professional certifications
Interview Data
During voice interviews, we collect audio data which is processed in real time to generate text transcriptions. Interview transcripts and AI-generated assessment summaries are stored against the relevant session.
Usage Data
We collect basic usage data including login timestamps, actions performed within the platform, and audit logs of scoring runs and configuration changes.
2. How We Use Your Information
We use collected information to:
- Provide and operate the recruitment platform
- Parse and score CVs against configured rubrics
- Conduct and transcribe voice interviews
- Generate AI-powered assessment summaries
- Maintain audit trails of scoring decisions and configuration changes
- Administer user accounts and access permissions
- Improve the Service through aggregated, anonymised analytics
3. Data Storage and Security
All data is stored in a PostgreSQL database hosted on infrastructure controlled by the Service operator. We implement appropriate technical and organisational measures to protect personal data, including:
- Password hashing using Werkzeug security utilities
- Session-based authentication with secure cookies
- Role-based access controls (admin and standard user roles)
- Audit logging of significant platform actions
4. Third-Party Services
The Service uses the following third-party providers to deliver its functionality:
OpenAI
We use OpenAI's APIs for the following purposes:
- Realtime API — Powers voice interviews via WebRTC. Audio is processed by OpenAI in real time and is not stored by OpenAI after the session ends (per OpenAI's API data usage policy).
- Whisper — Provides speech-to-text transcription during interviews.
- GPT-4o — Generates interview assessment summaries, parses CV documents into structured data, and generates rubrics from job descriptions.
Data sent to OpenAI via the API is processed in accordance with OpenAI's API data usage policies and is not used to train OpenAI's models.
5. Legal Basis for Processing
We process personal data under the UK General Data Protection Regulation (UK GDPR) and, where applicable, the EU General Data Protection Regulation (EU GDPR). Our legal bases for processing are:
- Contract — Processing account data is necessary to provide the Service you have signed up for
- Legitimate interests — Processing usage data and audit logs to maintain platform security, prevent misuse, and improve the Service
- Consent — Where you explicitly consent to AI processing of CVs or participation in AI-conducted interviews (consent checkboxes are presented before each action)
Organisations using Sift CV to process candidate data act as data controllers and are responsible for ensuring they have a lawful basis (typically legitimate interests for recruitment, or consent) for processing candidate personal data.
6. CV Data Processing
CV documents uploaded to the platform are processed as follows:
- The document (PDF or DOCX) is parsed locally to extract raw text
- The text is sent to OpenAI's API to extract structured fields (personal details, experience, qualifications, skills)
- Structured data is stored in the database for scoring and display
- Original uploaded files are stored in the application's file system
As the data controller, you are responsible for ensuring you have a lawful basis for processing candidate CVs, and for informing candidates that their data will be processed using AI tools.
7. Cookies and Analytics
The Service uses essential cookies required for the platform to function and lightweight, privacy-respecting analytics. We do not use any third-party tracking or advertising cookies.
| Cookie / Technology | Purpose | Type | Duration |
|---|---|---|---|
session |
Maintains your authenticated login session | Essential | Browser session (cleared on close) |
csrf_token |
Protects against cross-site request forgery attacks | Essential | Browser session |
| RegenInsite Analytics | Collects anonymous page view data (pages visited, referrer, device type) to help us improve the Service. No personal data is collected or shared with third parties. | Analytics (legitimate interest) | Session only |
We also use localStorage (not a cookie) to remember your cookie banner dismissal preference. This data never leaves your browser.
8. Data Retention
Account data, candidate records, interview transcripts, and scoring results are retained for as long as your account is active. Upon account deletion, your personal data will be removed. Candidate data associated with your organisation's jobs and scoring runs may be retained by other administrators in your organisation.
You may request deletion of specific candidate records at any time through the platform interface or by contacting us directly.
9. Your Rights
Under the UK GDPR and EU GDPR, you have the following rights in relation to your personal data:
- Access — Request a copy of the personal data we hold about you
- Rectification — Request correction of inaccurate personal data
- Erasure — Request deletion of your personal data ("right to be forgotten")
- Restriction — Request restriction of processing of your personal data
- Portability — Request transfer of your data in a structured, machine-readable format
- Object — Object to processing of your personal data in certain circumstances
- Withdraw consent — Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing
To exercise any of these rights, contact us at bryan@ai-regenesis.com. We will respond within 30 days.
10. Complaints
If you are unsatisfied with how we handle your personal data, you have the right to lodge a complaint with the relevant supervisory authority:
- UK: Information Commissioner's Office (ICO) — ico.org.uk/make-a-complaint
- EU: Your local Data Protection Authority
We would appreciate the opportunity to address your concerns before you contact a supervisory authority, so please reach out to us first.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the Service after changes constitutes acceptance of the revised policy.
12. Contact
For questions about this Privacy Policy or our data practices, contact:
AI-Regenesis Ltd
Email: bryan@ai-regenesis.com