Privacy Policy

Aetherwave Holdings LLC ("we," "us," or "our") operates StormInterview, an asynchronous video interview platform with AI-powered scoring. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform at storminterview.com and related services (the "Service").

StormInterview is a business-to-business (B2B) platform. Our customers are companies and organizations ("Customers") that use the Service to conduct interviews with job candidates ("Candidates"). This policy applies to both Customers and Candidates.

1. Information We Collect

1.1 Account Information

When you create an account, we collect your name, email address, company name, job title, and password. If you sign up through a third-party authentication provider, we receive your name and email from that provider.

1.2 Video Recordings

Candidates record video responses to interview questions through the Service. These video recordings are captured and stored as part of the interview process. Live video interviews conducted through our platform (powered by Daily.co) may also be recorded when enabled by the Customer.

1.3 Transcripts and AI Analysis

Video recordings are transcribed using Deepgram. A local Whisper model can be used instead; it runs on our own infrastructure and sends no audio to a third party. These transcripts are then analyzed by AI (Anthropic Claude) to generate scores and evaluations. The resulting transcripts, scores, and analysis summaries are stored as part of the interview record.

1.4 Payment Information

We process payments through Stripe. We do not directly store your full credit card number or bank account details. Stripe collects and stores payment information in accordance with PCI-DSS standards. We retain transaction records, billing addresses, and subscription details.

1.5 Usage Data

We automatically collect information about how you interact with the Service, including pages visited, features used, timestamps, browser type, operating system, device information, and IP address. We may also collect performance data such as page load times and error logs.

1.6 Communications

We collect information from emails and messages sent through the Service, including interview invitations and notifications delivered through our email delivery provider.

1.7 Google user data

When a recruiter connects Google Calendar, the access Google grants covers the recruiter's calendars. StormInterview only reads free/busy times from the primary calendar and only creates, updates or cancels events in the primary calendar. We receive the email address of the connected Google account. For the agenda view we read event details (title, start and end time, location, Google Meet link and the response status of invited attendees). We do not read the content of emails or contacts, and we do not read events from other calendars.

We use this data only to show availability and to plan interviews in the recruiter's calendar. When StormInterview creates an interview event, the email addresses of the interviewer and panel members are sent to Google as invitees. In the candidate self-scheduling flow the candidate's email address is also included as an invitee; the live-interview flow does not add the candidate and sends the invitation through StormInterview's own email.

OAuth access and refresh tokens are stored encrypted at rest with AES-256-GCM and bound to the tenant. The connection row also stores the connected account's email address, the granted scope, the token expiry, the last sync time and the connection status. With an interview record we keep the provider's event identifier, the Google Meet link, the email address of the calendar account that hosts the event, the organizer's user id, and the candidate's response status and response time.

Tokens are kept until the recruiter disconnects or Google rejects a token refresh. In both cases we delete the stored access and refresh tokens and mark the connection disconnected. Disconnecting also asks Google to revoke the tokens. The connection row keeps the account email, granted scope and status after the tokens are deleted. When a user account is erased or a workspace is deleted, StormInterview deletes the entire connection, including the tokens, the account email address, the granted scope and the status, and revokes the Google access where possible. The event identifier, meeting link, calendar account and response status stay with the interview record for as long as that record is retained. Disconnecting does not delete events that were already created in the recruiter's calendar; the recruiter can delete those in Google Calendar.

We do not sell Google user data, use it for advertising, or use it to train AI or machine learning models. We do not transfer it to third parties except as needed to provide the Service or as required by law. No human reads Google user data except with the user's consent, for security purposes, or as required by law.

You can revoke access with the disconnect button in StormInterview or at myaccount.google.com/permissions.

StormInterview's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

1.8 Microsoft user data

When a recruiter connects Microsoft Outlook, the access Microsoft grants covers the recruiter's calendars. StormInterview only reads free/busy times from the primary calendar and only creates, updates or cancels events in the primary calendar. We receive the account's email address. For the agenda view we read event details (title, start and end time, location, Microsoft Teams link and the response status of invited attendees).

We use this data only to show availability and to plan interviews. When StormInterview creates an interview event, the email addresses of the interviewer and panel members are sent to Microsoft as invitees. The candidate's email address is removed before the call to Microsoft; the candidate receives StormInterview's own invitation.

Tokens are stored encrypted at rest with AES-256-GCM and bound to the tenant. The connection row also stores the account's email address, the granted scope, the token expiry, the last sync time and the connection status. With an interview record we keep the provider's event identifier, the Microsoft Teams link, the email address of the calendar account that hosts the event, the organizer's user id, the candidate's response status and response time, and any alternative time the candidate proposes.

