Serin AI - Biometric Data Notice

Effective Date: 13/07/2026 Last Updated: 13/07/2026

*Note: Biometric features described in this policy are not currently implemented and are currently in the development pipeline for future release. We just collect the video for proctoring purposes and it is not utilized for any biometric analysis as of July 1, 2026.

This Notice applies specifically to biometric identifiers and biometric information, as defined under Illinois's Biometric Information Privacy Act (BIPA, 740 ILCS 14), the EU GDPR (Art. 9 — special category data), and India's IT (Sensitive Personal Data) Rules. It is a standalone document and is not part of, and does not substitute for, the Master Privacy & AI Policy. Where this Notice and the Master Privacy & AI Policy conflict on the subject of biometric data, this Notice controls.

1. What We Collect

Biometric Type	What It Is	When Collected
Facial geometry	An image of your face captured via webcam, used to generate a match against your uploaded government-issued ID	Identity verification step, if enabled for your interview
Eye-gaze / eye-tracking data	Patterns of eye movement and gaze direction recorded during the session	Throughout sessions with proctoring enabled
Voice biometrics	A voiceprint used for speaker verification	Only if explicitly stated for your specific interview — if this section does not apply to your interview, voice biometrics are not collected

2. Why We Collect It — and What We Do NOT Use It For

Each biometric type is collected for one purpose only:

Facial geometry → confirming you are who you claim to be, by matching against your submitted ID. Not used for emotion detection, personality inference, attractiveness scoring, demographic inference, or any form of candidate ranking.
Eye-gaze data → flagging potential attention/integrity anomalies for human review during proctoring. Not used to infer attentiveness as a competency, not used to score "engagement," and not shared with the Organization in raw form.
Voice biometrics (where applicable) → confirming the speaker's identity matches the registered candidate. Not used for accent classification, emotion detection, or any inference about national origin or other protected characteristic.

We do not use any biometric data for profiling, personality assessment, or any purpose beyond the specific verification/integrity function stated above.

3. Who Can Access This Data

Access to biometric data is restricted to the automated identity-verification and proctoring-integrity systems and the limited internal personnel responsible for operating and auditing those systems. The hiring Organization never receives your raw biometric data, biometric templates, or face/voice embeddings under any circumstances. Organizations receive, at most, a human-reviewed integrity flag summary — never the underlying biometric data. Personnel with access to biometric processing systems undergo background screening consistent with applicable federal requirements where Serin operates in a FedRAMP-authorized environment.

4. Retention and Destruction

Data	Retention	Destruction Trigger
Identity verification image	Deleted immediately upon confirmed match	Automated, no human step required
Biometric templates/embeddings (if generated)	Deleted at session end	Automated
Voiceprint (if applicable)	Deleted at session end	Automated

For U.S. federal agency customers, the routine deletion schedule may be suspended upon written notice from the agency, to permit compliance with litigation holds, IG inquiries, or FOIA requests.

In no case will any biometric identifier be retained longer than four (4) years from the date of collection or, if earlier, the date the purpose for collection is satisfied — whichever occurs first, consistent with BIPA's statutory maximum (740 ILCS 14/15(a)).

5. No Sale, Lease, Trade, or Profit

We do not sell, lease, trade, or otherwise profit from your biometric data, in whole or in part, under any circumstances. We do not disclose biometric data to any third party except: (a) with your prior written consent; (b) to complete a transaction you have specifically requested; (c) as required by a valid warrant or subpoena; or (d) as otherwise required by law.

6. Legal Basis and Jurisdiction-Specific Rights

6.1 European Union / United Kingdom (GDPR / UK GDPR Art. 9)

Our basis for processing your biometric data is your explicit, separate consent (Art. 9(2)(a)). This consent is independent of any other consent you provide and may be withdrawn at any time without penalty, by contacting contact@serin-ai.com. Withdrawal does not affect the lawfulness of processing before withdrawal and may require an alternative identity-verification or proctoring method to continue your application (see Section 7).

6.2 Illinois (BIPA, 740 ILCS 14)

You are entitled to: written notice of collection (this Notice); a written, signed, or electronically affirmed release before collection; a publicly available retention and destruction schedule (Section 4); and a private right of action for violation of this Act, including statutory damages of $1,000–$5,000 per violation. We do not condition your use of the Serin platform on a waiver of any BIPA right.

6.3 India (IT (Sensitive Personal Data or Information) Rules, and DPDP Act 2023)

Biometric data is treated as Sensitive Personal Data. We obtain itemized, standalone consent for each biometric processing purpose, separate from our general privacy notice, consistent with DPDP Act Section 6. You may withdraw consent and request destruction by contacting our Grievance Officer at contact@serin-ai.com.

6.4 California (CCPA/CPRA)

Biometric information is a category of "Sensitive Personal Information" under the CPRA. You have the right to limit our use of this data to the purposes disclosed here, and the right to request its deletion (see Master Privacy & AI Policy, Section 11.4).

7. Your Right to Refuse — and What Happens If You Do

You may decline biometric processing at any point before it begins. If you decline:

Identity verification: You must contact the Organization directly to request a manual, human-reviewed alternative. Serin does not facilitate, approve, or coordinate these requests, nor do we manage the resulting evaluation process.
Eye-tracking proctoring: We will disable eye-tracking for your session; other proctoring signals not classified as biometric (e.g., tab-switch detection) may remain active per the general session consent you provided.

Declining biometric processing will never result in automatic disqualification from your application. If a specific role genuinely requires identity verification as a non-negotiable condition (e.g., a regulated-industry compliance requirement imposed by the Organization), the Organization is liable to inform you of this explicitly. Serin does not manage, coordinate, or facilitate requests for human-conducted interviews, accommodations, or alternative assessment formats. You are solely responsible for initiating these requests directly with the Organization through their provided channels.

8. How to Exercise Your Rights

To withdraw consent, request destruction of your biometric data, or ask a question about this Notice: contact@serin-ai.com — we will confirm action taken within 15 business days, and in all cases within the statutory timeline applicable to your jurisdiction.

9. Updates to This Notice

Material changes to the biometric types we collect, our purposes, or our retention schedule will not be applied retroactively without obtaining fresh, separate consent from you for the new use.