Key points
- Dapatec LLC operates FloSkills, a hiring platform for businesses. This policy covers website visitors, customers and candidates.
- In hiring processes, the recruiting company decides how candidate data is used, and we process it on its behalf.
- Identity verification uses biometric data. We only do it with the candidate’s written consent, never sell that data and delete it on a fixed schedule.
- AI scores and sentiment insights are estimates. People make the hiring decisions.
- You can access, correct or delete your information by writing to legal@floskills.com. We answer within 10 business days.
1. Who we are and what this policy covers
In short: Dapatec LLC runs FloSkills. This policy applies to anyone whose information we process.
FloSkills is a recruiting and candidate-assessment platform for businesses, operated by Dapatec LLC, a North Carolina limited liability company (“Dapatec”, “we”, “us”). This policy applies to:
- Website visitors and demo requests: people who visit floskills.com or ask for a demo.
- Customers and users: the companies, recruiting agencies and professional recruiters that subscribe to FloSkills, and the people they invite to their workspaces.
- Candidates: people who apply to a role, are sourced by a customer, or take part in a screening call, technical interview or assessment, even if they never create an account.
Recruiting customers may also give candidates their own privacy notices. This policy does not replace them, nor any specific consent the law requires for recordings or biometric data.
2. Our role and our customers’ role
In short: We are responsible for our website, accounts and billing. In hiring processes, the customer decides and we act on its behalf.
Dapatec decides how and why personal information is processed for the website, user accounts, billing, security, platform administration and the professional-profile search we provide. For that processing we are the controller (“responsable del tratamiento” under Colombian law).
When a customer adds a candidate to its workspace and runs a hiring process (contacts, interviews, assessments and decisions), the customer decides the purposes of that processing and Dapatec processes the information on the customer’s behalf and following its instructions, as its processor (“encargado”). The customer is responsible for having a valid legal basis, giving candidates the required notices and answering their requests, and we help it do so. In every case, we remain responsible for our own legal obligations.
Candidates added to one customer’s workspace are available only to that customer. They are not shared with other customers.
3. Information we collect
In short: It depends on who you are and which features are used. Not every category applies to every person.
Website visitors and demo requests:
- Demo form: first and last name, work email, company name and company size.
- Technical data: signals used to protect our forms from bots and standard server logs: IP address, browser, device and pages requested.
Customers and users:
- Account: name, email, phone, sign-in data, organization, role (Owner, Admin, Manager or Recruiter) and preferences.
- Subscription and billing: plan, credits, invoices and transaction identifiers. Card details are processed by our payment processor; we do not store full card numbers.
- Usage and support: activity in the platform, first-party product analytics, support conversations and security logs.
Candidates:
- Professional profile: name, location, contact details, resume, experience, education, skills, profile links, applications and recruiter notes.
- Source: where the profile came from (a direct application, an upload by the recruiter or a professional-data provider), when and by whom it was added.
- Screening and interviews: answers, call and video recordings, transcripts, interview questions, evaluations and the status of each selection stage.
- Scores: affinity scores from 0 to 100 that combine hard and soft skills, competency levels and screening results.
- Identity verification: in technical video interviews, an image of an identity document, the text extracted from it, a selfie, frames captured during the interview and face comparison values. In some assessments, voice samples and voice comparison values. Several laws treat this as biometric or sensitive data (section 8).
- Sentiment insights: on the Premium Plus plan, estimates generated from interview transcripts (section 9).
We do not use candidate data to train Dapatec’s own AI models.
4. Where the information comes from
In short: From you, from the recruiting customer, from applications and from licensed professional-data providers.
- Directly from you: forms, account registration, job applications, the candidate portal and interviews.
- From the recruiting customer: resumes and information it uploads or imports.
- From licensed professional-data providers: a recruiter searches for profiles, reviews the results and decides which candidates to import. Contact details may be completed at that point.
We do not collect profiles by automated scraping of websites that prohibit it, including LinkedIn.
5. How we use information
In short: To run FloSkills, support hiring processes, keep the service secure and meet legal obligations. Never for advertising.
We use personal information to:
- provide, operate and support FloSkills, and manage accounts, workspaces, roles and credits;
- find, invite and contact candidates on behalf of customers;
- schedule and conduct AI phone screenings, technical interviews and assessments, and produce transcripts, evaluations and scores;
- confirm that the person in a technical video interview is the person who applied;
- help recruiters review and compare candidates;
- answer demo requests and send service, billing and permitted product communications;
- prevent fraud, abuse and impersonation, and protect the security of the service;
- comply with legal obligations and establish or defend legal claims.
AI results are estimates. They are not findings of fact, psychological assessments or guarantees that someone is suitable for a job.
