BitStage Privacy Policy

BitStage ("we", "us", "our", or "the Service") is operated by BitPlan Loyalty Inc. ("BitPlan"), a corporation incorporated in Ontario, Canada, with its registered office in Collingwood, Ontario. We provide an AI-powered rehearsal platform where job candidates in the hospitality, hotel, retail, and travel industries practise and demonstrate skills before stepping onto a real shift.

This Privacy Policy explains what information we collect, how we use it, who we share it with, how long we keep it, and the rights you have to control it. It applies to Candidates, Clients (employers), and visitors. It works alongside our Terms of Service; in the event of a conflict, the Terms of Service control.

This Policy applies to visitors to bitstage.ai and related domains; Candidates who create accounts and complete rehearsals; Clients who use the Service to source, evaluate, or hire Candidates; and third parties whose information is provided to us.

2.1 Controller / Business and Processor / Service Provider

• Practice / Profile use (Consent Tiers B and C). BitPlan acts as the controller / business.
• Employer-application use (Consent Tier A). BitPlan acts as processor / service provider, and the Client is the controller / business of the resulting hiring file.
• Cross-cutting controller activities. BitPlan retains a limited controller role for security, fraud-prevention, audit, fairness assessment, and product-integrity purposes for all Tiers.

3.1 Account Information

Name, email address, password hash, organization (for Clients), role, and an optional profile photo - collected directly from you when you create an account.

3.2 Rehearsal Recordings and Outputs

Audio recordings, video recordings (where camera access is enabled), real-time speech transcripts, response timing and behavioural markers, and BitScore values and explanations - captured with your express opt-in consent. We do not perform facial recognition, face identification, faceprint matching, voiceprinting, voice identification, or candidate emotion detection.

3.3 Device and Technical Information

IP address, browser type, OS, device type, screen size, camera/microphone permissions, time zone, approximate IP-derived location, and hashed device/browser integrity signals for fraud and abuse prevention, including guest practice session continuity and Resume Analyzer fair-use limits.

3.4 Usage Information

Pages visited, features used, links clicked, session duration, referral source, error logs.

3.5 Communications

Emails, support tickets, chat messages, and any other communications with us.

3.6 Data Not Collected Directly From You

We do not systematically collect Personal Data from third-party sources. If that changes we will inform you and update this Policy.

3.7 Payment Information (Clients only)

Billing name, billing email, billing address, and a payment-method token. We do not store full card numbers. Stripe processes payments.

What we do not do

• We do not make automated hiring decisions on behalf of Clients. A human reviewer is required.
• We do not use identifiable Candidate rehearsal data to train our AI models.
• We do not "sell" or "share" personal information as defined under CCPA/CPRA.
• We do not use your video for facial recognition or build a faceprint or voiceprint.
• We do not act as a "consumer reporting agency" under the U.S. FCRA, and BitScore is not a "consumer report".

5.1 The Pipeline

Each rehearsal is processed by a deterministic, version-locked scoring runtime. Audio and (optionally) video are transcribed and converted into schema-constrained BehavioralVectors. A version-locked scoring configuration is permanently associated with each scoring run. Language models are restricted to evidence extraction and do not produce your score directly.

5.2 Scoring Input Boundaries

BitScore uses the configured scoring evidence for the rehearsal, such as transcripts, response timing, and scenario events. Facial analysis, voiceprinting, voice identification, voice-tone analysis, prosody analysis, and candidate emotion detection are not used to score Candidates.

5.3 What We Do Not Do

• No facial recognition, face identification, or faceprint matching.
• No faceprint or facial-geometry storage for biometric identification.
• No voiceprint or voice identification.
• No AI detection of protected characteristics.
• BitScore is not produced by a language model directly - scores are deterministic and reproducible.
• No external retrieval, web lookups, or dynamic knowledge calls during scoring.

5.4 Data Separation Design

BitStage maintains database-level separation between identity data and behavioural scoring data, linked through a unique session/attempt binding mechanism.

5.5 Express, Informed, Opt-In Consent (Meaningful Consent)

Before each rehearsal, the Service presents a specific consent prompt addressing, in plain language and without bundling:

• What we collect under your selected Consent Tier.
• Who processes this data (categories of Subprocessors).
• The purposes for each data category.
• The applicable retention period under your selected Consent Tier.
• The meaningful risks of harm (inaccurate BitScore impact, Client review of recordings, biometric-law characterization of rehearsal recordings, residual security-incident risk).
• Your right to withdraw consent at any time and the consequences.

5.6 Withdrawal of Consent

Withdraw at any time via in-app controls or by emailing info@bitstage.ai. Withdrawal ends your active session and triggers deletion of session data within thirty (30) days, subject to legal retention obligations.

6.1 Tier A - Apply for a Role (Employer-Specific)

BitStage acts as processor. The Client may view authorized recordings in-app through access-controlled streaming where consent and retention rules allow. Clients do not download raw recordings through standard exports. The Client receives transcripts and BitScore. BitStage retains a copy for the Client's configured retention period (minimum ninety (90) days, maximum one (1) year from the rehearsal date).

6.2 Tier B - Save to Your BitStage Profile

Stored privately to your account in a sandboxed environment. Not visible to any Client unless you mark "Public" or share it.

6.3 Tier C - Audio Only

Only audio transcript and resulting score. No video recorded or stored at any time.

6.4 No Inducement

Your choice of Consent Tier never affects your BitScore, application status, or eligibility for any role.

6.5 Sandboxing

Profile rehearsals are stored in a logically isolated environment not accessible to Clients, advertisers, or other Candidates.

7.1 Encryption

All data is encrypted at rest using AES-256 and in transit using TLS 1.3.

7.2 Hosting and Cross-Border Processing

Production hosting is on AWS in us-east-1 and ca-central-1. The application database runs on AWS RDS for PostgreSQL. Real-time audio/video uses LiveKit; retained recordings persist to encrypted AWS object storage. Certain processing flows traverse us-east-1 and may be subject to U.S. legal process including the CLOUD Act, FISA § 702, or U.S. national-security letters.

7.3 Snapshot Binding and Tamper Detection

Every scoring run uses a deterministic, version-locked configuration. On replay or audit, the system validates configuration integrity.

7.4 Access Controls

Role-based access control, MFA for human operator access, security and compliance event logging, least-privilege principles. Personnel receive privacy and security training on hire and at least annually.

7.5 Compliance Posture

BitStage's security architecture is designed to align with SOC 2 (Trust Services Criteria) and ISO 27001 control principles. No third-party attestation has yet been completed; formal SOC 2 Type 1 readiness is targeted post-MVP.

7.6 No Silver Bullet

No security measure is guaranteed to be perfect. See Section 16 for our breach-notification commitment.

We engage carefully selected third parties to deliver elements of the Service. The current list is below; we maintain an updated list at bitstage.ai/subprocessors.

We require all Subprocessors to agree to data-protection terms at least as protective as those in this Policy and provide at least thirty (30) days' advance notice of material changes.

BitStage's use of information received from Google Workspace APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Information received through Google Workspace APIs is used only to provide user-authorized functionality, including creating and managing interview calendar events and configuring Google Meet spaces. BitStage does not use, transfer, or sell raw or derived Google Workspace API data to create, train, or improve foundational or generalized artificial intelligence or machine-learning models.

9.1 Categories

• Strictly necessary: authentication, security, core functionality. Cannot be disabled.
• Functional: remember your settings. Disabling may limit features.
• Analytics: Google Analytics 4 (IP truncation enabled). Analytics loads only after consent. You can change this anytime in your profile Cookie settings, or through your browser.
• Marketing: we do not currently set marketing or advertising cookies.

9.2 Global Privacy Control and Do Not Track

We honour the GPC signal as a "do not sell or share" opt-out. We do not currently respond to the legacy DNT header.

9.3 Cookie Consent

Where required by law, we obtain explicit consent before setting non-essential cookies. Withdraw or modify consent at any time.

The Service is primarily offered to Users located in Canada and the United States. Users outside North America should not access or use the Service.

Contact visibility after a job closes. While a job is open, Clients and recruiters may see a Candidate's email in the Service for that application. After the job closes, BitStage hides that email in the product unless the Candidate has opted in to be considered for other roles with that Client. Opt-in answers are stored with a timestamp and can be changed in the Candidate profile. BitStage does not delete the underlying email from system records solely because a job closes (it remains available for logs, support, and audit). Platform messages to an opted-in past Candidate are limited to specific role invitations - not marketing or general updates. See the Terms of Service, Section 4.4.

• Access. Request a copy of the Personal Data we hold about you.
• Portability. Receive a copy in a structured, machine-readable format.
• Correction. Update inaccurate information.
• Deletion. Request deletion, subject to retention obligations.
• Restriction. Limit how we use your data.
• Objection. Object to processing based on legitimate interests, including profiling.
• Withdraw consent. Where processing is based on consent.
• Explanation of automated decisions. Receive a plain-language explanation of any BitScore and dispute it.
• Complaint to a regulator. OPC (Canada), CPPA (California), CAI (Quebec), or your local DPA.

12.1 How to Exercise

Email info@bitstage.ai. We may need to verify your identity. We respond within thirty (30) days.

12.2 Tier A Application Data - Direct the Right Party

For Tier A application data already delivered to a Client, the Client is the controller. We will pass on requests to the relevant Client.

• Bias mitigation. Periodic audits for disparate impact; summaries at bitstage.ai/fairness.
• Explainability. BitScore outputs include plain-language feedback.
• No protected-characteristic detection.
• Right to dispute. Email info@bitstage.ai.

14.1 Canada - PIPEDA and Provincial Equivalents

We comply with PIPEDA and applicable provincial laws including BC PIPA and Alberta PIPA.

14.2 Ontario - AI Disclosure (Working for Workers Four Act, 2024)

Ontario employers must disclose AI use in screening candidates. When you apply to an Ontario Client, the Client is responsible for the required disclosure.

14.3 Quebec - Law 25

14.4 California - CCPA / CPRA and ADS Regulations

California residents have rights to know, delete, correct, opt out of sale or sharing (we do neither), limit use of sensitive personal information, and non-discrimination.

14.5 Colorado - Automated Decision Technology Framework

SB 26-189, effective January 1, 2027. Clients deploying for Colorado residents are responsible for compliance.

14.6 Illinois - BIPA, AIVIA, and HRA (HB 3773)

The Service is not designed to collect biometric identifiers as defined by BIPA. For Illinois users, the rehearsal consent prompt captures specific written consent for rehearsal recordings, transcripts, and related scoring outputs. Consent records are retained for the underlying data period plus three (3) years.

14.7 Texas, Washington, and Other U.S. State Biometric Laws

Our disclosures and consents are designed to support compliance with the Texas Capture or Use of Biometric Identifier Act and the Washington Biometric Privacy Act.

14.8 New York City - Local Law 144

NYC employer-Clients are responsible for compliance with NYC Admin Code §§ 20-870 to 20-874. Our most recent bias-audit summary is at bitstage.ai/fairness.

14.9 Maryland - HB 1202

The Service does not perform facial recognition.

14.10 Geographic Scope and International Principles

Users outside North America should not access or use the Service. Our practices are designed to be substantially aligned with GDPR principles to the extent compatible with our North American operating scope.

The Service is intended for Users aged eighteen (18) and older. We do not knowingly collect Personal Data from anyone under 18.

In the event of a personal-data breach likely to result in risk to your rights and freedoms, we will:

• Notify the relevant data-protection authority as required by law (PIPEDA as soon as feasible, and within 72 hours in jurisdictions with 72-hour timelines).
• Notify affected individuals without undue delay where the breach is likely to result in high risk.
• Provide nature of breach, categories and approximate number affected, likely consequences, and mitigation.
• For Tier A application data, notify the relevant Client without undue delay.

• No data sales.
• No automated hiring. Humans always in the loop.
• No identification biometrics.
• No protected-characteristic detection.
• No inducement. Privacy-protective Consent Tier choices never affect score or experience.
• No training without opt-in.
• Not a consumer reporting agency. BitScore is not a "consumer report".

Material changes will be communicated by email and in-app notice at least thirty (30) days before they take effect. The most recent version is always at bitstage.ai/privacy.

BitPlan Loyalty Inc., Collingwood, Ontario, Canada.

• Privacy team: info@bitstage.ai
• Algorithmic fairness and disputes: info@bitstage.ai
• Compliance documentation: info@bitstage.ai
• Security incidents: info@bitstage.ai

Last updated: June 8, 2026