Privacy Policy

Last updated: October 30, 2026

1. Introduction

Litmus Ltd. ("Litmus", "we", "us", or "our") respects your privacy. This Privacy Policy explains how we collect, use, and protect your information when you use our platform at www.litmushiring.com ("Service").

2. Information We Collect

Account Information: Name, email address, and profile details provided during sign-up or through third-party authentication (e.g., Google).

Assessment Data: Code submissions, commit history, assessment responses submitted by candidates, and records of AI assistant usage during the assessment (e.g., prompts sent to Claude Code, GitHub Copilot CLI, or similar tools, and the tool's responses), to the extent such activity occurs within the Platform, through Platform-provided or connected tools, or is otherwise made available to Litmus. Candidates are shown a disclosure describing what the Litmus assessment client records and asked to acknowledge it before starting an assessment. In a workspace that Litmus hosts, assessment data can also include a recording of what the terminal displays, with the time each part appeared. Characters a candidate types that the terminal shows on screen are part of that recording.

Walkthrough Recording: After submitting an assessment, candidates record a short video walkthrough explaining their work. Video and audio are uploaded to Litmus storage. Audio is transcribed by Deepgram to support evaluation, and by OpenAI's Whisper when Deepgram can't produce a transcript. Spoken answers to questions asked during an assessment are transcribed by OpenAI. The video, audio, and transcript are visible to the hiring company that invited the candidate.

Live Interviews: When a hiring company runs a live interview through Litmus, a Recall.ai notetaker can join the video call. It records the call's video and audio, including any shared screen, and Recall.ai transcribes the recording. Audio from the call can also be transcribed by Deepgram. The recording and transcript are visible to the hiring company.

Customer-Provided Context: When a hiring company links external systems to Litmus — for example, source-code repositories (via the Litmus GitHub App), issue trackers (Linear, Jira, GitHub Issues, Notion), or applicant tracking systems (Ashby, Greenhouse, Lever) — content and records from those systems flow into Litmus to enable assessment generation, candidate invitations, and pipeline tracking. Content from connected source-code and issue-tracker systems may be transmitted to AI providers named in §4 to produce relevant assessments. We use this content to provide the Service to the applicable hiring company and do not use it to train or improve Litmus's general assessment, grading, AI, or product systems, except as permitted by our agreement with that company.

Google Calendar: If you connect your Google Calendar, Litmus reads your calendar events (read-only access) to show your busy times on the interview availability grid and to let you pick the meeting you are on when creating a live-interview link. We store a credential so this works without reconnecting, and your choice of which of your calendars to read. Event details are shown only to you. If you choose a meeting to create a live-interview link, the details you confirm from it (the candidate's name and email address, and the meeting link) become part of that interview session in Litmus, where they are visible to the candidate and to members of your organization like any other session. We store nothing else from your calendar, and we do not sell calendar information or use it for advertising. You can disconnect at any time from Settings, which deletes the credential. Litmus's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Hiring and Performance Outcomes: We may receive subsequent interview outcomes, hiring decisions, and performance feedback from hiring companies or their connected systems where lawfully shared and permitted by our agreement with that company. Candidates are not required by the Candidate Platform Agreement to provide these reports.

Usage Data: Pages visited, features used, browser type, and device information collected automatically.

Payment Information: Billing details processed securely through Stripe. We do not store credit card numbers on our servers.

3. How We Use Your Information

To provide and maintain the Service
To manage your account and authenticate your identity
To process payments and manage subscriptions
To send transactional emails (e.g., assessment invitations, account notifications)
To improve the Service and develop new features
To ensure security and prevent fraud
For candidates, to administer assessments, preserve assessment integrity, generate or support evaluation outputs, provide submissions and related assessment metrics to the hiring company that invited the candidate, and maintain platform security
For candidates, to conduct internal research, analytics, quality assurance, and benchmarking, and develop, train, test, and improve Litmus products, assessment systems, and AI models using candidate submissions, assessment activity, evaluation outputs, and lawfully received outcomes, subject to applicable law, third-party rights, the applicable Candidate Platform Agreement, and our agreement with the hiring company.
To create and use information that meets the applicable legal standard for anonymous or de-identified information for research, analytics, benchmarking, reporting, product development, and AI-model development, training, and testing. We may license individual de-identified assessment records, not only aggregated statistics, to third parties for these purposes, subject to the safeguards in Section 4, the applicable Candidate Platform Agreement, applicable third-party rights, and our agreements with hiring companies.
To support automated and AI-assisted assessment administration, grading, integrity review, transcription, analytics, and evaluation outputs, which may be considered by the hiring company as part of its own candidate evaluation process — hiring companies are responsible for their own hiring decisions

Company-provided content and confidential information remain excluded from general research, benchmarking, model development or training, and commercialization unless the company separately authorizes the relevant use. This includes that content actually contained in submissions, outputs, or derived data. A response is not Company-provided content solely because it answers a Company-provided task; applicable customer-agreement restrictions continue to govern. Providing and evaluating the applicable assessment remain permitted.

4. Information Sharing

We do not currently sell personal information or share personal information for cross-context behavioral advertising as those terms are used under California privacy law. If that changes, we will update this Policy and provide any required opt-out mechanism before doing so. We may share information with:

Service Providers: Third parties that help us operate the Service, for example Clerk for authentication, Stripe for payments, Resend for email, Railway for application hosting and our database, Cloudflare R2 for storage and backups, and Vercel for hosting and Blob storage. Candidate recordings and transcripts are stored with Vercel Blob, Cloudflare R2, and Railway, and live interview recordings are stored with Recall.ai. Beyond storage and hosting, these are the providers that receive candidate audio, video, or transcripts to process them: Anthropic, for assessment generation and grading, which can include transcripts and still images from walkthrough videos; Deepgram, for transcribing walkthrough and interview audio; OpenAI, for transcription when Deepgram can't produce a transcript and for spoken answers to assessment questions; and Recall.ai, for recording and transcribing live interview calls. When an assessment lets a candidate's code use AI services through Litmus, the requests that code sends go to the provider the assessment uses: OpenAI, Anthropic, OpenRouter, or Voyage AI. These providers process information on our behalf under contract and are restricted from using it for their own independent purposes, including training their own general-purpose models on it.
Recipients of De-identified Information: We may license properly de-identified assessment records to researchers, product developers, and AI-model developers for the purposes described in Section 3. Before any release, we will assess and reduce identification risk in the intended use and disclosure context, including singling out, linkage, and reasonably available additional information. The records must not identify a hiring company or disclose its materials or confidential information. We will maintain the information in de-identified form and require recipients and permitted onward recipients to do the same, use it only for licensed purposes, and not attempt re-identification. We will not attempt or authorize re-identification of information prepared and maintained for this external reuse.
Website Visitor Identification: On our public marketing pages only, we use RB2B, a visitor identification service, which may use cookies and similar technologies to identify the business, and in some cases the professional profile, of a person visiting those pages. RB2B does not run on sign-in, candidate, assessment, shared report, or company account pages.
Hiring Companies: When you submit an assessment as a candidate, the hiring company that invited you can view your submission, walkthrough recording, transcript, related assessment activity, and evaluation outputs, as applicable to the assessment
Legal Requirements: When required by law, regulation, or legal process

Submission Ownership: Ownership and licenses for assessment work are governed by the version of the Candidate Platform Agreement you actually accepted, applicable law, and third-party rights. The applicable agreement contains the full ownership, license, confidentiality, and use restrictions. This Policy does not expand those grants.

5. Data Security

We implement appropriate technical and organizational measures to protect your data. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

We retain information only while necessary and lawful for its purpose. Relevant criteria include providing and reviewing assessments, maintaining hiring records, resolving disputes, security, and legal obligations. Retention does not itself authorize a new use. The following describes our current deletion mechanisms; it does not mean information may be retained indefinitely without a continuing lawful purpose. Account and billing data are retained for as long as your account is active and as needed to comply with legal and accounting obligations. Candidate submissions, video walkthroughs, interview recordings, audio, transcripts, and assessment activity data are kept until they are deleted, except as described in the next two sentences. Apart from those exceptions, they are not deleted automatically after a set period, and hiring companies can't set a retention period for them. If we refuse a submission after receiving it, we keep the refused upload for 30 days so it can be recovered if the refusal was a mistake, and then delete it. Recordings of a hosted workspace's terminal may be deleted automatically: an earlier recording one day after a newer one replaces it, and every recording 30 days after it was made. When a hiring company deletes a candidate, an assessment, or its organization, we keep the candidates' walkthrough recordings and the interview-call audio stored with Vercel Blob for 30 days so a mistaken deletion can be reversed, and then delete them; the recordings held by Recall.ai are deleted at once. Security and audit logs may be retained for longer periods where reasonably necessary. De-identified, aggregated, or anonymized data may be retained and used after account deletion where permitted by law and where it no longer identifies you. You may request deletion by contacting us, subject to applicable legal exceptions and retention that remains necessary and lawful for the relevant purpose.

7. Your Rights

Depending on your location, you may have rights to:

Access, know, and receive a copy of your personal information
Correct inaccurate information
Request deletion of your data
Request portability of your data
Object to or restrict certain processing
Opt out of the sale or sharing of personal information or targeted advertising (see Section 4), and exercise applicable rights relating to profiling or automated decision-making
Withdraw consent where processing is based on consent
Appeal a decision on a privacy request

We will not discriminate against you for exercising rights under applicable law. To exercise any of these rights, contact us at support@litmushiring.com; we may need to verify your identity before fulfilling a request. If you are in the EEA, UK, or Switzerland, our legal bases for processing include performance of a contract, legitimate interests (operating and securing the Service, administering assessments, preventing fraud and unauthorized assistance, and improving assessment and grading systems), compliance with legal obligations, and consent where required — and you have the right to lodge a complaint with your local supervisory authority.

For research, product improvement, model development, and other secondary uses involving personal information, we assess the applicable lawful basis and any additional conditions before processing. Where consent is required for an optional secondary use, we request it separately; refusing or withdrawing it does not affect participation in an assessment.

8. Cookies

We use essential cookies for authentication and session management. We may use analytics cookies to understand how the Service is used.

9. Children's Privacy

The Service is not intended for users under 18. We do not knowingly collect information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We publish updates on this page and, where required, provide additional notice or request separate consent before expanded uses begin. Posting an update does not establish acceptance of a new Candidate Platform Agreement or any separately required consent, and does not broaden rights over earlier assessments or submissions.

11. Contact

If you have questions about this Privacy Policy, contact us at support@litmushiring.com.