lizzyAI - Privacy Policy
Last updated on: 2026-05-27
At lizzyAI, we take your privacy seriously. Please read this Privacy Policy to learn how we treat Personal Data. This Privacy Policy explains how we collect, use, disclose, retain, and protect Personal Data when you access or use our Services, visit our website, communicate with us, or participate in an interview through our Services.
Where we rely on consent, we will request it separately and clearly. Your use of the Services does not, by itself, mean that we rely on consent as the legal basis for every processing activity described in this Privacy Policy. In particular, where lizzyAI processes candidate Personal Data on behalf of a hiring organization or other customer, lizzyAI generally acts as a processor or subprocessor and processes that data in accordance with the customer’s documented instructions, the applicable agreement, and applicable privacy laws.
You may print a copy of this Privacy Policy by using the “Print” function in your browser.
This Privacy Policy covers how we treat Personal Data that we gather when you access or use our Services. “Personal Data” means any information that identifies or relates to a particular individual and also includes information referred to as “personally identifiable information” or “personal information” or “sensitive personal information” under applicable data privacy laws, rules or regulations. This Privacy Policy does not cover the practices of companies we don't own or control, or people we don't manage. Please note that we may collect or process your Personal Data in service to our Customers.
Where lizzyAI processes Personal Data on behalf of a customer under a Data Processing Addendum (DPA), that Data Processing Addendum governs lizzyAI’s processor or subprocessor obligations to the customer. If there is a conflict between this Privacy Policy and the applicable Data Processing Addendum regarding Personal Data processed on behalf of a customer, the Data Processing Addendum will take precedence over the Privacy Policy.
This section applies if you are a job candidate, applicant, interview participant, or other individual whose Personal Data is processed through lizzyAI in connection with a customer’s recruitment, hiring, assessment, or interview process.
Role of lizzyAI and the customer: Where you participate in an interview or recruitment process through lizzyAI for one of our customers, the customer is generally the controller of your candidate Personal Data, and lizzyAI acts as the customer’s processor or, where the customer acts as a processor for another controller, as a subprocessor. In that role, lizzyAI processes candidate Personal Data only to provide the Services to the customer, for the purposes described in the applicable agreement and Data Processing Addendum, and in accordance with the customer’s documented instructions, unless applicable law requires otherwise. The customer is responsible for providing any additional privacy notice required for its recruitment process, including information about the customer’s identity, lawful basis, retention decisions, hiring decision-making, and any other processing that the customer determines or conducts outside the lizzyAI Services.
How candidate data is used: Candidate Personal Data is processed to deliver and manage the interview and recruitment workflow. This may include receiving, collecting, accessing, storing, structuring, temporarily caching, analyzing, scoring, summarizing, protecting, returning, and deleting candidate Personal Data as necessary to provide the Services. Candidate data may be made available to the customer through dashboards, APIs, notifications, reports, transcripts, scorecards, or similar service functionality, and may be processed by authorized subprocessors under contract where necessary to provide the Services.
SMS and WhatsApp candidate communications: Where enabled by the customer and selected, requested or consented to by the candidate, lizzyAI may process candidate Personal Data to send SMS or WhatsApp communications related to the candidate’s active recruitment or interview process. These communications may include interview invitations, reminders, scheduling updates, interview logistics, and related service messages. SMS and WhatsApp communications are not used by lizzyAI for marketing campaigns, general job promotions, passive sourcing, or cold outreach. Candidates will be provided with support information by replying “HELP” to an SMS or WhatsApp message. Candidates may opt out of SMS or WhatsApp communications as described in the relevant message, including by replying “STOP” to SMS and WhatsApp messages. SMS message frequency varies based on the candidate’s active interview or recruitment process. Message and data rates may apply. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes.
Where required or appropriate, the customer or lizzyAI will provide an alternative communication method.
Limits on candidate data use: Where lizzyAI processes candidate Personal Data as a processor or subprocessor, lizzyAI will not sell or share that Personal Data. lizzyAI will not retain, use, or disclose that Personal Data outside lizzyAI’s direct business relationship with the customer or for any purpose other than providing the Services to the customer, except as necessary to provide the Services, as instructed by the customer, or as required by applicable law. lizzyAI will not combine candidate Personal Data received from or on behalf of one customer with Personal Data received from or on behalf of another customer, except as necessary to provide the Services or as otherwise instructed by the customer.
Automated analysis and recruiter support: The Services may involve automated analysis of candidate responses, including text or voice-to-text analysis, scoring, summarization, assessment generation, interview notes, interview history, interview duration, scorecards, and related technical, usage, system, or fraud-detection indicators. These outputs are provided to support the customer’s recruitment and decision-making process. The customer remains responsible for determining the lawful basis for the recruitment process, providing required notices, responding to candidate rights requests, and making hiring or employment decisions. lizzyAI does not make final hiring decisions on behalf of the customer, and the customer remains responsible for any decision to advance, reject, hire, or otherwise evaluate a candidate. Candidates should contact the customer if they wish to request human review, express their point of view, contest a recruitment decision, or seek correction of candidate information or assessment outputs.
