Akovex Privacy Policy

Effective 2026-08-24 · Version 2.0-4256737b21e9
Operated by Akovex, Inc., a Delaware corporation. This document is not legal advice.

1. Who we are and what this covers

Akovex is a multi-tenant business operations platform operated by Akovex, Inc. ("we", "us"). This policy explains how we handle personal information in two distinct roles:

As a controller, for the personal information of the people who buy and administer Akovex: account holders, billing contacts, prospects and website visitors.
As a processor (service provider), for the personal information that our customers upload or generate inside the Platform about their employees, candidates, contractors, contacts and end customers. For that data the customer is the controller and decides what is collected, why, and for how long. Our handling of it is governed by the Data Processing Agreement, not by this policy alone.

If you are an employee, candidate or contact of a business that uses Akovex, your employer or that business is the controller of your data. Direct access and deletion requests to them first. We will assist them; we generally cannot act on your request unilaterally.

2. Personal information the Platform collects

The following is a factual inventory taken from the database schema, not a generic template list. Which categories apply to you depends on which features your organisation enables.

2.1 Account and identity

Name, work email, phone, job title, role, department, brand assignment, employment type, country, timezone, manager, start date, and an access code. Account credentials are stored as bcrypt hashes. Sign-in history including IP address and timestamps.

2.2 Onboarding and HR records

Onboarding phase and readiness, documents issued and signed, e-signatures, training progress, checklist completion, and manager notes.

2.3 Sensitive personal information

Where your organisation enables the relevant features, the Platform stores:

Date of birth, home mailing address, and emergency contact name and phone.
Financial account details: bank name, routing number, account number and payment handle, used for payroll and vendor payment. Date of birth and all four financial fields are encrypted at rest before being written to the database.
Compensation data: pay type, pay rate, probationary and post-probationary rates, compensation change history with reasons and approvers.
Time-off and absence records, including PTO requests and reasons. Note: the Platform does not have a dedicated health-data field. If a customer's staff enter medical detail into a free-text reason, that free text is stored as entered.
Performance and evaluation data: reviews, scores, letter grades, praise and concern signals, goals and key results, survey responses.
Recruiting data: candidate records, resumes, interview scorecards, offer letters.

2.4 Recordings and transcripts

Where meeting or interview recording is enabled, the Platform stores audio/video recording locations, full transcripts, per-speaker statistics, talk-time percentages, camera-on percentages, AI-generated summaries and sentiment analysis. Interview sessions store the candidate's name, email, recording URL and full transcript.

Read section 5 before enabling recording. It is the most legally sensitive feature in the Platform.

2.5 Business contact and customer data

CRM contacts, companies, deals, interactions, bookings, purchase history and abandoned carts.

2.6 Communications

Internal messages, direct messages and channel content. Where a customer connects an external mailbox, message content and metadata synced from that mailbox.

2.7 Usage and security telemetry

Pages visited, features used, session start and end, and error reports. Administrative and security-relevant actions are recorded in an audit log. That log is a security record, not a complete record of every action taken in the Platform.

3. Automated evaluation and scoring of individuals

This is the most important disclosure in this policy. Read it before enabling any feature that produces an assessment about a person.

Where your organisation enables the relevant paid features, Akovex generates automated assessments about identifiable people. We disclose them individually because several US jurisdictions now require it.

Feature	What it produces	Inputs
Interview scoring	Eight dimension scores (0-10) and an overall label of strong-hire / hire / consider / no-hire	The interview transcript, analysed both by keyword-frequency heuristics and by a third-party large language model
Employee evaluations	A 0-100 score, an A-F letter grade, a risk band, and a written recommendation which can include "formal warning" or "probation review"	Praise, concern, issue and reprimand signals; task activity
Contribution Value Score (CVIE)	A 0-1000 score, a performance tier, automatic pay-raise percentage recommendations, and algorithmic allocation of bonus pools into named per-person dollar amounts	Weighted contribution events across eight dimensions, with time decay
Attrition / flight-risk scoring	A 0-100 flight-risk score and a band of critical / high / moderate / low for every active person, plus suggested interventions	Tenure, contribution score, engagement survey sentiment, promotion and compensation history, manager changes
Work-product evaluation	An approved / needs-revision / incomplete verdict and a 0-100 score on an individual's submitted work	The work product itself, judged by a large language model
Composite scorecards and leaderboards	Company-wide ranking of individuals by composite score	Component scores above

What we tell you plainly:

These outputs are advisory. They are not decisions and must not be the sole basis for a hiring, promotion, discipline, compensation or termination decision.
Today the Platform does not technically prevent a customer from acting on these outputs without human review. Only the compensation recommendation has a built-in manager approve / reject / defer gate. The others do not. A human-approval gate for the remaining features is on our engineering roadmap. We state this rather than imply a safeguard that is not there.
The customer, as employer, is the deployer of these tools and is responsible for the notices, consents, bias auditing and recordkeeping its jurisdiction requires. See the MSA, section 8.
The interview scoring feature scores "collaboration" and "culture" partly by counting keywords in speech. We do not recommend using it as a screening tool, and it should not be enabled without employment-counsel review.

