Privacy Policy

What this Privacy Policy Covers

This Privacy Policy covers how we treat Personal Data that we gather when you access or use our Services. "Personal Data" means any information that identifies or relates to a particular individual and also includes information referred to as "personally identifiable information" or "personal information" under applicable data privacy laws, rules or regulations. This Privacy Policy does not cover the practices of companies we don't own or control or people we don't manage. Which party is responsible for your Personal Data is explained in the next section.

Who Is Responsible for Your Personal Data

If you create an account or apply to a position directly through the Services, MeritFirst is the sole controller of your Personal Data.

If a Hiring Company (defined below) directs you to take an assessment, MeritFirst and that Hiring Company are joint controllers of your Assessment Data for that assessment and of the identity and contact details we hold for it. Under our arrangement with Hiring Companies, MeritFirst provides you with this Privacy Policy and handles your requests about Assessment Data held on the Services. The Hiring Company is responsible for its own lawful basis for using your Assessment Data in its hiring decisions, for any notice covering Personal Data it holds in its own systems, and for the copies it keeps in its own systems. The full arrangement is Exhibit B to our Company Terms and Conditions. You may also contact the Hiring Company directly about your rights, and it will pass your request to us where it concerns data held on the Services.

If you apply to a Hiring Company through the Services without being directed by it, we disclose your Assessment Data to that Hiring Company, and it is an independent controller of the copy it receives.

Personal Data

Categories of Personal Data We May Collect

We may collect the following categories of Personal Data:

• Device or Web Data. If you interact with us online (e.g., by visiting our website or using our web-based Services), we may collect information about your device and/or browser such as your IP address, IP address-based location data, device ID, and type of device or operating system used to connect with us, and web page interactions and referring webpage/source through which you accessed the Services.
• Contact Data. We may collect your contact information such as your name, email, or phone number.
• Account Data. If you create an account to use our Services, we collect login credentials and other profile data. If you are using a paid Service, our payment processor Stripe, Inc., may collect your payment data including your payment card and billing information. Please note that we only have access to the last 4 digits of your payment card number.
• Professional Related Data. This may include your employer and job title, resume, social media handle, or other related information.
• Sensory Data. This may include photos you upload to the Services.
• Assessment Data. If you take an assessment using our Services, we collect the responses you submit, such as text, code, files, audio, video, screen, or phone-call recordings, and transcripts of those recordings, together with the results, scores, and evaluations we derive from them.
• Other Personal Data that You Choose to Submit or Provide. We may collect other Personal Data that you make available through Services or to us, such as in free-form boxes, questionnaires, emails, or other communications you send us.

Our Commercial or Business Purposes for Collecting Personal Data

Providing, Customizing and Improving the Services

• Creating and managing your account or other user profiles.
• Processing orders or other transactions; billing.
• Providing you with the products, services or information you request.
• Meeting or fulfilling the reason you provided the information to us.
• Providing support and assistance for the Services.
• Improving the Services, including testing, research, internal analytics and product development.
• Personalizing the Services, website content and communications based on your preferences.
• Doing fraud protection, security and debugging.
• Administering assessments.
• Disclosing your Assessment Data to the Hiring Company that directed you to an assessment, or that you applied to through the Services.
• Maintaining the integrity, security, and fairness of our assessments.
• Improving the validity and reliability of our assessments, using aggregated or de-identified data wherever possible.
• Carrying out other business purposes stated when collecting your Personal Data or as otherwise set forth in applicable data privacy laws.

Marketing the Services

• Marketing and selling the Services.

Corresponding with You

• Responding to correspondence that we receive from you, contacting you when necessary or requested, and sending you information about MeritFirst or the Services.
• Sending emails and other communications according to your preferences.

Other Permitted Purposes for Processing Personal Data

In addition, each of the above referenced categories of Personal Data may be collected, used, and disclosed with the government, including law enforcement, or other parties to meet certain legal requirements and enforcing legal terms including: fulfilling our legal obligations under applicable law, regulation, court order or other legal process, such as preventing, detecting and investigating security incidents and potentially illegal or prohibited activities; protecting the rights, property or safety of you, MeritFirst or another party; enforcing any agreements with you; responding to claims that any posting or other content violates third-party rights; and resolving disputes.

We will not collect additional categories of Personal Data or use the Personal Data we collected for materially different, unrelated or incompatible purposes without providing you notice or obtaining your consent.