Candidate rights requests: If you wish to exercise privacy rights in relation to candidate Personal Data processed for a customer, you should contact the customer in the first instance because the customer is generally responsible for responding to such requests. If you submit a request to lizzyAI, lizzyAI will, to the extent permitted by applicable law, notify or direct you to the relevant customer and will reasonably assist the customer in responding to your request where required by applicable privacy laws and the applicable Data Processing Addendum.
Retention and deletion of candidate data: Candidate Personal Data is processed for as long as required to provide the Services to the customer and to perform the applicable rights and obligations under the relevant agreement, or as required by applicable law or regulation. Upon termination or expiration of the applicable agreement, lizzyAI will return or delete candidate Personal Data and existing copies at the customer’s choice, unless further storage is required or authorized by applicable law. Where return or deletion is impracticable or prohibited by law, lizzyAI will block the Personal Data from further processing except to the extent necessary for continued hosting or processing required by law, and will continue to protect it.
Sensitive or special category data: lizzyAI does not require special categories of Personal Data to provide the Services, except where such data is provided or instructed at the sole discretion and responsibility of the customer. Please do not provide sensitive or special category Personal Data during an interview unless the customer has specifically requested it, explained why it is needed, and you understand that it is relevant to the recruitment process.
Important candidate-specific limitation: The purposes listed below apply differently depending on whether lizzyAI acts as a controller or as a processor. Where lizzyAI processes candidate Personal Data on behalf of a customer, lizzyAI processes that data only as necessary to provide the Services to the customer, for the purposes specified in the applicable agreement and Data Processing Addendum, and in accordance with the customer’s documented instructions, unless required by applicable law. The broader purposes below, including marketing, advertising, and general business development, do not apply to candidate Personal Data processed by lizzyAI as a processor or subprocessor, except to the extent permitted by the applicable agreement, the Data Processing Addendum, customer instructions, or applicable law.
We will not collect additional categories of Personal Data or use the Personal Data we collected for materially different, unrelated or incompatible purposes without providing you notice or obtaining your consent.
We may share your Personal Data to the categories of service providers and other parties listed in this section. For more information, please refer to the state-specific sections below.
Candidate data sharing limitation: Where lizzyAI processes candidate Personal Data as a processor or subprocessor for a customer, lizzyAI does not sell or share that Personal Data. lizzyAI does not retain, use, or disclose candidate Personal Data outside lizzyAI’s direct business relationship with the customer or for purposes unrelated to providing the Services to that customer, except as permitted by the applicable agreement, the Data Processing Addendum, or applicable law. lizzyAI does not combine candidate Personal Data received from or on behalf of one customer with Personal Data received from or on behalf of another customer, except as necessary to provide the Services or as otherwise instructed by the customer.
List of service providers and other parties:
Where service providers or subprocessors process candidate Personal Data on behalf of lizzyAI, they do so to help provide the Services, under contractual obligations designed to protect the Personal Data. lizzyAI remains responsible to the customer for the performance of authorized subprocessors’ data protection obligations as set out in the applicable Data Processing Addendum.
Legal Obligations: We may disclose any Personal Data that we collect with third parties in conjunction with any of the activities set forth under “Other Permitted Purposes for Processing Personal Data” section above.
Business Transfers: Personal Data may be transferred to a third party in connection with a merger, acquisition, bankruptcy, reorganization, financing, sale of assets, or similar corporate transaction. Where such Personal Data includes candidate Personal Data processed by lizzyAI as a processor or subprocessor for a customer, any transfer remains subject to the applicable agreement, Data Processing Addendum, customer instructions, and applicable privacy laws. Such candidate Personal Data may not be used by the recipient for unrelated purposes merely because of the corporate transaction.
Aggregated, de-identified, anonymized, and pseudonymized data: We may create aggregated, de-identified or anonymized data from the Personal Data where permitted by applicable law, the applicable agreement, and, where relevant, the Data Processing Addendum. Where this involves candidate Personal Data processed on behalf of a customer, lizzyAI will do so only as permitted by the applicable agreement, the Data Processing Addendum, customer instructions, and applicable law. We will not disclose such data in a manner that identifies a candidate. Where training or test datasets are used for improving internal models, lizzyAI applies pseudonymization where feasible and permitted and does not store identifiable audio or video content for that purpose.
