Ribbon Inc. is a technology company that provides AI-powered interviewing and analysis tools to organizations for recruitment, evaluation, and research purposes.

For the purposes of applicable data protection laws, including the General Data Protection Regulation (“GDPR”):

• Ribbon acts as a data processor when processing candidate data on behalf of customers.
• Ribbon may act as a data controller when processing personal data for its own business purposes, such as account management, website analytics, security, and legal compliance.

We may collect and process the following categories of personal data, depending on how you interact with the Services:

2.1 Candidate and Interview Data

• Name, email address, and contact details
• Audio and video recordings
• Interview transcripts
• Responses to interview questions
• Metadata related to interview sessions (timestamps, duration, device information)
• AI-generated summaries, scores, or analytical outputs

2.2 Customer and Business Data

• Name, business contact details, and role
• Account credentials
• Billing and payment information
• Metadata related to interview sessions (timestamps, duration, device information)

2.3 Website and Usage Data

• IP address
• Device and browser information
• Log files and analytics data
• Cookies and similar technologies

We process personal data for the following purposes:

• Providing and operating the Services
• Conducting and analyzing interviews
• Generating interview summaries and insights
• Improving and developing our products
• Account administration and customer support
• Security, fraud prevention, and system integrity
• Compliance with legal obligations

• Consent – where you have explicitly agreed to the processing (e.g., participation in an AI-conducted interview)
• Contractual necessity – where processing is necessary to perform a contract with a customer
• Legitimate interests – such as improving our Services, ensuring security, and preventing misuse, where such interests are not overridden by your rights
• Legal obligation – where processing is required to comply with applicable law

Where the GDPR applies, Ribbon relies on the following legal bases to process personal data:

Ribbon provides AI-powered tools that may process personal data using automated methods to generate interview transcripts, summaries, scores, or insights.

Ribbon does not make autonomous hiring or employment decisions. All outputs generated by the Services are intended to support human decision-making by our customers.

Where applicable law requires, you have the right to:

• Request human review of automated processing
• Express your point of view
• Contest automated outputs

You may exercise these rights by contacting privacy@ribbon.ai.

Ribbon develops AI systems intended to support human evaluation and decision-making. Ribbon does not deploy AI systems to make final employment or selection decisions.

In alignment with the EU Artificial Intelligence Act, Ribbon has implemented measures including:

Where applicable law requires, you have the right to:

• Human-in-the-loop system design
• Documentation of system capabilities and limitations
• Data quality and bias mitigation practices
• Logging, monitoring, and security controls

Customers using Ribbon remain responsible for ensuring appropriate human oversight and compliance with applicable employment and non-discrimination laws.

We retain personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Typical retention periods include:

• Interview recordings and transcripts: up to 24 months, unless deleted earlier at the request of the customer or data subject
• Customer account data: for the duration of the contractual relationship
• Logging, monitoring, and security controls

Customers using Ribbon remain responsible for ensuring appropriate human oversight and compliance with applicable employment and non-discrimination laws.

Typical retention periods include:

• Customers, as directed through use of the Services
• Service providers and subprocessors that support our operations
• Professional advisors (e.g., legal, accounting)
• Authorities where required by law

All subprocessors are subject to contractual confidentiality and data protection obligations.

Ribbon may transfer personal data outside the European Economic Area. Where required, such transfers are safeguarded through appropriate mechanisms, including Standard Contractual Clauses approved by the European Commission.

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have the following rights under applicable data protection laws:

• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object to processing through use of the Services

To exercise these rights, contact us at privacy@ribbon.ai. We may need to verify your identity before responding. We will respond within the timeframes required by law (generally within 30 days).

If you are located in the EEA, you have the right to lodge a complaint with your local data protection authority if you believe our processing of personal data violates applicable law.

We implement appropriate technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, or alteration.

Ribbon uses cookies and similar technologies to operate and improve the Services. You may control cookies through your browser settings where applicable.

The Services are not directed to children under 16. We do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time. The updated version will be indicated by a revised “Last updated” date.

If you have questions about this Privacy Policy or our data practices, contact us at:

Email: privacy@ribbon.ai
Company: Ribbon AI, Inc.