Legal Bases for Processing (EEA and UK)

If you are in the European Economic Area (EEA) or the United Kingdom, we rely on the following legal bases under the GDPR:

• Performance of a contract. Creating and managing your account, administering assessments you take, disclosing your Assessment Data to the Hiring Company that directed you to an assessment or to which you applied, providing support, billing for paid Services, and delivering the Services you request under our Terms of Use.
• Legitimate interests. Maintaining the integrity, security, and fairness of our assessments; fraud prevention, security, debugging, and analytics; personalizing the Services and corresponding with you about them; improving the Services and the validity of our assessments; and marketing the Services to Hiring Companies and prospective business customers.
• Legal obligation. Complying with applicable law, legal process, and requests from public authorities.
• Consent. Marketing emails to you where the law requires consent. You may withdraw consent at any time without affecting processing that took place before you withdrew it.

You are not legally required to give us Personal Data. Some of it is needed to create your account and to score and deliver an assessment, and without it we cannot provide those Services.

Automated Decision-Making and Profiling

We use automated tools, including AI models, to score assessment responses and to prepare summaries for the Hiring Company. Each answer is scored against criteria the Hiring Company sets or approves for that question. AI models grade written answers, code, uploaded documents, and transcripts of spoken answers, and multiple-choice answers are checked against an answer key. Phone-call scoring also uses basic call statistics such as talk time. We do not analyze video images, faces, or voice characteristics. The Hiring Company may use your scores to decide who moves to the next stage. MeritFirst does not make hiring decisions. Hiring Companies have agreed not to use scores as the sole or predominant basis for a hiring decision. The Hiring Company decides how to use your results alongside its own process, and any request for human review of a decision, or to contest it, should go to the Hiring Company.

Categories of Sources of Personal Data

We collect Personal Data about you from the following categories of sources:

You

• When you provide such information directly to us.
• When you create an account or use our interactive tools and Services.
• When you voluntarily upload information into the Services, provide information in free-form text boxes through the Services or through responses to surveys or questionnaires.
• When you send us an email or otherwise contact us.
• When you use the Services and such information is collected automatically.
  • Through Cookies (defined in the "Cookies" section below).
  • If you download and install certain applications and software we make available, we may receive and collect information transmitted from your computing device for the purpose of providing you the relevant Services, such as information regarding when you are logged on and available to receive updates or alert notices.

Third Parties

• Vendors. We may obtain business contact details for Hiring Company contacts from lead vendors.
• References. If you provide employment references, we may verify the reference and include some content and/or information in the references in your user profile.
• Hiring Companies. We may receive certain Personal Data from the hiring company who directed you to use the Services as part of your application, or that you choose to submit an application to using the Services ("Hiring Company").

How We Disclose Your Personal Data

We disclose your Personal Data to the categories of service providers and other parties listed in this section. Depending on state laws that may be applicable to you, some of these disclosures may constitute a "sale" of your Personal Data. For more information, please refer to the state-specific sections below.

• Service Providers. These parties help us provide the Services or perform business functions on our behalf. They include:
  • Hosting, technology and communication providers.
  • AI and machine learning providers, which may not use your data to train their own models.
  • Analytics providers for web traffic or usage of the site.
  • Security and fraud prevention consultants.
  • Support and customer service vendors.
  • Payment processors.
    • Our payment processing partner Stripe, Inc. ("Stripe") collects your voluntarily-provided payment card information necessary to process your payment.
    • Please see Stripe's terms of service and privacy policy for information on its use and storage of your Personal Data.
• Business Partners. These parties partner may include:
  • Businesses that you have a relationship with.
  • Hiring Companies, with whom we disclose your Assessment Data (your responses and results) when they directed you to an assessment or you applied to them through the Services.
• Parties You Authorize, Access or Authenticate.
  • Third parties you access through the Services or otherwise authorize.

Legal Obligations

We may disclose any Personal Data that we collect with third parties in conjunction with any of the activities set forth under "Other Permitted Purposes for Processing Personal Data" section above.

Business Transfers

All of your Personal Data that we collect may be transferred to a third party if we undergo a merger, acquisition, bankruptcy or other transaction in which that third party assumes control of our business (in whole or in part).

Data that is Not Personal Data

We may create aggregated, de-identified or anonymized data from the Personal Data we collect, including by removing information that makes the data personally identifiable to a particular user. We may use such aggregated, de-identified or anonymized data and disclose it with third parties for our lawful business purposes, including to analyze, build and improve the Services and promote our business, provided that we will not disclose such data in a manner that could identify you.