Candidate interview data and advertising cookies: Advertising and retargeting cookies are used in connection with our marketing website. They are not used to collect, infer, disclose, or target advertising based on candidate interview content, transcripts, assessments, scorecards, or other candidate Personal Data processed by lizzyAI as a processor or subprocessor for a customer.
The Services use cookies and similar technologies such as pixel tags, web beacons, clear GIFs and JavaScript (collectively, “Cookies”) to enable our servers to recognize your web browser, tell us how and when you visit and use our Services, analyze trends, learn about our user base and operate and improve our Services. Cookies are small pieces of data– usually text files – placed on your computer, tablet, phone or similar device when you use that device to access our Services. We may also supplement the information we collect from you with information received from third parties, including third parties that have placed their own Cookies on your device(s).
Please note that because of our use of Cookies, the Services do not support “Do Not Track” requests sent from a browser at this time.
We use the following types of Cookies:
You can decide whether or not to accept Cookies through your internet browser's settings. Most browsers have an option for turning off the Cookie feature, which will prevent your browser from accepting new Cookies, as well as (depending on the sophistication of your browser software) allow you to decide on acceptance of each new Cookie in a variety of ways. You can also delete all Cookies that are already on your device. If you do this, however, you may have to manually adjust some preferences every time you visit our website and some of the Services and functionalities may not work.
To explore what Cookie settings are available to you or to modify your preferences with respect to Cookies, you can access your Cookie management settings through the cookie banner or cookie preferences link available on our website. To find out more information about Cookies generally, including information about how to manage and delete Cookies, please visit http://www.allaboutcookies.org/ or https://ico.org.uk/for-the-public/online/cookies/ if you are located in the European Union.
Information about Interest-Based Advertisements: We may serve advertisements to you on third party platforms based on your visit to our marketing website. These advertisements may be targeted to visitors who fit certain general profile categories or display certain preferences or behaviors (“Interest-Based Ads”). Information for Interest-Based Ads (including Personal Data) may be provided to us by you, or derived from the usage patterns of particular users on our marketing website and/or services of third parties. Such information may be gathered through tracking users' activities across time and unaffiliated properties, including when you leave our Services. To accomplish this, we or our Advertising Partners may deliver Cookies to you through our marketing website. These Cookies may enable third parties, including our Advertising Partners, to serve targeted advertisements to you when you visit other websites. Interest-Based Ads are based on visits to our marketing website and are not based on candidate interview content, transcripts, assessments, scorecards, or other candidate Personal Data processed by lizzyAI as a processor or subprocessor for a customer.
We seek to protect your Personal Data from unauthorized access, use and disclosure using appropriate physical, technical, organizational and administrative security measures based on the type of Personal Data and how we are processing that data. You should also help protect your data by appropriately selecting and protecting your password and/or other sign-on mechanism; limiting access to your computer or device and browser; and signing off after you have finished accessing your account. Although we work to protect the security of your account and other data that we hold in our records, please be aware that no method of transmitting data over the internet or storing data is completely secure.
We retain Personal Data for as long as necessary for the purposes described in this Privacy Policy, including to provide the Services, comply with legal obligations, resolve disputes, enforce agreements, maintain security, and carry out lawful business purposes.
Candidate Personal Data: Where lizzyAI processes candidate Personal Data as a processor or subprocessor for a customer, lizzyAI processes and retains that data for as long as required to provide the Services to the customer and perform the rights and obligations under the applicable agreement and Data Processing Addendum, or as required by applicable law or regulation. Candidate Personal Data may also be retained according to the customer’s configuration, instructions, or applicable retention requirements. Because retention periods may be configured or determined by the customer, candidates should contact the customer for information about the specific retention period applicable to their recruitment process.
Upon termination or expiration of the applicable agreement, lizzyAI will, at the customer’s choice, return or delete candidate Personal Data and existing copies, unless further storage is required or authorized by applicable law. If return or deletion is impracticable or prohibited by law, lizzyAI will take measures to block the candidate Personal Data from further processing, except to the extent necessary for continued hosting or processing required by law, and will continue to protect the data.
We may retain information in aggregated, anonymized, de-identified, or pseudonymized form where permitted by applicable law and where the information does not identify you.
As noted in the Terms, we do not knowingly collect or solicit Personal Data from children under 16 years of age; if you are a child under the age of 16, please do not attempt to register for or otherwise use the Services or send us any Personal Data. If we learn we have collected Personal Data from a child under 16 years of age, we will delete that information as quickly as possible. If you believe that a child under 16 years of age may have provided Personal Data to us, please contact us at privacy@lizzy-ai.com.
California Resident Rights: Under California Civil Code Sections 1798.83-1798.84, California residents are entitled to contact us to prevent disclosure of Personal Data to third parties for such third parties' direct marketing purposes; in order to submit such a request, please contact us at privacy@lizzy-ai.com.
