Privacy Policy

1. Introduction

Looma Interviewer AI ("we", "our", "the Extension") is a Chrome browser extension designed to help recruiters and hiring managers conduct and analyze video interviews on Google Meet. This Privacy Policy explains how we collect, use, and protect your data.

2. Data We Collect

2.1 Interview Content Data

When you use the Extension to record an interview, we collect:

• Audio recordings of all interview participants
• Video recordings of interview participants (if video is enabled)
• Live transcriptions of spoken dialogue during the meeting
• Meeting metadata: date, time, meeting ID, participant names

2.2 Technical Data

• User preferences: recording quality settings, language preferences
• Authentication tokens: to connect with your backend server
• Extension usage data: button clicks, feature usage (stored locally only)

2.3 Data We Do NOT Collect

3. How We Use Your Data

3.1 Primary Purpose

All collected data is used solely for:

• Interview evaluation: Analyzing candidate responses and performance
• Transcript generation: Converting speech to text for review
• Recording storage: Saving interview sessions for later review
• AI analysis: Processing interviews for insights and candidate assessment

3.2 Data Processing Location

4. Data Storage and Security

4.1 Storage Location

• Browser Storage: Only stores user preferences, authentication tokens, and meeting metadata
• Backend Server: All interview recordings and transcripts are stored on your self-hosted backend
• No Cloud Storage: We do not maintain any cloud servers or databases that store your interview data

4.2 Data Retention

• Data retention policies are controlled by your backend system
• You have full control over how long recordings are stored
• You can delete recordings at any time through your backend interface

4.3 Security Measures

• All data transmission uses HTTPS encryption
• Authentication tokens are stored securely in Chrome's storage API
• No sensitive data is logged to browser console in production builds

5. Third-Party Services

5.1 Google Meet Integration

• The Extension integrates with Google Meet to capture meeting content
• We do NOT send any data to Google (except standard Meet functionality)
• Google's own Privacy Policy applies to Google Meet usage

5.2 Your Backend Server

• The Extension communicates exclusively with your configured backend server
• We do not control or access your backend infrastructure
• Your backend's privacy policy applies to data stored there

5.3 No Third-Party Analytics

6. User Rights and Controls

6.1 Consent Requirements

6.2 Data Access and Deletion

• Access: You can access all your data through your backend system
• Export: You can download recordings and transcripts at any time
• Deletion: You can delete data through your backend interface
• Uninstall: Removing the Extension deletes all local browser data

6.3 GDPR Compliance (EU Users)

If you are in the European Union, you have additional rights:

• Right to Access: Request a copy of your data
• Right to Rectification: Correct inaccurate data
• Right to Erasure: Request deletion of your data
• Right to Data Portability: Receive your data in a portable format
• Right to Object: Object to certain data processing activities

7. Permissions Explanation

7.1 Required Chrome Permissions

• activeTab: To interact with Google Meet pages
• storage: To save user preferences and authentication tokens
• tabCapture: To record meeting audio and video
• desktopCapture: Fallback method for screen sharing capture
• meet.google.com: To access Google Meet interface

7.2 Why We Need These Permissions

Each permission is strictly necessary for core functionality. See the "Permissions" section in the Chrome Web Store listing for detailed explanations.

8. Data Protection for Organizations

8.1 Enterprise Usage

• Organizations can self-host the backend for full data control
• IT administrators can configure centralized backend URLs
• All data remains within the organization's infrastructure

8.2 Compliance Certifications

• The Extension architecture supports GDPR, CCPA, and SOC 2 compliance
• Compliance responsibility lies with the organization operating the backend
• We provide technical documentation for security audits

9. Children's Privacy

The Extension is designed for business use (recruitment and hiring) and is not intended for children under 13. We do not knowingly collect data from minors.

10. International Data Transfers

• Data is sent to your configured backend server
• If your backend is in a different country, standard data transfer rules apply
• You are responsible for ensuring compliance with international data transfer regulations

11. Changes to This Privacy Policy

• We may update this Privacy Policy periodically
• Changes will be reflected in the "Last Updated" date
• Major changes will be communicated through Extension update notes
• Continued use after changes constitutes acceptance

12. Contact Information

13. Legal Basis for Processing (GDPR)

Under GDPR, our legal basis for processing is:

• Consent: You explicitly consent by using the recording feature
• Legitimate Interest: Processing is necessary for recruitment and hiring activities
• Contractual Necessity: Required to provide the service you requested

14. Your Responsibilities

15. Limitation of Liability

• We provide the Extension "as is" without warranties
• We are not liable for misuse of recorded data
• You are solely responsible for compliance with applicable laws
• Data loss due to backend server issues is not our responsibility