1. Data controller
The data controller for personal data collected through this website and CopiloIT commercial channels is Williams Infinity, owner of the product CopiloIT, dedicated to software development, artificial intelligence solutions, and SaaS tools for IT recruiting.
- Email: ian@williamsinfinity.com
- Website: https://copiloit.com
2. What data we process
We may process data provided directly through forms, demo requests, registrations, or communications, including name, surname, company, role, email address, phone number, selected plan, billing data, and any information included in your message.
When the application is used, we may also process organization user data, workspace configuration, recruiting processes, candidates, professional profiles, interviews, evaluations, notes, video and audio recordings —including image and voice—, transcripts, AI-generated results, and technical metadata required to provide the service.
If registration is completed through Google OAuth, we may receive account identifiers, email address, and email verification status provided by Google.
3. Purposes of processing
- To handle information, contact, or demo requests.
- To manage registration, authentication, account activation, and access to CopiloIT.
- To process payments, subscriptions, billing, and plan management through payment providers.
- To provide product features, including managing candidates, conducting and recording AI interviews, transcribing responses, generating evaluations and reports, and making them available to the customer organization's authorized hiring team.
- To send necessary transactional communications such as account activation, payment confirmations, security notices, or support messages.
- To measure website usage with analytics, only where consent has been provided for analytics cookies.
- To comply with legal obligations applicable to the data controller.
4. Legal basis
- Consent when you voluntarily contact us, submit a form, or accept analytics cookies.
- Pre-contractual measures when you request a demo or commercial information.
- Performance of a contract to manage registration, account access, product access, payments, and provision of the contracted service.
- Legitimate interest to maintain service security, prevent abuse, provide support, and improve the product without disproportionately affecting user rights.
- Legal obligation where processing is required by applicable law.
For recruiting processes, the customer organization determines the legal basis applicable to the processing of candidate data. CopiloIT processes that data on the organization's behalf and under its instructions.
5. Data retention
Data will be kept for as long as necessary to handle the request, maintain the commercial or contractual relationship, provide the service, and afterwards for the periods required by applicable law or for as long as liabilities may arise from the processing.
Data associated with recruiting processes and candidates will be retained according to the configuration, instructions, or needs of the customer organization, without prejudice to any blocking or deletion required by law.
Interview recordings will be subject to the retention period configured for the service and the customer organization's instructions, and will be deleted or returned where applicable.
6. Recipients and third-party access
As a general rule, personal data will not be disclosed to third parties unless legally required or necessary to provide the service. Technology providers acting as processors or subprocessors may access data, including hosting, infrastructure, email, security, payment, analytics, authentication, automation, and artificial intelligence providers.
Among others, CopiloIT may rely on providers such as Stripe for payments, Google for authentication and analytics, Cloudflare for security and network services, Resend or other email providers, cloud infrastructure services, databases, and AI model providers required to run product features.
Candidate data, including recordings, transcripts, and evaluations, may be accessed by authorized personnel of the customer organization managing the recruiting process.
7. International transfers
If any technology provider processes data outside the European Economic Area, appropriate safeguards required by GDPR will be adopted.
8. Candidate data and CopiloIT's role
When a customer organization uses CopiloIT to manage candidates, recruiting processes, interviews, or evaluations, that organization will normally act as data controller for that data. In that context, Williams Infinity/CopiloIT acts as processor, processing data under the customer's instructions and to provide the contracted service.
CopiloIT maintains confidentiality, limits access and subprocessing to what is necessary to provide the service, and assists the customer organization with data subject rights, security, and the deletion or return of data under the applicable terms.
9. Interviews, recordings, and artificial intelligence
Before starting a recorded module, candidates are informed that the interview uses artificial intelligence and is recorded on video and audio. The recording may include their image, voice, and conversation with the AI. Audio may be transcribed and responses may be analyzed to generate evaluations and reports based on the criteria defined for the recruiting process.
AI-generated results support the hiring team and do not make the final hiring decision on their own. The customer organization must maintain human oversight. Candidates may ask the responsible organization for human intervention or information about their evaluation.
CopiloIT does not sell candidate data or use candidate recordings, transcripts, or evaluations to train or fine-tune artificial intelligence models. Recordings are not used for biometric identification or emotion inference.
10. User and candidate rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing, and portability, and withdraw consent where applicable, by writing to ian@williamsinfinity.com.
If you are a candidate in a process managed by a customer organization, you should preferably submit your request to that organization as data controller. CopiloIT will assist the organization in responding to it.
If you believe the processing of your personal data does not comply with applicable law, you may also file a complaint with the competent supervisory authority.
11. Information security
CopiloIT applies reasonable technical and organizational measures to protect personal information against unauthorized access, alteration, loss, or improper disclosure, including access controls and logical separation of customer organization data.
12. Changes to this policy
This privacy policy may be updated to reflect legal, technical, or service changes. The current version will always be the one published on this page.