Nevada Resident Rights: If you are a resident of Nevada, you have the right to opt-out of the sale of certain Personal Data to third parties. Please note that we do not currently sell your Personal Data as sales are defined in Nevada Revised Statutes Chapter 603A.
If you are a resident of the European Union (“EU”), United Kingdom (“UK”), Lichtenstein, Norway or Iceland, you have certain rights over your Personal Data under the EU or UK General Data Protection Regulation (the “GDPR”), as outlined below. If you have any questions about this section or whether any of the following applies to you, please contact us at privacy@lizzy-ai.com.
Please note that where we process candidate Personal Data on behalf of a customer, we generally act as the customer’s processor or subprocessor. In that case, the customer is generally responsible for responding to privacy rights requests. If you are a candidate and wish to exercise rights in relation to a recruitment or interview process, you should contact the hiring organization or other customer in the first instance. If you submit a request to lizzyAI, we will, to the extent permitted by applicable law, notify or direct you to the relevant customer and will reasonably assist the customer in responding to your request where required by applicable privacy laws and the applicable Data Processing Addendum.
Personal Data Use and Processing Ground: The “Our Purposes for Collecting Personal Data” section above explains how Personal Data may be used. The applicable lawful basis depends on the context and on whether lizzyAI acts as a controller, processor, or subprocessor.
Where lizzyAI acts as a processor or subprocessor for candidate Personal Data: Where lizzyAI processes candidate Personal Data on behalf of a customer, the customer is generally responsible for determining the lawful basis for the processing, providing required privacy notices, obtaining any required consents or permissions, and responding to data subject requests. lizzyAI processes such candidate Personal Data in accordance with the customer’s documented instructions, the applicable agreement, the Data Processing Addendum, and applicable law.
Where lizzyAI acts as a controller: Where lizzyAI acts as a controller, we process Personal Data only where we have a lawful basis to do so. Lawful bases may include:
For candidate Personal Data processed by lizzyAI as a processor or subprocessor, the broader controller purposes listed above do not permit lizzyAI to sell or share candidate Personal Data, use it for unrelated marketing, use it outside lizzyAI’s direct business relationship with the customer, or combine it with Personal Data from other customers, except as permitted by the applicable agreement, Data Processing Addendum, customer instructions, or applicable law.
EU, UK and Swiss Data Subject Rights: You have certain rights with respect to your Personal Data, including those set forth below. For more information about these rights, or to submit a request, please email us at privacy@lizzy-ai.com. Please note that in some circumstances, we may not be able to fully comply with your request, such as if it is frivolous or extremely impractical, if it jeopardizes the rights of others, or if it is not required by law, but in those circumstances, we will still respond to notify you of such a decision. In some cases, we may also need you to provide us with additional information, which may include Personal Data, if necessary to verify your identity and the nature of your request.
Questions about recruitment decisions or assessment outputs: The Services may generate interview-related outputs such as transcripts, summaries, assessments, scorecards, and related indicators to support the customer’s recruitment process. Because the customer is generally responsible for the recruitment process and any hiring decision, questions, objections, correction requests, or challenges relating to recruitment decisions or assessment outputs should be directed to the customer in the first instance. lizzyAI will reasonably assist the customer in responding to such requests where required by applicable privacy laws and the applicable Data Processing Addendum.
Transfers of Personal Data: lizzyAI and its authorized subprocessors may process Personal Data in countries other than the country where you are located. Where lizzyAI processes Personal Data under the Data Processing Addendum, Personal Data may be transferred outside the EEA, UK, or Switzerland as necessary to provide the Services, provided that, at the customer’s election, lizzyAI will store Personal Data in the EEA. Where Personal Data protected by the GDPR, UK GDPR, or Swiss data protection law is transferred to a country that is not subject to an applicable adequacy decision, lizzyAI will use appropriate safeguards in accordance with applicable privacy laws. These safeguards may include the EU Standard Contractual Clauses, the UK Addendum, the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, the Swiss-U.S. Data Privacy Framework, or other lawful transfer mechanisms, as applicable.
Where lizzyAI receives a legally binding government access request for Personal Data processed under the Data Processing Addendum, lizzyAI will handle that request in accordance with the applicable agreement, Data Processing Addendum, and applicable law, including by attempting to redirect the requesting authority to the customer and notifying the customer where legally permitted.
If you have any questions or comments about this Privacy Policy, the ways in which we collect and use your Personal Data or your choices and rights regarding such collection and use, please do not hesitate to contact us at:
Individuals and the data protection supervisory authorities in the EU/EEA and individuals and the data protection supervisory authority ("ICO") in the UK may also contact our data protection representatives according to Article 27 GDPR/GDPR UK: