Legal

Privacy Notice

Version: 1.0 · Effective: May 2026

1. Who is responsible for this assessment

You have been invited to complete an assessment on the Storm platform by your prospective employer (“the Company”). The Company is the data controller responsible for this hiring process and for all decisions made about your application.

Yolex Labs LLC (“Yolex Labs”) processes your personal data as a data processor on behalf of the Company under a written data processing agreement. Yolex Labs does not make hiring decisions and is not responsible for the outcome of your application.

For data protection enquiries directed to the Company, contact the Company directly using the contact details provided in your hiring communications.

For data protection enquiries directed to Yolex Labs, contact: support@yolexlabs.com .

EU/EEA Representative: [Name and contact of appointed EU Representative service — to be completed prior to EU deployment].

2. What personal data is collected

During this assessment the following categories of personal data are collected on behalf of the Company:

  • Identification data: your name and email address as provided at registration
  • Professional data: role, seniority, and any background information you provide during the assessment
  • Assessment response data: your written responses to AI-generated assessment scenarios and questions
  • Evaluation data: AI-generated scores, summaries, and evaluation outputs derived from your written responses based on criteria specified by the Company
  • Session recording: video and ambient audio recording of your assessment session for integrity verification purposes as described in Section 4
  • Technical data: IP address, browser type and version, device information, session timestamps, and interaction logs collected to operate and secure the platform

Yolex Labs collects only the data necessary for the purposes described in this notice. The session recording is used solely for proctoring and integrity verification. It is not used as an assessment input and is not analyzed by AI under any circumstances.

3. How AI is used

The Storm platform uses artificial intelligence to:

  • Generate assessment scenarios and questions based on the role requirements, job description, and experience and skill criteria entered by the Company’s recruiter
  • Analyze your written responses to generate competency-based evaluation scores and summaries across job-relevant dimensions defined by the Company

These outputs are provided to the Company’s hiring team as decision-support tools only.

The following are explicitly outside the scope of Storm’s AI systems:

  • The session recording — not processed or analyzed by AI under any circumstances
  • Facial expressions, emotional state, tone of voice, or any behavioral or biometric characteristics
  • Any inference from ambient audio captured during the session
  • Any analysis of how you look, sound, or present during the assessment

Storm’s AI outputs are not designed or intended to serve as the sole basis for hiring decisions. The Company’s hiring team is responsible for all final decisions about your application.

The AI systems used in this assessment have been designed to minimize bias across protected characteristics. Yolex Labs conducts independent audits of AI outputs to assess fairness across candidate groups. AI systems are not perfect and human judgment is required in the evaluation of all results.

4. Session recording

Your assessment session is recorded via camera and microphone for integrity verification and proctoring purposes only.

  • The recording captures video and ambient audio while you complete your written assessment responses
  • The recording may be reviewed by the Company’s hiring team and personnel directly involved in this recruitment process for integrity verification purposes only
  • The recording is not analyzed or processed by Storm’s AI systems under any circumstances
  • The recording does not contribute to your evaluation scores
  • The recording is not used to assess your facial expressions, emotional state, tone of voice, or any behavioral or biometric characteristics
  • Access to recordings within Yolex Labs’ systems is restricted to authorized personnel only

Recording storage and retention

Depending on the configuration selected by the Company, recordings are handled as follows:

  • Where Yolex Labs stores the recording: retained for a maximum of 90 days following the conclusion of the hiring process and then securely and permanently deleted without exception
  • Where the Company stores the recording on its own infrastructure: Yolex Labs transmits the recording to the Company and does not retain a copy. The Company as data controller is solely responsible for the security, retention, access controls, and deletion of that recording in accordance with all applicable laws including where relevant the Illinois Biometric Information Privacy Act

5. Legal basis for processing

Yolex Labs processes your personal data on the following legal bases:

  • Assessment response data, evaluation data, and session recording: your explicit consent given via the consent checkboxes in the pre-assessment modal
  • Technical and operational data including session logs and security monitoring data: legitimate interest in operating a secure and reliable platform and preventing fraud and unauthorized access
  • Legal obligations: where retention or processing is required by applicable law, Yolex Labs processes data to the extent necessary to comply

Where consent is the legal basis you have the right to withdraw consent at any time by contacting support@yolexlabs.com . Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Withdrawal may mean the Company is unable to complete your assessment or consider your application.

Where legitimate interest is the legal basis you have the right to object. See Section 6.

6. Your rights

Depending on your location you may have the following rights:

  • Right of access: to obtain confirmation of whether your data is processed and to receive a copy
  • Right to rectification: to request correction of inaccurate or incomplete data
  • Right to erasure: to request deletion where data is no longer necessary or where you withdraw consent
  • Right to restriction: to request that processing is limited in certain circumstances
  • Right to data portability: to receive your data in a structured machine-readable format
  • Right to object: to object to processing based on legitimate interest
  • Right to human review: where a decision about your application is made solely by automated means and produces legal or similarly significant effects, you have the right to request human review, to express your point of view, and to contest the decision. Where a human reviewer has been involved in the decision you may still contact the Company to discuss the outcome.
  • Right to withdraw consent: at any time without affecting the lawfulness of prior processing

To exercise rights regarding the Company’s use of your data contact the Company directly.

To exercise rights regarding Yolex Labs’ processing contact support@yolexlabs.com . Yolex Labs will respond within 30 days of a verified request.

If you are located in the EU or EEA you have the right to lodge a complaint with your local data protection supervisory authority. A list of EU supervisory authorities is available at https://edpb.europa.eu .

