Kira-AILegal

Data processing addendum

Last updated: 29 July 2026

This addendum forms part of the agreement between Kira-AI and each customer using the platform, and governs how Kira-AI processes personal data on the customer’s behalf. In GDPR terms: the customer is the controller, Kira-AI is the processor.

1. What this covers

Kira-AI processes personal data to provide AI voice interviews and the review tools around them while the customer’s account remains open. The data concerned:

  • Data subjects: the customer’s candidates and the customer’s own team members.
  • Categories of data: candidate names and email addresses, interview audio recordings, transcripts, AI-generated summaries and scores, candidate feedback, recruiter notes and account data. No special categories of data are required by the service, and customers agree not to solicit them in interview questions.

2. Instructions

Kira-AI processes personal data only on the customer’s documented instructions — in practice: the configuration of the account, vacancies, and interviews, plus this addendum. Kira-AI does not use candidate data for its own purposes, does not sell it, and does not use it to train models beyond providing the service to the customer. If an instruction would, in Kira-AI’s view, break data protection law, Kira-AI flags it before proceeding.

3. Confidentiality and personnel

Access to customer data inside Kira-AI is limited to personnel who need it to operate or support the service, all bound by confidentiality obligations.

Operator access. The Processor’s authorized personnel may access Customer Data — including candidate interview content — strictly to resolve support issues and to perform the quality-assurance review described below; these are the only two purposes. Every such access is individually logged (actor, operation, timestamp); access records are retained for 24 months and made available to the Customer on reasonable request. Any Processor action that modifies Customer Data is additionally recorded in the Customer’s own activity log.

Vendor quality assurance (post-market monitoring). The Customer instructs the Processor to review samples of interview recordings, transcripts and AI-generated scores for the purpose of monitoring and improving the quality, accuracy and fairness of the AI interview system, including the post-market monitoring expected of high-risk AI systems under the EU AI Act. Such review is purpose-bound and logged as above; candidate data is never repurposed, and no candidate data is used for marketing or model training beyond the scoring of that candidate’s own interview. The Processor contacts candidates only to deliver the interview itself on the Customer’s instruction — the invitation, the email verification code, and the personal link to resume an interview — and never for marketing or on any other customer’s behalf.

4. Security

  • Encryption in transit and at rest
  • Workspace membership controls and tenant isolation between customer accounts
  • Unguessable, revocable interview links; archiving revokes links for interviews that have not started, while an interview already running can finish
  • Append-only audit logging of access and review events
  • Regular review of infrastructure and dependency security

5. Sub-processors

Kira-AI uses a small set of sub-processors to run the service: cloud hosting and storage, speech-to-text and language-model providers, and payment processing (which never touches candidate data). Each is bound by a data processing agreement at least as protective as this one. The current list is available on request; Kira-AI gives notice before adding or replacing a sub-processor, and customers may object on reasonable data protection grounds.

6. Assistance

Kira-AI helps the customer meet its own obligations: the app includes candidate deletion with full cascade (recording, transcript, scores, notes) and audit logs. Requests for access, a copy, correction or restriction have no self-serve mechanism yet and are assembled manually by Kira-AI on request. Where a data subject contacts Kira-AI directly, the request is passed to the customer without undue delay; if the customer does not respond to a forwarded erasure request within 25 days of it being passed on, Kira-AI may execute the erasure itself and records and notifies that it has done so.

7. Breach notification

If Kira-AI becomes aware of a personal data breach affecting the customer’s data, it notifies the customer without undue delay with what is known: the nature of the breach, the data and subjects affected, and the measures taken.

8. International transfers

Where processing involves transfers outside the EU/EEA, they take place under the European Commission’s standard contractual clauses or an equivalent lawful transfer mechanism, applied to Kira-AI and to each sub-processor involved.

9. Deletion and return

During the subscription, candidate and account deletion requests are handled through Kira-AI support on the customer’s documented instruction. Ending or cancelling a subscription does not delete customer data. In operational terms, everything stays accessible in the app while the account is open, the customer exports what they need before closing, deletion on account closure is the committed path, and we assist with return on request. No bulk-export subsystem is promised. On the customer’s documented instruction to close the account, Kira-AI deletes all customer personal data within 30 days, except where law requires longer retention. A tamper-evident record of each deletion — operation identifiers, timestamps, a one-way keyed reference to the erased target, and non-identifying counts and status, containing no personal data — is retained for 24 months as proof of erasure. This Article 28(3)(g) clause remains subject to counsel review before launch.

10. Audits

Kira-AI makes available the information reasonably necessary to demonstrate compliance with this addendum and, where legally required, allows audits by the customer or an agreed independent auditor, with reasonable notice and scope.

Questions about this addendum or a signed copy for your records: support@getkira.com. See also the privacy policy and the candidate consent page.