6. AI scoring and automated decisions
In short: FloSkills scores candidates and, if the customer configures it, can move them out of a stage automatically. People make the final decision and can restore any candidate.
Customers create roles and set the requirements, questions and criteria. FloSkills evaluates answers and calculates an affinity score from 0 to 100 that combines hard and soft skills. Depending on the customer’s configuration, a candidate can be moved out of a stage of the process automatically; an authorized recruiter can review and restore that candidate at any time. Final hiring decisions are made by the customer, not by FloSkills.
Candidates can ask for a human review of an automated result, or object to it, by contacting the recruiting organization or writing to legal@floskills.com (section 17). Where local law regulates automated employment decision tools, the customer is responsible for the related notices, audits and alternatives.
7. Phone screening, video interviews and recordings
In short: Candidates are told before a call or video is recorded, and agree first.
- Invitations: candidates receive an email about an opportunity, confirm their interest and choose a time.
- AI phone screening: at the agreed time, an AI interviewer with an artificial voice calls the candidate. The call is recorded and transcribed to produce a structured summary.
- Technical interviews: they take place by phone, live video or pre-recorded video. Every technical video interview starts with identity verification (section 8).
Before a call or video is recorded, we tell the candidate that the interviewer is an AI, that the session is recorded and transcribed and how the results are used, and we ask for the candidate’s consent. Answering a call is not, on its own, treated as consent.
Candidates who prefer not to take part in an AI interview can ask the recruiting organization for an alternative.
8. Identity verification and biometric data
In short: We compare a selfie, an ID document and interview frames to confirm that the person interviewing is the applicant. Only with written consent; never sold; deleted on a fixed schedule.
This section is our public policy on biometric data, including its retention and destruction schedule.
- What we collect: at the start of a technical video interview (Premium Plus plan), an image of an identity document, a selfie and frames captured during the interview. For certain Colombian documents we extract the document text. From these images we generate face comparison values. In some assessments we also compare voice samples from the same application.
- Why: only to help the recruiting organization confirm that the person taking the technical interview is the person who applied, and to prevent impersonation. We do not use this data to infer emotions, health, ethnicity or any other characteristic.
- Consent: before collecting it, we tell the candidate in writing what is collected, why and for how long, and obtain the candidate’s written electronic consent. This consent is separate from any terms of use.
- It is optional: a candidate who does not consent can ask the recruiting organization for an alternative, such as a technical interview by phone. Not consenting does not, by itself, exclude anyone from the process.
- How it works: face and voice comparisons run on models deployed on FloSkills servers. Results indicate a match, an inconsistency or insufficient data. They are probabilistic, can be wrong and never reject a candidate automatically: a person reviews them.
- Who sees it: results are shown only to the recruiting organization running the process. We do not sell, lease or trade biometric data, and we only disclose it to service providers bound to protect it, with the candidate’s consent, or when the law requires it.
- Retention and destruction: images of identity documents and selfies are deleted 30 days after the identity check is completed. Face and voice comparison values are deleted 30 days after the hiring process closes, and never more than 12 months after they were collected. In every case, biometric data is permanently destroyed once the purpose for which it was collected has been fulfilled, or within 3 years of the candidate’s last interaction with FloSkills, whichever comes first.
9. Sentiment insights
In short: On Premium Plus, AI estimates sentiment from interview transcripts. They are estimates, not psychological evaluations or lie detection.
When included in the customer’s plan (currently Premium Plus), FloSkills sends interview transcripts to an AI provider to generate sentiment labels, notes for each question and estimates such as confidence, motivation or clarity.
- They are based on text only. They do not use images, facial expressions or tone of voice.
- They are language-model estimates, not clinical or scientifically validated measurements, and can be wrong or biased.
- They do not detect lies.
- Customers must not use them as the only basis for a hiring decision.
- The feature is not offered where the law prohibits it.
10. Legal bases and consent
In short: Contract, legitimate interests, legal obligations and, for sensitive data, explicit consent.
Depending on the country and the activity, we process personal information because it is necessary to perform a contract with the customer or the user, to comply with legal obligations, for legitimate interests that are not overridden by the person’s rights (such as security and fraud prevention), or with consent.
Biometric and other sensitive data are processed only with explicit consent or another basis the law expressly allows. Accepting our Terms is not consent to biometric processing. In Colombia, we or the recruiting customer obtain the prior, express and informed authorization required by Law 1581 of 2012 and keep proof of it.
12. International transfers
In short: FloSkills is operated from the United States. Information may be processed there and in the countries where our providers operate.
Dapatec is a U.S. company and FloSkills serves customers and candidates in several countries, including the United States and Colombia. Personal information may be transferred to and processed in the United States and in the countries where our service providers operate. When we transfer information internationally, we apply the safeguards required by applicable law, including, for information subject to Colombian law, the rules of Law 1581 of 2012 on international transfers and transmissions.
