Privacy Policy

This Privacy Policy describes how Kendor (“we”, “us”) collects, uses and shares personal data when you use our technical hiring platform — as a hiring team member, as a candidate taking an assessment or applying to a job, or as a visitor to our site.

Our role: controller and processor

For candidate data processed as part of an organization’s hiring (assessment submissions, activity signals, recordings, applications and reviewer notes), the hiring organization is the data controller and Kendor acts as its data processor: we process that data on the organization’s instructions. If you are a candidate and want to exercise your rights over screening data, the fastest route is the organization that invited you — we assist them with every request. For account data, self-serve candidate profiles, our website and our communications, Kendor is the controller.

Information we collect

• Account data — name, email, password (stored hashed) and language preference when you create a hiring-team or candidate account; optional candidate-profile fields you choose to add (photo, title, location, links, skills). A hiring-team member can add a profile photo; teammates see it, and it shows on hackathon pages they host. When you create a hiring team, you can also tell us how you heard about Kendor; we use the answer only to learn which channels work. If your verified work email shares its domain with an existing hiring team, we show you that team’s name so you can ask to join it. If you ask, we email your name and email address to its owners; the request is deleted once they approve or decline it.
• Assessment data — the code and answers you submit, files in your assessment workspace, test results, scores, and timing (when you started, finished, or ran out of time).
• Assessment integrity signals — during an assessment we record editor activity such as tab switches, paste events and a typing timeline of your editor session, so reviewers can verify the work is your own. While you work, reviewers can also view the code in your workspace live; that view is read-only and stores nothing beyond your normal auto-saves. Where terminal recording is on for an assessment, what appears in your sandbox terminal is recorded so reviewers can replay it (hidden input, such as a password prompt, is not). Requests you send from the editor’s Requests panel are recorded the same way, with their responses (credentials such as Authorization headers and cookies are not). Where the hiring organization enables proctoring, screen recordings made during the assessment are stored for its reviewers. We tell you before an assessment starts what is captured.
• Job applications — the details you submit on a company’s job posting: name, email, and any optional fields the company requests (headline, location, links, resume link, cover note, answers to its questions). A hiring team can also put you forward for one of its own roles without a new form, using the details it already holds for you — the record says it was added by the team rather than submitted by you.
• Hackathon applications — when you apply to build at, or offer to judge, a hackathon an organization runs on Kendor: your name and email, the fields its form asks for (country, GitHub, LinkedIn, company, company website or LinkedIn page, role, photo), your answers to its questions, the language you applied in, that you accepted its rules, and whether you agreed to share your application with its judging companies. The organization running the hackathon is the controller of this data. Your application only counts once you confirm your email from the link we send. If you judge and choose to be listed, your name, photo, role, company (with its link) and country appear on the hackathon’s public page once the organization accepts you. To come off the page, ask the organization or write to us. Our emails about your application also include a share card: an image with your name, photo (if you added one), country or role and company, and the hackathon. It sits behind a private link only you get, so it is seen only by those you share it with, and it stops working once your application is deleted. If you build, judges score your entry on the published criteria and leave a comment. They see a number, not your name or contact details, while they score. Once a judge submits their scores for your entry, those scores are locked and, if you agreed to share your application with its judging companies, that judge sees your name, country, email and the GitHub, LinkedIn and website links you gave, so they can contact you about jobs. If you didn’t agree, you stay anonymous to judges. If entries tie at the top, judges may also rank them against each other. If you judge, the scores, comments and rankings you give are kept with your application. Both are in your data export.
• Hackathon results — When the organization publishes the results, the hackathon’s public results page shows each ranked entry with its rank, total score and the builder’s name, photo and country (if they gave them), as the hackathon’s rules say. Every builder with an entry gets a personal results link showing their rank, the judges’ average for each criterion and the comments judges chose to share with them; judges decide for each comment whether the builder sees it. From that link you can switch to appearing as “Builder” and your entry number instead of your name, at any time. That choice, and whether each comment was shared, are in your data export.
• Hackathon venue and live watching — If the hackathon has a virtual venue, you get a desk number on its map. If you switch on “Let judges and hosts watch me work live”, the organization’s judges and hosts can watch you while a challenge is in progress: your files (except env files), your terminal, the file you have open and where your cursor is, read-only and under your name. Nothing they see is recorded, and you can switch it off at any time; we keep only when you switched it on. Your desk number and that choice are in your data export.
• Product feedback to Kendor — Kendor may ask people who use it, for now builders after a hackathon, for feedback about the platform through a personal link. Your answers (ratings of Kendor, what you write, whether you would use or recommend Kendor again, and whether we may quote you publicly by your first name) go to Kendor, not to the organization that ran the hackathon. Kendor decides what to do with them and is the controller of this data; we use it to improve the product. You can change your answers for 14 days after the email, and we only quote you if you tick that box. They are in your data export and deleted with your hackathon application.
• Reviewer content — hiring teams write notes, comments, ratings and feedback about submissions and candidates; this is controlled by the hiring organization.
• Emails a hiring team sends you — when a company acknowledges your application, tells you it is not moving forward, makes you an offer or welcomes you aboard, it sends that email through Kendor using its own wording. We keep a record that it was sent — the type of email, its subject, the address it went to, who sent it and when — so the team can see what you were told. We do not keep a copy of the message text. If a team closes your application without writing to you, we record that decision too, marked as not sent; your data export says which it was.
• Live review sessions — when a hiring team invites you to walk through your submission, we process the invite (your email and its expiry) and any comments you write in the review thread. During a live session your display name, the file you have open and your cursor position are relayed to the other participants in real time; these presence signals are not stored. A live session can also carry an audio/video call between you and the reviewers — your microphone and camera stay off until you turn them on, the media is encrypted in transit and is not recorded or stored.
• Interviews a hiring team schedules with you — the time and length of the meeting, its type (intro, technical, team or final), who from the company is joining, the time zone you book in, any request you send for a different time, and the emails about it: the invitation and calendar entry, a booking receipt, a reminder the day before, and — while a time is still unconfirmed — a nudge. Each of those is a message the hiring team can reword; none is marketing. When the interview happens in a Kendor room, the shared whiteboard you and the panel draw on is stored with the interview so the team can look back at it; the room’s chat is not stored at all. In a live coding interview, the code written in the shared sandbox is kept with the interview the same way when it ends. When the organization records sessions, the terminal output and the conversations with AI coding agents (Claude Code, Codex) in that sandbox are kept too; the lobby tells you before you join. Requests sent from the editor’s Requests panel are kept with those recordings, without credentials such as Authorization headers and cookies. The room also notes when you and each interviewer joined and left, and how many characters each of you typed in the shared code. A hiring team can also keep private notes on the interview — what to probe on, and their read afterwards. Those notes, the whiteboard, that code and those recordings are about you, so they are yours to see: they are included in your data export and deleted when you erase your data. The notes are never shown to you inside the product and never sent to you.
• Feedback on our docs — when you answer “Was this article helpful?” on a docs page, we store your yes or no, which article it was about, the language you were reading in, and any note you choose to write. We do not store who you are, your IP address or a cookie with it, so it cannot be linked back to you.
• Usage and log data — basic technical logs (requests, errors, approximate region) kept for security and operations. When something breaks in the app or your browser, we also keep an error report so we can find and fix the bug: where in our code it happened, your browser and operating system, the page address with ids removed, and your account or attempt number. It holds no name, email, IP address, cookies or code you wrote, and it stays on our own server in the EU. We do not run third-party analytics or advertising trackers.
• Usage records — when you work in a Kendor sandbox or join a call, we record when it started and ended against a pseudonymous id, never your name or email, so the hiring organization’s usage can be counted and invoiced.

How we use information, and on what basis

• To run assessments, grade submissions and show results to the hiring team — performance of a contract, and the hiring organization’s legitimate interest in evaluating applicants.
• To capture integrity signals and (where enabled) recordings — the hiring organization’s legitimate interest in verifying assessment authenticity, with notice to you before the assessment begins.
• To operate accounts, send transactional email (invitations, password resets, notifications) and provide support — performance of a contract.
• To secure the platform, prevent abuse and debug faults — legitimate interest.

Cookies

We use strictly necessary and functional cookies: keeping you signed in, remembering your language and your light or dark theme, and carrying an assessment invitation across pages. On our public website pages only — never in the app, in assessments or in interview rooms — we use Microsoft Clarity to understand how visitors use the site: clicks, scrolling and the pages viewed. What you type is never recorded. Clarity sets analytics cookies and Microsoft processes this data on our behalf. Visitors in the EEA, the UK and Switzerland are asked first and Clarity loads only if they accept (legal basis: consent); elsewhere it runs by default (legal basis: our legitimate interest in improving the website). You can change your choice at any time with “Cookie settings” at the bottom of every page. We set no advertising or cross-site tracking cookies.

Sharing and sub-processors

We do not sell personal information. Candidate screening data is shared with the hiring organization that runs the assessment or job posting — that is the service. To operate the platform we use a small set of infrastructure providers acting on our instructions: netcup (hosting, Frankfurt), Amazon Web Services (file and recording storage in Frankfurt, and code-execution servers in the United States and Singapore for candidates in the Americas and Asia-Pacific; its CloudFront network delivers profile photos, logos and cover images from servers worldwide), Mailgun (email delivery, EU region), Cloudflare (DNS/CDN, security and bot checks on our signup, contact and application forms) and LiveKit (live audio/video for review calls — media transits their servers in real time and is not stored). Each is bound by a data-processing agreement — the full list lives at kendor.io/legal/subprocessors. For hiring organizations, our own Data Processing Agreement governs the candidate data we process on their behalf.

When an organization pays for its plan by card, Stripe processes the payment: it receives the billing contact’s name and email address, the company’s billing address and tax ID, and the card details, which go straight to Stripe and never reach Kendor. We keep only the Stripe customer and subscription identifiers and the plan the organization is on. Stripe is headquartered in the United States and certified under the EU–US Data Privacy Framework.

If a hackathon you take part in has a virtual venue, Kendor runs it itself: our own install of the open-source WorkAdventure software, on an Amazon Web Services server in Frankfurt that exists only for the event. The venue’s proximity audio and video go through LiveKit, as review calls do, and are not recorded; proximity chat is not stored. The venue shows your name as it is in Kendor to the people in it, and holds your avatar and where it stands; all of it is deleted with the server after the event. While you build, your avatar also shows whether you’re building or idle, depending on whether you typed or clicked in your bench in the last few minutes; it’s worked out in your browser and shared only with the people in the venue, and Kendor doesn’t store it. Joining is optional.

When a hiring organization enables AI assistants for an assessment, the assistant runs in the candidate’s sandbox terminal under the organization’s own Anthropic or OpenAI account: the code in the workspace and the prompts typed to the assistant are sent to that provider through our infrastructure, on the organization’s instructions and its terms with the provider. Candidates are told before the assessment begins, and the terminal — including the assistant’s work — is visible to reviewers as part of the submission. Where terminal recording is on, we also keep the conversation itself — the candidate’s prompts, the assistant’s replies and the commands it ran — for the organization’s reviewers.

An organization can instead let candidates use their own AI account. The candidate then signs in to their own Claude, ChatGPT, Google (Antigravity), GitHub Copilot, Cline or Cursor account (or uses OpenCode’s free models, which need no account and send the code and prompts to OpenCode) inside the sandbox, and the code and prompts go to that provider under the candidate’s own account and terms, not through our infrastructure. The sign-in stays in the sandbox while the candidate works. When the sandbox restarts, it is carried into the new one: our sandbox servers hold it in memory for at most five minutes and never write it to disk. When the candidate submits a challenge, its sandbox is shut down and the sign-in is held the same way, for at most ten minutes, for the next challenge’s sandbox. It is deleted, and the sandboxes are shut down, when the candidate submits the assessment or its time runs out; neither we nor the organization keep it. Where terminal recording is on, we keep the conversation from the assistant’s own session log in the sandbox, for the organization’s reviewers. Where an assistant keeps its log in a folder that goes away with the sandbox (Antigravity, Gemini CLI), we keep a copy of that folder without its sign-in files and rebuild the conversation from it or from the terminal recording; the copy is part of the candidate’s data export and is deleted with the other recordings.

A hiring organization can also have AI summarise a submitted attempt for its reviewers, under the organization’s own Anthropic or OpenAI account and on its instructions: the challenge brief, the candidate’s code and changes, test results, terminal recordings, assistant conversations, activity signals and written answers are sent to that provider, without the candidate’s name or email address. The summary describes the work, with evidence, for the reviewers; it gives no score or recommendation, and people make every hiring decision. Candidates are told before the assessment begins, or in the lobby before a live coding session. A live coding session can be summarised the same way once it ends: its code, terminal recordings and assistant conversations, with how much each person typed. The summary is kept with the attempt, included in the candidate’s data export and deleted with the attempt.

If the organization turns on the “explain your code” check, right after the submit the candidate’s code changes, the challenge brief and the prompts the candidate gave an AI assistant during that challenge go to the organization’s AI provider, without their name or email address, to write three questions about them. The candidate answers them on the spot, two minutes each, without their editor or AI assistant. What they type is saved as they go, so an answer survives a reload or the time running out. We keep the answers, the time each one took, how many pastes were blocked and how often the candidate left the tab (never any pasted text), and the provider checks each answer against the code. In a hackathon up to five questions are written the same way for the judges instead, and an organizer may record what the builder said when asked. The organization’s reviewers see the questions, answers and checks with the attempt. Candidates and hackathon builders are told before the assessment begins. All of it is in the candidate’s data export and is deleted with the attempt, or after 365 days.

Members of a hiring team can add a job description when they start a new challenge project or import a repository, to have AI draft the challenge. This runs only under the organization’s own Anthropic or OpenAI account; Kendor does not use an account of its own for it. The job description stays in the team member’s browser until drafting starts. It is then sent to that provider to choose a starting project and name the assessment, and written into the author’s own sandbox, where the AI coding agent (Claude Code on Anthropic, Codex on OpenAI) reads it and builds the challenge. Kendor does not store it anywhere else. A job description may name the person who wrote it or give their contact details; no candidate data is ever sent. Any reference solution the agent writes stays in the author’s sandbox and is removed from everything candidates receive. The draft is ordinary assessment content that the organization reviews and publishes before any candidate sees it.

An organization can also import one of its own repositories as a challenge and have AI carve the task out of it. The same AI coding agent reads and edits the repository’s files in the author’s sandbox, so they are sent to the same provider under the organization’s own account. Candidates see the finished challenge, which is built from that repository. When an author asks the AI agent to fix how a challenge runs, it reads the challenge’s files and the recent output of its services, with keys and passwords masked, under the same account. Nothing from candidates’ sandboxes is sent.

Where a hiring organization connects its applicant tracking system (Ashby, Greenhouse or Lever), we receive your email address and the identifiers of your application from it when you are moved into a screening or interview stage, and we send it your invitation status, the time you book for a live coding interview, your score, result, the hiring team’s decision and a link to the review. What we send is copied into the organization’s own system, where the organization controls and erases it; deleting your data at Kendor does not remove that copy.

If you choose to sign in with Google, Google shares your name, email address and Google account ID with us, and we keep the ID to recognise you next time. If your employer has set up single sign-on, its identity provider (such as Okta or Microsoft Entra ID) shares your name and email address with us each time you sign in. We never receive your Google or company password.

Our Slack community

We offer support and a place to talk with other Kendor users in our public Slack workspace. If you join it, we process your Slack profile name, email address and profile photo, and the messages you post in our workspace, to answer your questions and run the community. We do this on the basis of our legitimate interest in supporting the people who use Kendor; for a paying customer’s support requests, the basis is performance of our contract with them.