Tokens are kept until the recruiter disconnects or Microsoft rejects a token refresh. In both cases we delete the stored access and refresh tokens and mark the connection disconnected. Microsoft has no endpoint to revoke a single app's delegated refresh token, so deleting our copy is the maximum we can do on our side; the recruiter can also remove the app's access from their Microsoft account. The connection row keeps the account email, granted scope and status after the tokens are deleted. When a user account is erased or a workspace is deleted, StormInterview deletes the entire connection, including the tokens, the account email address, the granted scope and the status. We do not sell Microsoft user data, use it for advertising, or use it to train AI or machine learning models. We do not transfer it to third parties except as needed to provide the Service or as required by law.

2. How We Use Your Information

We use collected information to:

• Provide and maintain the Service, including recording, transcribing, and analyzing interviews
• Process AI-powered scoring and evaluation of interview responses
• Send interview invitations, reminders, and notifications to Candidates on behalf of Customers
• Process subscription payments and manage billing
• Provide customer support and respond to inquiries
• Monitor and improve the performance, reliability, and security of the Service
• Detect, prevent, and address technical issues, fraud, or abuse
• Comply with legal obligations
• Communicate updates, security alerts, and administrative messages

3. Data Sharing and Sub-processors

We do not sell your personal data. We share data with the following third-party service providers (sub-processors) only as necessary to operate the Service:

We may also share information when required by law, to protect our rights, or in connection with a merger, acquisition, or sale of assets.

4. Data Retention

We retain your data for as long as necessary to provide the Service and fulfill the purposes described in this policy. Specific retention periods include:

• Account data: Retained for as long as your account is active, plus up to 30 days after deletion to allow for recovery.
• Video recordings and transcripts: Retained for the duration specified by the Customer's subscription plan. Customers can delete recordings at any time. Upon account termination, recordings are deleted within 90 days.
• AI scores and analysis: Retained alongside the associated interview records and deleted on the same schedule.
• Payment records: Retained for up to 7 years as required for tax and accounting compliance.
• Usage logs: Retained for up to 12 months for analytics and security purposes, then anonymized or deleted.

5. Cookies and Tracking

We use cookies and similar technologies to:

• Essential cookies: Necessary for authentication, session management, and security. These cannot be disabled.
• Functional cookies: Remember your preferences such as language settings and display options.
• Analytics cookies: Help us understand how users interact with the Service so we can improve it.
• Marketing cookies: Measure the reach of our campaigns and show relevant advertising. These are only set after you grant marketing consent.

On the public site we use CookieYes for consent management, Microsoft Clarity for analytics, HubSpot and LinkedIn Insight for marketing, Google Ads for advertising and conversion measurement, and Google AdSense for advertising. Google Ads loads its tag with consent denied and sets no advertising cookies until you consent. We use Google Analytics 4 only when a measurement ID is configured; production currently does not configure one.

You can control cookie preferences through your browser settings. Disabling essential cookies may affect the functionality of the Service.

6. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request that we correct inaccurate or incomplete data.
• Deletion: Request that we delete your personal data, subject to legal retention requirements.
• Portability: Request your data in a structured, machine-readable format.
• Restriction: Request that we limit how we process your data.
• Objection: Object to processing based on legitimate interests.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

Note for Candidates: If you are a Candidate whose data was collected through a Customer's use of StormInterview, please contact the Customer (your prospective employer) directly to exercise your data rights. If the Customer is unable to assist, you may contact us.

7. Children's Privacy

StormInterview is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16, we will take steps to delete that information promptly. If you believe a child under 16 has provided us with personal data, please contact us at [email protected].

8. International Data Transfers

StormInterview is operated from the United States. If you access the Service from outside the United States, including from the European Union or European Economic Area, your data may be transferred to, stored in, and processed in the United States or other countries where our sub-processors operate.

We implement appropriate safeguards for cross-border data transfers, including Standard Contractual Clauses (SCCs) approved by the European Commission, and we ensure our sub-processors maintain adequate levels of data protection. For more details on our GDPR compliance, please see our GDPR Compliance page.

9. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request details about the categories and specific pieces of personal information we have collected about you, the sources of that data, the business purpose for collection, and the categories of third parties with whom we share it.
• Right to Delete: You may request that we delete your personal information, subject to certain exceptions.
• Right to Opt-Out of Sale: We do not sell personal information. If this changes, we will provide a "Do Not Sell My Personal Information" link on our website.
• Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise your CCPA rights, contact us at [email protected]. We may verify your identity before fulfilling your request.

10. Security

We implement industry-standard technical and organizational measures to protect your data, including encryption in transit (TLS) and at rest, access controls, regular security audits, and secure software development practices. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. For significant changes, we may also send a notification via email. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

12. Contact Information

If you have questions or concerns about this Privacy Policy or our data practices, please contact us: