Eneya
Privacy Policy
Last updated: 27 July 2026
This Privacy Policy explains how Eneya (“we”, “our”, “us”) collects, uses, and protects your personal information when you use our platform and related services.
Eneya is a privately operated digital service based in the EU.
For privacy inquiries, subscription requests, or data-deletion questions, contact us at: eneya@eneya.app
1. Who this policy is for
Eneya is used by two different groups of people, and we handle their data differently.
Recruiters create an account and use Eneya to build questionnaires and review results.
Candidates never create an account. They receive a private link from a recruiter, answer the questions, and submit. A candidate’s relationship is with the recruiter who invited them; Eneya processes their answers on that recruiter’s behalf.
2. What we collect
From recruiters
When you sign in with Google, we receive and store your name, email address, profile picture URL, and a stable identifier provided by Google. We do not receive or store your Google password.
We also store what you create in the product: questionnaires, the roles they describe, candidate records you add, and the decisions you record.
From candidates
We store the answers you write, the name and email address the recruiter entered for you, and the following information about how the response was produced:
- how long you spent on the form in total, and on each individual answer;
- how many times text was pasted into the form.
Why this matters: these signals are used to estimate whether answers were written by you or copied from elsewhere. A high suspicion score limits the evaluation result. They are not a hidden metric — they influence the outcome, which is why we state them here.
We do not use advertising cookies, tracking pixels, or third-party analytics. The only cookie we set is a sign-in session cookie for recruiters. Candidates are not given a cookie.
3. How answers are evaluated
Answers are sent to a large language model, which returns a level of evidence for each competency and written comments. Scores and the final verdict are calculated by our own code from those levels, not by the model.
A person makes the hiring decision, not the model. The result is a recommendation shown to the recruiter, who decides what to do with it. Eneya does not automatically reject, shortlist, or rank candidates, and it does not send decisions to any other system.
Candidates are told before they begin that their answers will be evaluated with the help of AI and that a person makes the decision.
4. Legal basis
For recruiter account data, our basis is performance of a contract — we cannot provide the service without an account.
For candidate answers, the recruiter is the controller and determines the purpose; Eneya acts as a processor on their instructions. The recruiter is responsible for informing candidates and for having a lawful basis for the assessment.
5. Who else processes this data
We use a small number of service providers. Each one is bound by a data processing agreement.
| Provider | Purpose | Location |
|---|---|---|
| Render | Application hosting and database | EU (Frankfurt) |
| Cloudflare | Domain, DNS, and TLS termination | Global edge network |
| Recruiter sign-in (OAuth) | EU / US | |
| Google (Gemini) or Anthropic (Claude) | Evaluation of answers | EU / US |
The evaluation provider is configurable; exactly one is active at any time. If you need to know which one processes your data, contact us.
We do not sell personal data, and we do not share it with anyone outside this list.
6. International transfers
Our application and database are hosted within the European Economic Area. Some providers above are US-incorporated, which means data may be accessible from outside the EEA. Such transfers rely on Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
7. How long we keep data
Candidate answers, evaluations, and the related assignment records are deleted 12 months after the recruiter records a decision, or 12 months after submission if no decision is recorded. Once a candidate has no records left, their name and email address are deleted too.
Recruiter account data is kept while the account is active and deleted within 30 days of an account deletion request.
Archiving a questionnaire or candidate inside the product hides them from lists — it does not delete anything. Deletion happens on the schedule above, or on request.
8. Your rights
If you are in the EEA or UK you have the right to access, correct, or delete your personal data, to restrict or object to processing, and to receive a copy in a portable format.
Candidates: you may ask us to delete your answers at any time by writing to the address above. We will also tell the recruiter who invited you, since they hold their own record of your application.
You also have the right to lodge a complaint with your national data protection authority.
9. Security
Candidate links contain a random token and are the only way to reach a questionnaire — treat yours as private. Links expire, and a recruiter can revoke one at any time. Tokens are removed from our server logs and are not sent to analytics.
Access to answers is limited to the recruiter who created the questionnaire, unless they explicitly generate a read-only share link.
10. Changes to this policy
If we change this policy in a way that affects how your data is used, we will update the date at the top and, where the change is significant, notify account holders by email.