The workspace runs on Slack, a service of Slack Technologies (part of Salesforce), which holds this data in the United States; the transfer relies on the EU–US Data Privacy Framework. Please don’t share candidates’ personal data in the community, such as names, email addresses, code or results; email it to hello@kendor.io instead.

International transfers

Our infrastructure — application servers, database, code execution and file storage — is located in the European Union (Frankfurt, Germany). For performance, candidates and reviewers located in the Americas run their coding sandbox on servers in the United States (Amazon Web Services, Ohio), and those in Asia-Pacific on servers in Singapore (Amazon Web Services), so the editor and preview respond quickly; the same applies when a hiring organization chooses one of those regions, or briefly when our EU servers are at capacity. What a sandbox produces and that we keep — submissions, recordings — is stored in the EU. That fallback also applies to organizations that chose the EU region, so a sandbox can still start when those servers are full. Where data is processed outside the EU/EEA, or a provider’s corporate structure could involve access from outside it, we rely on the EU–US Data Privacy Framework and Standard Contractual Clauses as safeguards.

Retention

• Account and profile data — kept while your account exists; deleted when you delete your account.
• Assessment submissions and results — kept while the hiring organization’s account retains them, so hiring decisions stay auditable. While you work, we keep a few recent versions of your saved code so it can be recovered after a technical fault; they are deleted with the submission.
• “Explain your code” questions, answers and checks — deleted with the attempt, or 365 days after the check was made.
• Proctoring recordings, editor-session captures, terminal recordings, Requests-panel logs and AI-assistant conversations — deleted automatically 12 months after the assessment.
• Hackathon applications — deleted 7 days after the confirmation link expires if the email is never confirmed; 30 days after the hackathon ends if not accepted; 12 months after it ends if accepted.
• Product feedback to Kendor — deleted together with the hackathon application it was asked through.
• Encrypted database backups — kept for 30 days, then deleted automatically. Data you erase disappears from backups once they age out, and is never brought back by a restore.
• Stored files (submitted code, recordings, uploads) — after they are deleted or replaced, copies stay in our storage backups for up to 7 days, then are permanently removed.
• Unused assessment invitations — deleted 90 days after they expire; password-reset tokens 30 days after they expire.
• Requests to join a hiring team that no owner answers — deleted 90 days after they were sent.
• Sign-in session records — kept while the session can be renewed (30 days of inactivity, refreshed each time you use the site) and deleted 7 days after they expire. Signing out ends them immediately.
• Records of emails a hiring team sent you — deleted 24 months after the email was sent.
• Interviews a hiring team scheduled with you, including the panel’s private notes about the conversation — deleted 24 months after the interview was due to take place.
• Notes left with feedback on our docs — deleted 12 months after they were written. The anonymous yes or no is kept.
• Technical logs (requests and errors, including errors your browser reports to us) — deleted after 14 days.
• Error reports (where our code broke, browser and operating system, page address and your account or attempt number) — deleted automatically after 30 days. This is also how a request to erase them is met, within the one month the law allows.
• Sandbox and call usage records — deleted 24 months after they end. If you ask to be erased, the link to you is removed and only the times are kept.
• Messages you post in our Slack community — deleted automatically 90 days after they are posted. Your profile stays in the workspace while you are a member.

Your rights

Depending on where you live (including under the GDPR), you may have the right to access, correct, export, delete or restrict the processing of your personal data, to object to processing based on legitimate interest, and to lodge a complaint with your supervisory authority. Candidates with a Kendor account can download their data and delete their account directly from account settings. For anything else, contact us at hello@kendor.io — where the hiring organization is the controller we will pass the request on and help resolve it.

Security

Passwords are stored hashed, candidate code runs in isolated sandboxes, recordings and workspace files live in private storage accessed through short-lived signed URLs, and access to candidate data is limited to the hiring organization’s authorized members.

Changes and contact

We will update this policy as the product evolves and adjust the date above. Questions or requests: email hello@kendor.io.