Privacy Policy

Last updated: August 10, 2026 · Version 1.0

1. Who we are and who this policy covers

Entrevo is a recruitment platform that conducts AI-assisted interviews, organizes evidence and supports human hiring decisions. The platform is operated by OmniSmart, at entrevo.com.br, with the application hosted at app.entrevo.com.br.

This policy covers two groups of people:

• Platform users — recruiters and hiring managers at companies that subscribe to Entrevo.
• Candidates — people taking part in a hiring process run by a customer company through Entrevo.

2. Our two roles: controller and processor

This distinction determines who decides what about your data, and it matters:

3. Data we process

3.1 Platform users

• Identification and contact: name, work email, company, job title.
• Access credentials (passwords stored only as hashes) or the Google account identifier when signing in with Google.
• Usage data: pages visited, actions taken, technical logs and IP address, for security and auditing.
• Billing data processed by our payment provider. We never store card numbers.

3.2 Candidates

• Contact and profile data: name, email, phone, city, résumé and public professional profile (for example, LinkedIn) provided by the person or by the hiring company.
• Interview content: text or voice answers, the conversation transcript and, in the final video stage, the transcript of the conversation with the company's team.
• Generated assessments: scores per criterion, literal quotes used as evidence, points to validate and decision-support recommendations.
• Scheduling records: booked slots, reschedules and confirmations.

3.3 Sensitive data

We do not ask for and do not want sensitive data. The platform is explicitly instructed not to infer racial or ethnic origin, religion, political opinion, union membership, health, disability, sex life, sexual orientation, gender identity, marital status, children or pregnancy. If a candidate spontaneously mentions something of this nature, it is not used as an assessment criterion.

4. Purposes and legal bases

We never sell personal data and we do not use candidate data for advertising.

5. Data obtained from Google APIs

Entrevo offers two optional Google integrations. Both are initiated by you, require your explicit consent on Google's own screen, and can be disconnected at any time.

5.1 Sign in with Google

We request the openid, email and profile scopes solely to identify you and create or access your account. We store your name, email and Google account identifier.

5.2 Google Calendar

When a user connects their calendar, we request the https://www.googleapis.com/auth/calendar.events scope for the single purpose of maintaining interview events:

• Create the event when a candidate books a time slot on the platform;
• Update that event when the interview is rescheduled;
• Delete that event when the interview is cancelled.

From your calendar we store only the identifiers of events created by the application itself, so that we can update them later. We do not read, list or process events that Entrevo did not create. The access token is encrypted at rest, reachable only by the application server, and is revoked with Google when you disconnect the integration in Settings.

6. Artificial intelligence: what we do and never do

The platform uses language models to conduct the conversation, transcribe audio and organize evidence against the criteria the company defined for the job.

• The decision is always human. The AI does not approve, reject, select or eliminate anyone. It signals alignment with the criteria and flags evidence gaps; the person responsible for the job decides.
• Every score requires quotable evidence. Without a literal excerpt of the candidate's own words supporting the assessment, the criterion is recorded as a gap, with no score.
• Your data does not train third-party models. We use AI providers in processing mode, with content excluded from their model training.
• Right to review. You may request human review of any automated assessment and an explanation of the criteria applied.

7. Sharing and sub-processors

We share data only with those necessary to operate the service, under contract and confidentiality obligations:

We may also disclose data when required by a competent authority, to comply with a legal obligation, or to exercise rights in legal proceedings. In a corporate reorganization, data may be transferred to the successor, with this policy remaining in force.

8. International transfers

Some sub-processors are located outside Brazil, as indicated above. Such transfers rely on the mechanisms of Article 33 of the Brazilian LGPD and on contractual clauses requiring a level of protection compatible with Brazilian law.

9. Security

• Traffic encrypted in transit (TLS); the database is reachable only from the server's internal network.
• Passwords stored only as hashes; integration tokens encrypted and restricted to the server.
• Strict tenant isolation: each workspace sees only its own data, verified on every request.
• Résumés and photos are served only to authenticated members of the workspace, never through public links.
• Audit log of relevant actions and of decisions made about candidates.
• Daily backups and a tested recovery routine.

If a security incident with material risk occurs, we will notify affected controllers and the Brazilian Data Protection Authority within the applicable deadlines.

10. Retention and deletion

• Hiring process data: retained for the period set by the customer company in its dashboard. Once it elapses, the platform automatically anonymizes the candidate's data and deletes résumé, photo and transcripts.
• Interview audio: discarded right after transcription; never stored.
• Account and billing data: kept for the duration of the contract and afterwards for the period required by tax law.
• Audit records: kept as long as necessary for security and legal defense.

11. Your rights

You may request: confirmation that processing exists; access to your data; correction of incomplete or outdated data; anonymization, blocking or deletion of unnecessary data or data processed unlawfully; portability; information about sharing; information about the consequences of refusing consent; withdrawal of consent; and review of automated decisions.

Write to privacidade@entrevo.com.br. We respond within 15 days. We may ask for additional information to verify your identity before acting on the request — that protects you.

12. Cookies

We use only what is essential: a session cookie to keep you securely signed in, and temporary cookies during the Google sign-in flow. We use no advertising cookies and no third-party tracking in the application.

13. Children

The platform is intended for people aged 18 or over, in the context of employment processes. We do not knowingly collect data from children. Apprenticeship programs involving minors require specific handling by the customer company, in the best interest of the data subject and with consent from whoever holds legal responsibility.

14. Changes to this policy

We may update this policy to reflect changes in the service or in the law. The last updated date is always at the top of the page. If a change is material, we will notify customers by email or inside the platform before it takes effect.

15. How to reach us

• Data Protection Officer and privacy: privacidade@entrevo.com.br
• Support: suporte@entrevo.com.br
• General contact: contato@entrevo.com.br

You may also lodge a complaint with the Brazilian National Data Protection Authority (ANPD).