13. How long we keep information
In short: Only as long as the purpose requires, with specific limits for identity data.
| Information | How long we keep it |
|---|---|
| Demo requests | 24 months after the last contact |
| Accounts and workspaces | While the subscription is active and up to 2 years after it ends, unless the customer asks us to delete them earlier |
| Candidate records, interviews, recordings and scores | As instructed by the recruiting customer; by default, up to 12 months after the hiring process closes |
| Identity document images and selfies | 30 days after the identity check is completed |
| Face and voice comparison values | 30 days after the hiring process closes, and never more than 12 months after collection |
| Billing records | As long as tax and accounting laws require (generally up to 7 years) |
| Security logs | 12 months |
| Backups | Overwritten on a rolling cycle of up to 35 days |
When a period ends, we delete or anonymize the information. We keep it longer only when the law requires it or to establish or defend legal claims.
14. Security
In short: Reasonable safeguards, with no absolute guarantees.
We use technical and organizational measures appropriate to the nature of the information, including role-based access, separation between customers’ workspaces and access controls on our systems. No system is completely secure. If a security incident affects your personal information, we will notify you and the authorities as the law requires.
16. Emails and calls
In short: You can stop non-essential messages at any time.
We send service and billing emails, interview invitations requested through customers’ hiring processes and, where permitted, product news to customers. Our marketing emails include an unsubscribe link and our mailing address. Candidates can stop invitations from a hiring process by using the unsubscribe link, replying to the invitation, or contacting the recruiting organization or us.
17. Your rights and how to exercise them
In short: Access, correct, delete or object by writing to legal@floskills.com. We answer within 10 business days, or 15 for complaints.
Depending on where you live, you have the right to:
- know whether we process your information and access it;
- correct or update it;
- ask us to delete it;
- withdraw your consent or object to certain processing, including direct marketing;
- receive a copy in a portable format, where applicable;
- ask for a human review of an automated result;
- complain to a data protection authority.
To make a request, write to legal@floskills.com from the email address linked to your information, or include enough details to identify you. You don’t need an account. We may ask for reasonable information to verify your identity. If your information is part of a customer’s hiring process, we may forward your request to that organization and help it respond.
We answer queries within 10 business days, and complaints and requests for correction or deletion within 15 business days. If we need more time, we will tell you why before the deadline and answer within 5 additional business days for queries or 8 for complaints. Exercising your rights is free. Some rights have legal exceptions, such as records we must keep by law; if we can’t fully meet a request, we will explain why.
18. United States
In short: Some states give additional rights, especially over biometric data.
Privacy and biometric laws vary by state. Where a state law applies, we provide the notices, consent mechanisms and rights it requires, including the written notice, written release and public retention schedule required by biometric privacy laws such as Illinois’ (sections 8 and 13). Employers using FloSkills are responsible for their own obligations, including state and local rules on AI-analyzed video interviews and automated employment decisions.
19. Colombia
In short: If Colombian law applies, you can file queries and complaints with us and, after that, with the SIC.
For processing subject to Law 1581 of 2012 and its regulations:
- Controller: Dapatec LLC, with the contact details at the end of this policy. When a candidate is part of a customer’s hiring process, that customer is the controller and Dapatec acts as its processor.
- Area in charge of requests: Dapatec’s privacy team, at legal@floskills.com.
- Your rights: to know, update and rectify your data; request proof of your authorization; be informed of how your data is used; file complaints with the Superintendence of Industry and Commerce (SIC) after completing the procedure with us; revoke your authorization and request deletion when there is no legal or contractual duty to keep the data; and access your data free of charge.
- Sensitive data: biometric data is sensitive. Answering questions about sensitive data or providing it is optional, and no activity is conditioned on providing it.
- Procedure: queries are answered within 10 business days, extendable by 5, and complaints within 15 business days, extendable by 8, as set out in articles 14 and 15 of Law 1581 of 2012.
- Validity: this policy applies from its effective date. Our databases remain in force while FloSkills operates and the information is needed for the purposes described, subject to the periods in section 13.
20. European Union and EEA
In short: FloSkills is not currently offered in the EU or EEA.
FloSkills is not currently marketed to organizations in the European Union or the European Economic Area. Before offering it there, we will update this policy with the information and safeguards required by the GDPR and the EU AI Act.
21. Age
FloSkills is intended for people aged 18 or older. We do not knowingly collect information from minors; if we learn that we have, we delete it.
22. Changes to this policy
We update this policy when our practices, providers or the law change. The version and effective date at the top identify the current text. If a change is material, we notify customers by email or in the platform before it takes effect.
Contact
- Operator
- Dapatec LLC, a North Carolina limited liability company, United States
- Email (privacy, legal notices and security)
- legal@floskills.com