Privacy Policy

Last updated: 4 October 2026

Questions? privacy@confiri.com

1. Who we are

Confiri checks that the person joining a video interview is the person who was invited, before they reach the call. It is operated by Global Talent Leaders LTD (company number 14557865), registered in England and Wales at Summit House, Horsecroft Road, Harlow, Essex, CM19 5BN.

When you go through Confiri as a candidate, the company interviewing you (the “recruiter”) has engaged us. They are the data controller and Global Talent Leaders LTD acts as their data processor. For recruiter accounts, Global Talent Leaders LTD is the data controller.

2. What data we collect

Candidates

  • Your name and email address, from the recruiter's calendar invitation or entered by the recruiter
  • Live camera frames during the camera check, processed in memory and never stored (see section 6)
  • Your LinkedIn profile address and public profile details, including the public profile photo used for comparison
  • Your mobile number, if you choose to confirm it by text message
  • Device and browser details (type, operating system, screen and camera capabilities), limited to a fixed list of fields
  • Your IP address and approximate location, to detect VPN, proxy and Tor use
  • When you completed each step, and the outcome of each check

Recruiters

  • Name, work email address, company name and settings
  • Your password, stored only as a hash by our authentication provider; we never see it
  • If you connect a calendar: the connection token and the calendar data described in section 4
  • Billing details, handled by Stripe

3. How we use data

PurposeLegal basis
Checking that the person joining an interview is the person invitedLegitimate interests of the recruiting company in preventing fraud and security breaches
Comparing your live camera image with your LinkedIn photoYour explicit consent, given on the consent screen before the check starts
Giving the recruiter a result and a plain-English summary of each checkLegitimate interests
Emailing candidates their interview invitationLegitimate interests
Reading and updating a recruiter’s calendar events (section 4)Performance of our contract with the recruiter
Keeping results so the recruiter can review themPerformance of our contract with the recruiter
Recruiter account emails, sign-in and password securityPerformance of our contract with the recruiter

Confiri never rejects a candidate automatically: a person on the recruiter's team decides. We do not use data for advertising, we do not sell it, and we do not use it to train AI models, ours or anyone else's.

4. Google Calendar and Microsoft Outlook data

A recruiter can connect their Google Calendar or Microsoft Outlook calendar so Confiri can schedule interviews on it and find the interviews they already organise. When they do, Confiri:

  • Creates an event on the recruiter's own calendar when they schedule an interview in Confiri, with a Google Meet link, and invites the interview panel they chose. The candidate is never added to that event: they receive Confiri's own invitation and join through Confiri.
  • Changes or deletes only the events Confiri created, and only when the recruiter reschedules or cancels that interview in Confiri. The calendar notifies the panel of the change.
  • Reads events on the connected calendar for the next seven days, only to find interviews the recruiter organises (events with a word such as “interview” in the title). For each one, it reads its title, time, guests and meeting link, and creates a verification session with the outside guest's name and email address, the job title from the event title, and the meeting link.
  • Updates such an event for the recruiter: it adds a link to the interviewer's review page and removes the candidate from the guest list, so the candidate joins through Confiri's own invitation instead. The calendar notifies the candidate of that change. Confiri never deletes an event it did not create, and never changes events that are not interviews.
  • Stores the connection token until the recruiter disconnects, and a record of which events it has created or handled (event ID, start time and candidate email) so it never handles one twice.

Calendar data is used only to provide this feature. It is never used for advertising, never sold, never used to train AI models, and never read by people except where the recruiter asks us to for support, for security reasons, or where the law requires it.

Confiri's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

A recruiter can disconnect at any time in Confiri's Settings, or remove Confiri's access from their Google account at myaccount.google.com/permissions or from their Microsoft account.

5. Services we use

ProviderWhat it does for ConfiriLocation
AWS RekognitionThe camera check and face comparison, in memoryIreland
SupabaseDatabase and sign-inLondon
VercelHosting the applicationLondon (static files from its global network)
ResendSending invitations and account emailsIreland
TwilioText-message confirmation and phone carrier lookupUSA, EU routing where available (SCCs)
IPinfoConnection checks from the IP addressUSA (SCCs)
EnrichLayerPublic LinkedIn profile details and photoUSA (SCCs)
AnthropicWriting the plain-English summary for the interviewer, from check outcomes and the candidate’s name (no images)USA (SCCs)
StripeRecruiter billing (no candidate data)USA, EU entity for UK and EU customers
Google, MicrosoftCalendar connection, when a recruiter chooses itThe recruiter’s own account
Have I Been PwnedHow long an email address has existed (a partial hash, never the address), and refusing recruiter passwords already exposed in breaches (the first five characters of a hash, never the password)Australia (SCCs)
Gravatar, RDAP registries, Tor ProjectEmail age and connection lookups (a hash of the email address, the email domain, and the IP address)Various public services

6. Biometric data

The camera check only starts after you tick the consent box. You can decline: your interviewer is told, and can arrange another way to continue. During the check:

  • A short sequence of camera frames goes to AWS Rekognition in Ireland, in real time, solely to confirm a live person is present.
  • A frame is compared, in memory only, with the public LinkedIn photo you provided, and checked for more than one face. Only a similarity score and a face count are kept.
  • If the check confirms a live person, AWS Rekognition keeps a face template from that frame: a set of numbers describing your face, not a picture. It is held in a collection of your own and is used only to compare you, one to one, with yourself at your next interview with the same company, to confirm the same person attends each round. It is deleted 30 days after your last interview, or straight away if you are not taken forward. Sales demonstration calls never keep one.
  • No image of you is ever written to storage, at any point.
  • Nothing is used to identify you anywhere else, or to compare you with other candidates. Your face template is never searched against anyone else's.

7. How long we keep data

DataKept for
Verification sessions: results, candidate name and email, check details90 days after the session completes or expires, unless the recruiting company sets a different period. A nightly job deletes them.
Camera framesNever stored
Face template (numbers, not an image) for comparing interview rounds30 days after the candidate’s last interview with that company; deleted straight away if they are declined. A nightly job deletes expired ones.
Cached copy of the LinkedIn photoKept so the interview panel can compare it with the person on the call; deleted 30 minutes after the interview is due to end, straight away if the candidate is declined, and in every case by a daily clean-up
Calendar connection tokenUntil the recruiter disconnects the calendar or deletes the account
Recruiter account dataUntil the account is deleted, plus 30 days

8. Your rights (UK GDPR)

You have the right to access, correct, erase, restrict, port and object to your data, and to withdraw consent where we rely on it. Email privacy@confiri.com and we will respond within 30 days. Candidates can also contact the recruiting company directly, as the controller of their data.

You can complain to the Information Commissioner's Office (ICO) at ico.org.uk.

9. Cookies

We use strictly necessary cookies only: one keeps recruiters signed in; one keeps a candidate's verification session open in their browser for up to 12 hours; and a short-lived cookie protects the calendar connection step (it expires after 10 minutes). No advertising or tracking cookies.

10. Security

Data is encrypted in transit (TLS) and at rest. Each company's data is separated by row-level security in the database. Verification links are single-use and kept out of our logs, calendar tokens are never sent to the browser, and new recruiter passwords are checked against known breaches. The full list of systems that touch data, and what each one receives, is on our security page.

11. International transfers

Our database and application servers are in London and the camera check runs in Ireland. Some services listed above are in the USA or elsewhere; where data leaves the UK, we rely on appropriate safeguards, including Standard Contractual Clauses with the UK addendum.

12. Changes to this policy

We may update this policy. We will email recruiters about material changes, and the date at the top of this page always shows the latest version.

13. Contact us

Email: privacy@confiri.com
Company: Global Talent Leaders LTD
Company number: 14557865
Registered address: Summit House, Horsecroft Road, Harlow, Essex, CM19 5BN

Terms of ServiceBack to Confiri