Privacy Policy

1. Who we are and what this Policy covers

Confeti, Co. (Confeti, we, us) is a Delaware corporation located at 131 Continental Dr, Suite 305, Newark, DE 19713, United States. This Privacy Policy explains how we collect, use, share and protect personal information when we act as a controller of that information, including in relation to our website, customer accounts, product administration and support.

When a business customer uses Confeti to record interviews or manage recruiting data, that customer generally determines the purposes and lawful basis of the processing. In that context the customer acts as a controller (or processor for another controller) and Confeti acts as a processor (or subprocessor) under the applicable agreement and Data Processing Addendum (DPA). This Policy does not override those instructions.

2. What information we process

The information processed depends on the features and integrations used. Some is provided directly, some comes from business customers and their authorized users, and some is generated in delivering the Services.

• Account and business-contact information: name, email, company, role, account settings and authentication identifiers;
• Recruitment and interview content: resumes, applications, professional histories, job information, meeting metadata, audio recordings, transcripts, speaker data, interview notes, candidate evaluations and scorecards;
• AI-related content: prompts, instructions, contextual information, summaries, recommendations, draft documents and other generated outputs;
• Connected-service information: calendar events, meeting or file metadata, and content made available through an integration that a customer enables with the relevant permissions;
• Technical and usage information: IP address, device and browser characteristics, error logs, activity records and security events; and
• Communications: support requests, contact messages, notices and transactional emails.

3. Why we use personal information

Where we are an independent controller, we use account and related information to provide requested services, administer organizations and users, authenticate access, respond to support, send service notices, detect misuse, protect systems, comply with legal obligations and maintain records reasonably required for operating our business.

Where we are a processor, we handle candidate, interview and recruiting content according to the customer’s documented instructions to support recording, transcription, analysis, collaboration, AI-assisted recruiting workflows, integrations, export and deletion.

Where applicable, our legal bases for independent-controller processing include performing a contract, complying with legal duties, legitimate interests in operating and securing the Services, and consent for activities that require it. We do not treat our customers’ recording instructions as replacing the customer’s responsibility to give legally required notices and obtain any necessary consent.

4. Interview recordings and individual rights

Recordings may include voices, participant names, statements, professional histories and other personal information. Business customers control whether and how interviews are recorded and must supply required participant notices and obtain any necessary lawful consent or authorization. We do not decide whether a particular employer should record an interview.

If you are a candidate, employee or interview participant and want access, correction or deletion of information collected by a recruiting organization using Confeti, contact that organization first. We assist the organization in responding to valid requests under the DPA and applicable law.

5. AI and model training

Confeti uses approved processing providers to transcribe or analyze materials and produce requested AI-assisted outputs. We do not use Customer Personal Data, identifiable AI inputs or identifiable AI outputs to train a general-purpose AI model, a model made available to unrelated third parties or a provider’s model for that provider’s independent benefit without the customer’s prior written authorization.

We may use aggregated or effectively de-identified usage and operational information for reliability, security, maintenance, evaluation and improvement where it does not identify or permit reasonable reconstruction of a customer or individual. AI outputs may be inaccurate; employers remain responsible for human review and lawful recruiting decisions.

6. Sharing and service providers

We do not sell personal information. We may share data with authorized personnel and suppliers as needed to operate the Services, comply with lawful requests, protect safety and security, or complete a corporate transaction subject to appropriate protections.

Our service-provider categories include cloud infrastructure, authentication, transcription and language processing, AI processing, transactional email and customer support. The September 2026 DPA lists Google Cloud and Firebase, AssemblyAI, Resend and Google Workspace as approved processing suppliers, with material changes governed by the DPA.

Customer-enabled connectors, such as Google Calendar, Google Drive, Microsoft identity providers, Comeet and Slack, may exchange information as configured by the customer and are also subject to their own independent practices. Access through Google APIs is used to provide the customer-requested feature within the permissions granted, not for unrelated advertising or sale of data.

7. Where information is processed

Our core application and storage infrastructure is hosted in the United States, principally in Google Cloud us-central1. Some service providers use distributed systems or other disclosed locations. Where required by law, we use contractual or other recognized safeguards for restricted international transfers. Details for customer-controlled data are in the DPA.

8. Security

We use reasonable security measures designed to protect personal information, including access restrictions, transport encryption, managed-service encryption at rest, credential protection, logging and incident response. No networked service can be made entirely free from risk.

The desktop recorder may leave local audio files on a user-controlled computer. Those files, and exported or downloaded copies, remain subject to the user’s or employer’s device and storage practices rather than Confeti’s cloud-deletion process.

9. Retention and deletion

For customer-controlled interview content, the standard deletion process removes deleted interviews from ordinary product access within 24 hours and substantive content from primary production systems within 30 days. Following termination of the Services, Customer Personal Data is deleted from primary production systems within 60 days, subject to customer export, legal retention, documented disputes and limited audit or security records.

Limited audit, security, fraud-prevention and deletion records may be retained for up to 24 months. Managed backups, transaction logs and recoverable versions may remain isolated temporarily until their normal lifecycle ends. Independently controlled account and business records are retained only as reasonably necessary for service administration, compliance, security, disputes or legally required periods. Contact us for an applicable retention request.

10. Cookies and similar technologies

Our site and app may use essential cookies, authentication tokens and related storage needed for account access, security, preferences and functionality. Depending on enabled features, we may collect limited analytics or diagnostics data. Where non-essential tracking requires consent, we will seek it before using that tracking. Browser settings can restrict cookies, although essential product features may then stop working.

11. Your privacy rights

Depending on your location and the laws that apply, you may have rights to request access, correction, deletion, restriction, portability, objection, or withdrawal of consent, and to complain to a competent supervisory authority. Rights are subject to statutory limitations and exemptions.

For personal information for which Confeti is the controller, contact security@confeti.co. We may need to verify your request. For recruitment data controlled by your employer or another Confeti customer, make the request to that organization; we will provide reasonable assistance as its processor.

12. Children and sensitive information

The Confeti business platform is for authorized users aged at least 18. We do not knowingly invite children to create business accounts. Customer-supplied recruiting information may nevertheless concern younger applicants or contain sensitive personal data; the recruiting organization must have a lawful basis and appropriate safeguards for that processing.

Please do not submit health, biometric, protected-trait or other special-category data unless it is necessary and you are legally authorized to do so.

13. Changes and related documents

We may update this Policy as our Services, legal requirements or practices change. We will provide reasonable notice of material changes through the website, email or the product where appropriate. A change to this notice does not amend a separately signed agreement.

See our Terms of Service and Data Processing Addendum for contractual responsibilities, including recording-consent obligations, processing roles, safeguards, retention and authorized subprocessors.

14. Contact

Privacy and security inquiries: security@confeti.co. Legal and general inquiries: admin@confeti.co. Confeti, Co., 131 Continental Dr, Suite 305, Newark, DE 19713, United States.