If you are located in the UK the relevant authority is the Information Commissioner’s Office at https://ico.org.uk .

7. Who your data is shared with

Your personal data is shared with the following recipients:

  • The Company’s hiring team and authorized personnel directly involved in this recruitment process
  • Yolex Labs’ sub-processors who process data solely on Yolex Labs’ instructions to operate the platform

Yolex Labs’ current sub-processors are:

  • Hetzner and Google Cloud Platform: cloud infrastructure, hosting, databases, and storage
  • OpenAI , Anthropic , and Google Gemini: AI inference for analyzing written assessment responses and generating evaluation outputs and assessment content
  • SendGrid: candidate and recruiter email communications
  • Microsoft Identity: authentication services

The list above is the current and complete set of sub-processors. We will update this notice when it changes. Yolex Labs does not sell your personal data to any third party for any purpose.

8. International data transfers

Your personal data may be transferred to and processed in countries outside your country of residence including the United States.

Where personal data is transferred from the EEA or UK to a third country without an adequacy decision, Yolex Labs implements Standard Contractual Clauses approved by the European Commission and where necessary additional technical and organizational measures to ensure equivalent protection. Details of transfer mechanisms in place are available upon request at support@yolexlabs.com .

9. Data retention

  • Assessment response data and evaluation outputs: deleted within 90 days of the conclusion of the hiring process unless you request earlier deletion
  • Session recordings stored by Yolex Labs: deleted within 90 days as described in Section 4
  • Session recordings stored by the Company: the Company is responsible for retention and deletion
  • Security and technical logs: retained for a minimum of 12 months for security monitoring and audit purposes
  • Backup data: retained in accordance with Yolex Labs’ Backup and Disaster Recovery Policy

Upon expiry of the applicable retention period data held by Yolex Labs is securely deleted or anonymized. Retention periods may be extended only where required by applicable law or active legal proceedings.

10. Data security

Yolex Labs implements appropriate technical and organizational measures to protect your personal data including encryption in transit and at rest, role-based access controls, multi-factor authentication, and continuous security monitoring.

In the event of a personal data breach affecting your data held by Yolex Labs, Yolex Labs will notify the Company without undue delay. The Company is responsible for notifying you and any relevant supervisory authority as required by applicable law.

11. Illinois residents

Illinois Biometric Information Privacy Act (BIPA)

The proctoring recording captures video and ambient audio and may capture biometric identifiers including facial geometry.

Under BIPA you are informed that:

  • The purpose of this recording is assessment integrity verification only
  • The recording is reviewed by the Company’s hiring team and is not analyzed by AI
  • Where stored by Yolex Labs: retained for a maximum of 90 days and then securely and permanently deleted
  • Where stored by the Company: the Company as data controller is solely responsible for retention and deletion of the recording and for compliance with BIPA obligations with respect to that recording
  • Biometric data held by Yolex Labs is not sold, leased, traded, or otherwise profited from
  • Biometric data is not shared beyond the Company and Yolex Labs’ sub-processors as necessary to store and deliver the recording

To exercise your BIPA rights regarding data held by Yolex Labs contact support@yolexlabs.com . To exercise rights regarding data held by the Company contact the Company directly.

Illinois AI Video Interview Act

The Illinois AI Video Interview Act applies to AI analysis of video interview responses. Storm’s AI systems analyze only your written text responses. The session recording is not analyzed by AI under any circumstances. On this basis the Act’s AI analysis provisions do not apply to Yolex Labs’ processing of the session recording.

For completeness you are informed that AI is used to analyze your written assessment responses to generate competency-based scores across job-relevant dimensions as described in Section 3.

You have the right to request deletion of your assessment responses, session recording where held by Yolex Labs, and any AI-generated analysis at any time. Requests may be submitted to support@yolexlabs.com and will be completed within 30 days of a verified request.

12. California residents

Under the California Consumer Privacy Act and California Privacy Rights Act you have the following rights:

  • The right to know what personal information is collected, used, shared, or sold
  • The right to delete personal information held about you
  • The right to correct inaccurate personal information
  • The right to opt out of the sale or sharing of personal information — Yolex Labs does not sell or share candidate personal information for cross-context behavioral advertising
  • The right to non-discrimination for exercising your privacy rights

To exercise your California privacy rights contact support@yolexlabs.com . Yolex Labs will respond to verified requests within 45 days as required by law.

13. Colorado residents

If you are located in Colorado, under the Colorado Privacy Act as amended by H.B. 24-1130, this proctoring recording may capture biometric information. You are hereby informed that:

  • The purpose of this recording is assessment integrity verification only
  • The recording is not analyzed by AI
  • Where stored by Yolex Labs, recordings are retained for a maximum of 90 days and then securely and permanently deleted
  • Biometric information is not sold, leased, or traded

To exercise your rights regarding biometric data held by Yolex Labs contact support@yolexlabs.com .

14. Singapore residents

Yolex Labs processes your personal data in accordance with the Singapore Personal Data Protection Act 2012. You have the right to access and correct your personal data held by Yolex Labs. To exercise these rights contact support@yolexlabs.com . Yolex Labs will respond within 30 days of a verified request.

15. Updates to this notice

Yolex Labs may update this notice from time to time. Material changes will be communicated before taking effect. The version number and effective date at the top identify the version you consented to. Your consent is specific to the version displayed at the time of your assessment.

16. Contact

Yolex Labs LLC
Email: support@yolexlabs.com
EU/EEA Representative: [to be appointed before EU deployment]