Last updated 18 September 2026

Privacy notice

Cadra is the Data Fiduciary for this processing.

This notice itemises what Cadra collects when you use the assessment product, why, and who can see it.

What we collect

• Name and email — to create and sign in to your account.
• Phone number and institution — where these are provided. Often your employer or the hiring organisation supplies them when they add you to a cohort, rather than you entering them yourself. They appear on the report the hiring team sees.
• Organisation and cohort membership — to show the assessments you are assigned and to keep data inside your organisation.
• Developer profile links you give us — GitHub, LeetCode, Kaggle, LinkedIn, portfolio, and a repository you nominate as your best project, along with any notes you add. Used for the pre-screen assessment.
• Public profile information we fetch from those links — where you have given us a profile link, we retrieve publicly available information from that platform (for example public repositories or public activity) and store the result with your assessment. We do not access anything private and we do not log in as you.
• Source / repository URL — when you submit a coding assessment.
• Chat and tool transcript — from the assessment session (Cadra-managed environment or your own Claude Code session).
• Integrity hashes and provenance — fingerprints of lines and files produced in the session, used to show how the submitted work relates to that session. This is not a recording of you.
• Scores and reports — produced from your submission. The hiring team for your cohort can see these.
• IP address and browser user-agent — recorded in our server logs whenever you use the product, and used to operate and secure the service. We also count recent failed sign-in attempts against an email address and a source address, to limit password guessing. Security logs are retained for up to one year.

We do not collect a resume file today. If a later assessment asks for one, this list will be updated.

Telemetry

Separately from the list above, we record:

• how long the session ran
• whether you used the managed environment or your own tools
• usage against the cohort budget

This is used to run the session and to read integrity in context. We do not infer grit, learning agility, communication style, or employability from it.

What we do not collect

We do not collect keystroke dynamics, webcam video, or screen recording.

Where it is stored and processed

Application compute runs in Google Cloud asia-south1 (Mumbai).

Candidate and employer personal data is stored in Supabase ap-northeast-2 (Seoul). A move to an India region is planned.

We use OpenRouter for model access. OpenRouter does not retain prompt or completion content by default and does not train on it. Individual upstream model providers apply their own retention policies. Cadra's own proxy does process prompt content — for token accounting, budget enforcement, and assessment integrity — and assessment transcripts are stored with your assessment record.

How long we keep it

How long we keep it:

• Your account, assessments, transcripts and reports — kept for as long as your account exists and the hiring organisation needs the result. We do not delete these automatically today. If you want your data removed, write to us and we will tell you what we can erase and what we must keep.
• Security and processing logs — up to one year, then deleted automatically by our log store.
• Invitation links — expire 24 hours after they are issued, and stop working once used.

Who can see it

Cadra operators, as needed to run the product. Admins in your organisation. Not another company's admins.

Your rights

You can ask us to:

• tell you what personal data of yours we hold, and why
• correct or complete anything that is wrong or out of date
• erase data where we are not required to keep it
• explain how an assessment result was produced

Write to us at the address below and we will respond. Some data belongs to the hiring organisation that invited you — where that is the case we will tell you, and you may need to ask them as well. A Data Protection Board is being established under the DPDP Act; once it is operating you will also be able to complain to it.

Contact

hello@cadra.work. This is not a Data Protection Officer.

How we host and protect this data: Security overview.