Your rights regarding these assessments. If you are an employee or candidate of an Akovex customer, you may ask that customer for an explanation of any score about you. For the CVIE score, the Platform can produce a full per-dimension trace showing the contributing events, points and sources, and we will help the customer produce it.

Opt-out. You may ask to be excluded from automated scoring by writing to [email protected], and your organisation's administrator may make the same request on your behalf. This is handled manually by our team today. There is no self-service setting for it in the Platform. A per-person in-product control is in development, and this policy will be updated when it ships. We will not describe a control as available before it is.

4. AI processing and who receives your data

When AI features are used, the relevant content is transmitted to a third-party model provider for processing and the result returned. Specifically:

Interview transcripts, including the candidate's words, are sent to an external language model provider for scoring.
An individual's submitted work product is sent to an external language model provider for evaluation.
Meeting transcripts are sent for summarisation, action-item extraction and sentiment analysis.
General assistant, drafting and analysis features send whatever content you supply to them.

Requests are routed across providers by a cost-tiering router, which may select a locally hosted model, a lower-cost API model, or a higher-capability API model depending on the task. The provider that receives a given request is therefore not fixed. The full list of AI providers we may use is in the DPA subprocessor annex.

We do not authorise our AI providers to train their models on customer content. The exact protection depends on each provider's enterprise terms; we maintain the current position in the DPA rather than restating it here, so that it cannot go stale.

Do not enter into AI features any information that is legally privileged, subject to a confidentiality obligation that forbids disclosure to a subprocessor, protected health information, or data you are not authorised to send to a third-party AI service.

The Platform can record meetings and interviews and produce transcripts, per-speaker statistics and AI summaries.

We state this plainly because it is a legal trap: the Platform does not currently capture or store participant consent to recording. There is no consent field, no consent prompt and no stored acknowledgement in any meeting or interview module.

Consequences for our customers. Utah, where we operate, is a one-party-consent state. Many states are not — California, Illinois, Washington, Pennsylvania, Florida, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Connecticut, Delaware and Oregon require all parties to consent. Illinois imposes additional, specific duties on AI-analysed video interviews, including advance notice, an explanation of what the AI evaluates, consent, and destruction within 30 days of an applicant's request.

Until in-product consent capture ships, the customer is solely responsible for obtaining every consent the law requires before enabling recording. We recommend customers announce recording verbally at the start of every session and obtain written candidate consent before any recorded interview.

6. Why we process personal information

To provide, operate, secure and support the Platform; to authenticate users and prevent abuse; to process billing; to generate the features the customer has enabled; to communicate about the account; and to comply with law. As a processor, we act on the customer's documented instructions and do not use customer content for our own purposes.

We do not sell personal information. We do not share it for cross-context behavioural advertising. We do not disclose it to advertising networks.

7. Subprocessors

We disclose the third parties that may receive personal information. The authoritative and maintained list, with the data categories and processing location for each, is Annex B of the Data Processing Agreement. Summary as of this version:

Infrastructure and storage: Hostinger (hosting), Cloudflare (network delivery and offsite encrypted backup storage via R2). AI processing: Anthropic, OpenAI, Z.ai, and locally hosted models. Meetings and media: Zoom, LiveKit, ElevenLabs, fal.ai. Business systems: Stripe (payments), Intuit QuickBooks Online (accounting), AppFolio (property management sync), OpenPhone (voice and SMS), Apollo (lead enrichment), Metricool and the Meta and YouTube publishing APIs (social), and our outbound SMTP provider.

Processing is predominantly in the United States. Several providers operate globally; the per-provider position is recorded in Annex B.

We will maintain this list and give notice of additions as set out in the DPA.

8. Security

We describe only controls that are actually in force. We do not claim certifications we do not hold.

In force: TLS in transit; bcrypt password hashing; optional TOTP two-factor authentication; session cookies set httpOnly, sameSite=lax and secure in production; role-based access control with per-brand scoping and per-row ownership checks; AES-256 encryption at rest for financial account details, date of birth and stored integration credentials; an audit log of administrative and security-relevant actions; automated database backups replicated offsite to encrypted Cloudflare R2 storage, retaining the most recent 30 backups.

What we do not claim. We hold no SOC 2 report and no ISO 27001 certification. Tenant separation in production is enforced at the application layer; database-level row-level security is implemented in the codebase but is not active in the current production configuration. We will not describe our isolation as database-enforced until that migration completes.

No system is perfectly secure. See the MSA for incident notification commitments.

9. Retention and deletion

Account data is retained while the account is active.

How deletion actually works today. We describe this precisely rather than in the abstract, because the mechanics matter:

Deleting a person deactivates the record; it does not erase it. The record is flagged as archived, sign-in access is revoked, and the row is retained so that an administrator can restore it. Irreversible erasure is available, but it is performed manually by our team on written request. We previously stated that "the account record is removed". That was not accurate, and it has been corrected.
Requests are fulfilled manually. There is no automated request intake, identity-verification step or fulfilment tracking in the Platform. Each step is performed by a person. We still commit to the 30-day window below; we simply do not want you to assume it is automated.
The retention periods shown inside the product are targets, not automated guarantees. The compliance module displays retention periods, but no job currently enforces them automatically. Treat them as our policy, not as a mechanism.

What we do commit to. On written request to [email protected] we will, within 30 days of verifying your identity: confirm what personal information we hold about you; provide a copy in the formats we can produce; and delete or irreversibly anonymise the personal information we are not required to retain, performing each step manually where automation does not yet exist. We will tell you specifically what we must retain and why.

What is retained regardless. Records we are legally required to keep — invoices, payment and tax records, payroll records, signed agreements, and security and audit logs — are retained for the period applicable law requires. Backups rotate on their own schedule (most recent 30 retained), so data may persist in backups for a period after deletion from the live system.

Post-termination. See the Terms of Service, section on termination, for the data export window. Note the current limitation described there.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete or obtain a portable copy of your personal information, to opt out of sale or sharing (we do neither), to limit the use of sensitive personal information, and to be free from discrimination for exercising these rights.

California residents. Under the CCPA as amended by the CPRA, "consumer" includes employees, job applicants and contractors. If your employer uses Akovex, that employer is the business responsible for your rights request; we support them as their service provider. We do not sell or share personal information as those terms are defined. Section 3 of this policy is our disclosure of automated decision-making technology; California's ADMT rules phase in with compliance required from 2027-01-01, and we are building to them.

How to exercise a right. If you are an Akovex account holder, contact us directly. If you are an employee, candidate or contact of an Akovex customer, contact that organisation; we will assist it. Requests are handled manually today (see section 9).

Appeals. If we decline a request, you may reply asking for review, and where your state provides it, complain to your state Attorney General.

11. Cookies

One cookie, and it is the one that signs you in. The Akovex application sets exactly one cookie: a first-party session cookie named connect.sid. It is created only after you sign in, it exists solely to keep you signed in, and it is set httpOnly, sameSite=lax and secure in production. Because it is strictly necessary to deliver a service you have asked for, it is exempt from cookie-consent requirements under EU and UK law. We therefore do not ask your permission for it and we do not put it behind a consent banner: withholding it would not protect you, it would simply stop you signing in.

Nothing else is stored on your device. The application sets no advertising cookie, no cross-site tracking cookie, no analytics cookie and no third-party cookie of any kind. No third-party analytics or advertising script runs in the application, and no analytics provider appears in our subprocessor list because we do not use one. The marketing website at akovex.com sets no cookies.

How we measure product usage instead. Usage measurement is first-party and happens on our servers, not on your device. While you are signed in, the Platform records which area of the product and which page a request reached, the action, and whether the request came from a phone or a desktop, and writes that to the same database that holds your organisation's other records. There is no cookie, no advertising identifier and no device fingerprint involved, and no third party receives it, so none of it can follow you to any other website. These usage records are pruned on a rolling 90-day window by a scheduled maintenance job.

If any of this changes. We will not introduce a non-essential cookie, tracking tag or third-party analytics tool without first presenting a consent request, obtaining consent where the law requires it, and updating this section together with our subprocessor list in the same change. The session cookie described above would never be placed behind that gate, because it is strictly necessary and consent-exempt.

Our marketing website may use privacy-preserving, self-hosted analytics. Where it does, that analytics is first-party, is not shared with an advertising network, and does not set cross-site tracking cookies. If we deploy analytics that requires consent under EU law, we will present a consent mechanism before it runs.

12. Children

The Platform is a business tool and is not directed to anyone under 16. We do not knowingly collect information from children. Customers must not use the Platform to process data about children without their own lawful basis.

13. International users

We operate in the United States and process data there. We do not currently market to or target the European Union or the United Kingdom. If an Akovex customer processes EU or UK personal data in the Platform, the DPA's international transfer terms apply and the customer must tell us, because certain Platform features (in particular the person-scoring features in section 3) carry additional obligations under EU law that we do not currently support.

14. Changes

We will update this policy as the Platform changes. Where a change is material — in particular any change to the categories of data collected, the automated decision features in section 3, or the subprocessor list — we will notify account administrators in advance through the Platform or by email. The version number and date at the top of this document are the operative record.

15. Contact

Akovex, Inc., a Delaware corporation

Privacy contact: [email protected]