Cookies

Data Security

We seek to protect your Personal Data from unauthorized access, use and disclosure using appropriate physical, technical, organizational and administrative security measures based on the type of Personal Data and how we are processing that data. You should also help protect your data by appropriately selecting and protecting your password and/or other sign-on mechanism; limiting access to your computer or device and browser; and signing off after you have finished accessing your account. Although we work to protect the security of your account and other data that we hold in our records, please be aware that no method of transmitting data over the internet or storing data is completely secure.

Where Your Personal Data Is Processed

MeritFirst is based in the United States, and your Personal Data is stored and processed on servers located in the United States, including by the service providers described above. While your Personal Data is outside your home jurisdiction (including Canada), it is subject to the laws of the United States and may be accessible to courts, law enforcement, and regulatory authorities there under those laws. Wherever your Personal Data is handled, we protect it using contractual and security safeguards designed to provide a comparable level of protection.

The United States is not covered by an EU or UK adequacy decision that applies to our processing. If you are in the EEA, the United Kingdom, or Switzerland, and the GDPR treats our processing as an international transfer, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum, where applicable) with the service providers that process your Personal Data on our behalf. Where we disclose your Assessment Data to a Hiring Company located outside the EEA, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum, where applicable), which are incorporated into our agreement with that Hiring Company. You may request a copy of the relevant clauses by contacting us as described under "How to Reach Us."

Data Retention

We retain Personal Data about you for as long as necessary to provide you with our Services or to perform our business or commercial purposes for collecting your Personal Data. When establishing a retention period for specific categories of data, we consider who we collected the data from, our need for the Personal Data, why we collected the Personal Data, and the sensitivity of the Personal Data. In some cases we retain Personal Data for longer, if doing so is necessary to comply with our legal obligations, resolve disputes or collect fees owed, or is otherwise permitted or required by applicable law, rule or regulation. We may further retain information in an anonymous or aggregated form where that information would not identify you personally.

Where we have used Personal Data in an evaluation or recommendation about you, including Assessment Data, we retain that information for at least 12 months following the relevant decision so that you can access it and exercise your rights, after which it is deleted, de-identified, or anonymized in accordance with our retention schedule.

Personal Data of Children

As set out in our Terms of Use, the Services are not directed to individuals under 16 years of age, and users confirm they are at least 16 by registering for or using the Services. If we learn that we have collected Personal Data from an individual under 16, we will take prompt steps to delete it. To report a concern, contact team@meritfirst.us.

Your Rights

You may ask us, in writing, whether we hold Personal Data about you, how we have used it, and to whom we have disclosed it, and you may request a copy. We will respond within 30 days of receiving your request, or within such extended period as applicable law permits for complex requests, and may need to verify your identity first.

If your Personal Data is inaccurate or incomplete, you may ask us to correct it; if we do not agree that a correction is warranted, we will record your challenge alongside the information.

In limited cases, applicable law permits or requires us to withhold information, for example where a record would reveal Personal Data about another individual or confidential commercial information. Where an exception applies, we will sever the protected information, provide the remainder, and explain the basis for withholding.

If you are in the EEA or the United Kingdom, you also have the right to request erasure of your Personal Data, to restrict its processing, to object to processing based on legitimate interests (including profiling), to receive the Personal Data you provided to us in a portable format, and to withdraw any consent you have given. You may object at any time to the use of your Personal Data for direct marketing, and we will stop. You can exercise these rights by contacting us as described under "How to Reach Us." You also have the right to lodge a complaint with your local supervisory authority.

Other State Law Privacy Rights

California Resident Rights

Under California Civil Code Sections 1798.83-1798.84, California residents are entitled to contact us to prevent disclosure of Personal Data to third parties for such third parties' direct marketing purposes; in order to submit such a request, please contact us at team@meritfirst.us.

Your browser may offer you a "Do Not Track" option, which allows you to signal to operators of websites and web applications and services that you do not wish such operators to track certain of your online activities over time and across different websites. Our Services do not support Do Not Track requests at this time. To find out more about "Do Not Track," you can visit www.allaboutdnt.com.

Nevada Resident Rights

Please note that we do not currently sell your Personal Data as sales are defined in Nevada Revised Statutes Chapter 603A.

EU and UK Representatives

If you are located in the European Economic Area (EEA) or the United Kingdom, we have appointed representatives under Article 27 of the EU General Data Protection Regulation (GDPR) and the UK GDPR. You may contact the relevant representative below regarding any matter related to our processing of your Personal Data, including to exercise your rights or to raise a concern. You may also lodge a complaint with your local supervisory authority.

European Union Representative

United Kingdom Representative

Data Protection Officer

How to Reach Us

If you would like to ask about, make a request relating to, or complain about how we process your personal information, please contact team@meritfirst.us, or mail us at the address below.