Meritclaw Privacy Policy

This Policy applies to Meritclaw (“Meritclaw” or “MW”), an AI-powered hiring integrity platform by Verificient Technologies Inc. (“Verificient”, “Company”, “we”, “us”, or “our”). Meritclaw is designed to support hiring organizations in evaluating resume’s authenticity and candidate’s identity, skills, assessment performance, and integrity across the hiring lifecycle, including resume screening, skills assessments, live interviews, and certain internal corporate training verification workflows.

Meritclaw generates decision-support signals and assessment scores to assist human reviewers in making better-informed hiring or training decisions. Meritclaw does not make automated hiring decisions, perform emotion or affect recognition, or infer protected characteristics such as race, ethnicity, gender, health status, political affiliation, religion, or similar sensitive characteristics. Final employment, hiring, promotion, certification, or training decisions are always made by human reviewers.

This Policy outlines how Verificient collects, uses, stores, processes, and discloses Personal Information in connection with Meritclaw and its related services (“Services”).

Unless your Client organization or hiring organization (“Data Controller”) has provided separate terms in writing, this Policy applies to your use of the Services.

Definitions

Client Organization / Data Controller – Organization, employer, staffing agency, recruiter, enterprise customer, or institution using Meritclaw to support hiring, assessment, interview integrity, or internal training verification workflows. The Client Organization determines the categories of data collected and the configuration of monitoring requirements.

Data Processor / Service Provider – Verificient and Meritclaw act as a processor or service provider on behalf of the Client Organization. Processing activities may include identity verification, assessment integrity monitoring, interview integrity monitoring, fraud prevention, assessment delivery, reporting, AI-assisted evaluation, and secure storage of session-related information.

Services We Provide

Meritclaw provides hiring integrity and assessment monitoring services on behalf of Client Organizations. These services may include:

Resume analysis and job-description matching;
AI-assisted candidate skill conversations;
Identity verification;
Skills assessment delivery and monitoring;
Interview integrity monitoring;
OS-level monitoring during assessments and interviews;
Incident detection and reporting;
Integrity scoring and reporting;
Internal training verification workflows; and
HR review dashboard and analytics.

Meritclaw produces several decision-support indicators including:

JD Fit Score;
Authenticity Score;
Assessment Score; and
Integrity Score.

These scores, alerts, recommendations, and integrity indicators generated by Meritclaw are advisory only, intended to support human review. Meritclaw does not automatically reject candidates or employees.

Information We Collect

Personal Information collected through Meritclaw may include, depending on the configuration selected by the Client Organization:

Name;
Email address;
Resume or CV information;
Job application information;
Government-issued identification documents;
Photographs and webcam captures;
Biometric identity verification data, including facial biometric reference templates used for identity verification;
Audio and video recordings;
Screen recordings and screen-sharing sessions;
Assessment responses and submissions;
AI-assisted interview or assessment transcripts;
Device, operating system, browser, and hardware information;
Running application and process information during monitored sessions;
System configuration details;
Integrity event logs and incident timelines;
Phone camera streams used for secondary monitoring;
Authentication and login information;
IP address and device identifiers; and
Communications with customer support personnel.

Certain monitoring features may operate at the operating-system level rather than solely within the browser environment. Depending on Client Organization configuration, this may include monitoring for unauthorized applications, secondary monitors, additional input devices, virtual drivers, screen overlays, or other integrity-related indicators. Keystroke dynamics analysis is not currently active.

The exact categories of Personal Information collected are determined by the Client Organization and its selected integrity requirements.

How We Use Personal Information

Personal data is processed with the candidate’s or user’s consent and/or under other applicable legal bases, including the legitimate interests of the Client Organization in maintaining hiring integrity, fraud prevention, assessment security, interview integrity, training verification, and platform security, as permitted under applicable law.

We use Personal Information to:

Verify user identity;
Create and maintain biometric identity verification profiles;
Deliver and administer assessments and interviews;
Monitor assessment and interview integrity;
Detect unauthorized behavior, fraud, or policy violations;
Generate decision-support scores and reports;
Provide HR dashboards and reporting tools;
Provide customer support;
Improve platform reliability, functionality, and security; and
Comply with applicable legal obligations.

Meritclaw uses AI technologies to support:

Resume parsing and job-description matching;
AI-assisted skill conversations;
Assessment generation;
Assessment scoring assistance;
Integrity event detection; and
Session analysis and reporting.

We handle and treat Personal Information collected or received while providing our Services in a manner that is consistent with any binding agreement we have with the Data Controller. In the absence of a binding agreement, we will handle and treat your Personal Information in a manner that is consistent with this Policy and the applicable law.

We use your Personal Information generally as a data processor on behalf of the Client Hiring Organization, as per their requirement to provide, improve, and develop our services. We use biometric data that we collect from you during onboarding to create your identity profile for the services and for confirming your identity for when you take a test or appear for a live interview.

To Whom We Disclose Your Personal Information

Verificient does not sell Personal Information. Personal Information may be disclosed to authorized service providers, subprocessors, Client Organizations, and integrated third-party platforms solely for legitimate business, operational, security, or service-delivery purposes consistent with this Policy and applicable agreements.

Responsible use of AI

Verificient is committed to the responsible use of AI, prioritizing transparency, privacy, and security. Our AI technologies primarily rely on computer vision for face and ID detection, motion and blur tracking, spoofing and mobile phone detection, as well as conversational AI for support interactions. AI assists in identifying potential integrity, policy, or security violations during assessments or interviews, it does not make final determinations on cheating. AI alerts requiring further review are assessed by human professionals, who may be representatives from the Client Hiring organization. Users have the right to understand how AI is used in their assessment, interview, and hiring process experience, and request clarification on AI-generated alerts, and access Verificient’s privacy policies regarding AI and data usage.

What Meritclaw AI Does Not Do

Does not perform emotion or affect recognition;
Does not infer protected or sensitive characteristics;
Does not make automated hiring decisions; and
Does not automatically reject candidates.

Information Provided by Client Organizations

Client Organizations may provide information necessary to enable the Services, including:

Candidate identifiers;
Email addresses;
Job descriptions;
Assessment configurations;
Internal employee identifiers;
Applicant Tracking System (ATS) identifiers; and
Training module information.

ATS and Third-Party Integrations

Where configured by the Client Organization, Meritclaw may integrate with third-party Applicant Tracking Systems (“ATS”) or video conferencing platforms.

Only summary outputs and authorized reporting information may be shared with ATS platforms, including:

JD Fit Score;
Authenticity verdicts;
Assessment Scores;
Integrity Scores; and
Incident counts.

Meritclaw may also operate alongside third-party conferencing services such as Google Meet or Zoom during monitored interviews.

This Policy does not apply to third-party platforms, websites, ATS systems, or conferencing providers operated independently by Client Organizations or third parties. Those services are governed by their own privacy policies.

Third-Party Service Providers

Our services may contain links to third party websites for providing our services and or support. Meritclaw utilizes enterprise-grade third-party AI, cloud hosting, analytics, infrastructure, and support service providers to support authorized platform functionality.

These providers process Personal Information solely for authorized operational purposes and in accordance with applicable contractual, privacy, confidentiality, and security obligations. The policies and procedures we describe in this Policy do not apply to the third party websites or to your interactions with the Client Organization’s own systems, websites, or applicant tracking platforms. These are governed by the Client organization’s own privacy policy. We suggest contacting those sites directly for information on their privacy policies in case you have a query.

Appropriate technical and organizational safeguards are implemented to protect Personal Information from unauthorized access, disclosure, alteration, misuse, or loss.

Cookies and Tracking Technologies

Meritclaw and related Services may use cookies, session tokens, device identifiers, and similar technologies for:

Authentication;
Session management;
Security;
Fraud prevention;
Performance optimization;
Analytics; and
User experience improvements.

Certain features of the Services may not function properly without these technologies enabled.

Data Security

We take the security of Personal Information seriously and implement industry-standard administrative, technical, and organizational safeguards to protect Personal Information.

Candidate and session data are stored in encrypted cloud environments and protected through access controls, secure transmission protocols, logging, monitoring, and other security measures designed to reduce the risk of unauthorized access, disclosure, alteration, or destruction.

However, we do not control the security of your own equipment or your own network connection, and therefore we are not responsible for any information you transmit to us through the equipment or internet connection you use.

For any data deletion or data editing or data information or exercising any of your rights with regards to the data may be directed to the Privacy office or Officer of your Client Organization, including hiring organizations, employers, staffing agencies, enterprises, or training providers who is the Data Controller.

Data Retention and Deletion

Candidate and session-related data may include recordings, transcripts, biometric reference templates, integrity event logs, application reports, and monitoring information.

By default, Meritclaw retains Personal Information for up to 30 days following completion of the relevant session or workflow unless otherwise configured by the Client Organization or required by applicable law.

The Client Organization may define custom retention periods which shall take precedence over default retention settings. Upon expiration of the applicable retention period, Personal Information is securely deleted or anonymized, except where limited retention is necessary for legal compliance, dispute resolution, security, billing, fraud prevention, or legitimate business purposes.

International Data Transfers

Meritclaw is operated from the United States. If you access Meritclaw from outside the United States, your information will be transferred to and processed in the United States, which may have different data protection laws than your country of residence. Where international transfers occur, appropriate safeguards are implemented in accordance with applicable data protection laws including contractual, organizational, and technical protections designed to ensure lawful handling of Personal Information.

In the case of any such transfer or access, the personal information is subject to the law of the jurisdiction in which it is used or stored, including any law permitting or requiring disclosure of the information to the government, government agencies, courts and law enforcement in that jurisdiction. By providing your information on or to the Services, you consent to any such storage, transfer, and processing in accordance with this Policy and applicable law.

Meritclaw services are not available in Europe.

Your Rights and Choices

Depending on applicable law and the role of the Client Organization as Data Controller, individuals may have rights relating to:

Access to Personal Information;
Correction of inaccurate information;
Deletion requests;
Restriction or objection to processing;
Withdrawal of consent where applicable; and
Data portability requests.

Because Verificient generally acts as a Data Processor or Service Provider on behalf of the Client Organization, requests regarding Personal Information should typically be directed to the applicable Client Organization or its privacy office.

You may also contact Verificient at privacy@verificient.com and we will assist in routing or supporting the request where appropriate.

Verificient gives its users whose information we receive under the EU-U.S Data Privacy Framework (DPF), UK Extension to the EU-U.S. DPF and Swiss-U.S. Data Privacy Framework Programs, right to restrict the onward processing of their personal data and data portability, subject to certain limitations and exceptions as defined by your Client organization. Any request related to change in use of the services, onward data processing or data portability should be directed to your Client organization’s Privacy Officer. If for some reason, you are not able to contact your Client organization then you may contact us at privacy@verificient.com or raise a ticket request at https://www.verificient.com/support.

Representation for Data Subjects in the EU and UK

We value your privacy and your rights as a data subject and have therefore appointed a EU & UK Privacy Representative as our point of contact.

Our EU & UK Privacy Representative provides you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative or make use of your data subject rights, please visit : EU & UK privacy representative.

It may however be quicker to exercise your privacy rights by contacting the Data Privacy Officer of your Client Organization.

Verificient Technologies Inc. adheres to the EU-U.S Data Privacy Framework (DPF), UK Extension to the EU-U.S. DPF and Swiss-U.S. Data Privacy Framework Programs.

Note: Verificient adheres to EU General Data Protection Regulation (“GDPR“). Refer to our GDPR page for more information.

Verificient Technologies complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) as set forth by the U.S. Department of Commerce. Verificient Technologies has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. Verificient Technologies has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

Verificient Technologies Inc. is subject to the jurisdiction and enforcement authority of the US Federal Trade Commission (FTC).

In compliance with the Data Privacy Framework (DPF), Verificient Technologies Inc. commits to resolve complaints about our collection or use of your personal information. EU, UK, and Swiss individuals with inquiries or complaints regarding our Data Privacy Framework (DPF) policy should first contact Verificient Technologies Inc. at: privacy@verificient.com, or contact our Support team at : support@verificient.com, or chat with us via the chat window on our website – www.verificient.com.

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Verificient commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF to JAMS, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://www.jamsadr.com/dpf-dispute-resolution for more information or to file a complaint. The services of JAMS are provided at no cost to you.

If your complaints under Data Privacy Framework cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction

We acknowledge the right of EU, UK, and Swiss individuals to access their personal data. EU, UK, and Swiss individuals wishing to view or correct personal data may do so by following the instructions in this privacy policy found in “The Choice You Have With Your Information” section. Furthermore, said individuals also have the right to request deletion of data that has been handled in violation of the DPF Principles.

Verificient Technologies Inc. may be required to release the personal data of EU, UK and Swiss individuals in response to lawful requests from public authorities including to meet national security and law enforcement requirements.

Verificient Technologies Inc. is liable for the onward transfer of personal data of EU, UK and Swiss individuals to agent third parties unless it can be proven that we were not responsible for the actions giving rise to the damages.

You can view the complete Terms of Service here.

Biometric Information Notice

Meritclaw may collect and process biometric identifiers or biometric information, including facial geometry scans and facial biometric reference templates, for identity verification, impersonation prevention, fraud detection, and assessment or interview integrity monitoring.

Verificient does not sell, lease, trade, or otherwise profit from biometric identifiers or biometric information. Biometric information is retained only for as long as necessary to fulfill the authorized purposes described in this Policy, comply with applicable law, resolve disputes, or enforce agreements, after which such information is securely deleted or anonymized in accordance with applicable retention requirements and Client Organization configurations.

Where required by applicable law, the applicable Client Organization and/or Verificient will obtain legally required notice and consent before collecting biometric information.

Biometric information may be disclosed only to authorized service providers, subprocessors, Client Organizations, or where required by law.

Your California privacy rights

This section provides additional details about the personal information we collect about California consumers and the rights afforded to them under the California Privacy Rights Act ‘CPRA’ which works as an addendum to the California Consumer Privacy Act or ‘CCPA’.

For more details about the personal information we have collected over the last 12 months, including the categories of sources of personal information collected, please see the “Information We Collect” section above. We collect this information for the business and commercial purposes described in the “How We Use Your Personal Information” section above. We share this information with the categories of third parties described in the “To Whom We Disclose Your Personal Information” section above. Verificient does not sell the personal information we collect. Please note that we do use third-party cookies due to the technology of how Meritclaw is integrated with the testing platforms utilized by the Client organizations and for continuous use of the App (Desktop app, mobile app or browser plugin/extension app) and for purposes as further described in our “Cookies and Other Tracking Technologies” section above.

Subject to certain limitations, the CPRA provides California consumers the right to request to know more details about the categories or specific pieces of personal information we collect (including how we use and disclose this information), the right to request deletion of their personal information, the right to opt out of any “sales” of their personal information that may be occurring and the right to not be discriminated against for exercising these rights.

California consumers may make a request pursuant to their rights under the CPRA by contacting your Client Organization’s Privacy Officer, or if for any reason you cannot contact your Client Organization’s Privacy Officer, you may contact us at privacy@verificient.com Or may create a ticket request on https://www.verificient.com/support.

Children’s Privacy

Meritclaw Services are not intended for children under the age of 13 without appropriate parental or legal guardian consent and authorization from the applicable Client Organization.

Changes to this Policy

Verificient may update this Policy from time to time by posting an updated version on its website or through the Services. Where required by applicable law, additional notice or consent will be obtained for material changes affecting Personal Information processing.

Contact Information

If you have questions regarding this Policy or our privacy practices, please contact us at privacy@verificient.com