Privacy Policy

Zerva is an applicant tracking platform operated by Divinify LLC, a Georgia limited liability company ("Divinify," "we," "us," "our").

This Privacy Policy explains how we handle personal information. Please read the next section first — it determines which parts of this policy apply to you.

1. Start Here: Which Part Applies to You?

We handle personal information in two very different roles, and your rights depend on which one is involved.

If you visited our website or contacted us about Zerva

You're interacting with us directly. We decide what to collect and why — in privacy terms, we are the controller. Sections 2 through 5 apply to you. Contact us at info@zerva.us with any questions.

If you applied for a job through a company that uses Zerva

Your information belongs to the hiring office you applied to, not to us. They chose to use Zerva to manage their recruiting. They decide what to ask you, what to do with your answers, how long to keep them, and whether to hire you. We simply operate the software that stores and moves that information for them — in privacy terms, they are the controller and we are the processor.

What this means practically:

• Questions about your application, your interview, or your data go to the company you applied to — not to Divinify. We can't answer questions about your candidacy, and we generally can't delete or change your information without their instruction, because it isn't ours.
• If you don't know how to reach them, or you contact us by mistake, email us at info@zerva.us. We'll do our best to point you to the right hiring office and, where required by law, we'll pass your request along to them.
• Section 6 describes what we do with applicant information on our customers' behalf, so you can see how it's handled.

If you're a Zerva customer (a business using the platform)

Sections 2 through 5 cover your own account information. Section 6 and the Data Processing Addendum cover the applicant data you process using Zerva.

2. Information We Collect Directly

Website visitors. When you visit zerva.us, we collect basic technical information automatically — IP address, browser and device type, pages viewed, referring site, and timestamps. This is standard server and analytics data used to keep the site working and understand how it's used.

People who contact us. If you fill out a form, request a demo, or email us, we collect what you send — typically name, business name, email address, phone number, and whatever you write to us.

Customers. When you sign up for Zerva, we collect account and business information: your name, email, phone number, business legal name, business address, EIN, and website. We collect EIN and legal business name because carriers require them to register your business for text messaging — see Section 4.

Billing. Payments are processed by Stripe. We receive confirmation of payment, the last four digits and type of card, and billing status. We never see or store your full card number.

Support and communications. Records of support requests, and emails or messages you exchange with us.

Usage data. How you use the platform — features used, actions taken, timestamps, error and performance data. We use aggregated and de-identified usage data to operate, secure, and improve Zerva.

We do not use customer or applicant data to train artificial-intelligence models, and our AI providers are contractually prohibited from training their models on it.

3. Why We Use It

We use the information in Section 2 to:

• provide, operate, secure, and improve the Service
• create and manage your account, and authenticate users
• register your business for text messaging with carriers (required — see Section 4)
• process payments and manage subscriptions
• provide support and respond to your questions
• send service and administrative messages (billing notices, security alerts, changes to terms, outages)
• send marketing about Zerva, where permitted — you can opt out of marketing at any time using the unsubscribe link or by emailing info@zerva.us; you can't opt out of essential service messages while you have an account
• detect, investigate, and prevent fraud, abuse, and security incidents
• comply with law and enforce our agreements

We rely on our contract with you, our legitimate business interests, your consent where required, and legal obligations as the bases for these uses.

4. Who We Share It With

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

We share information with service providers who help us run Zerva. They may use it only to provide services to us, under contract. Our current providers include:

| Provider | What it does | |---|---| | Supabase | Database and file storage | | Vercel | Application hosting | | Cloudflare (R2) | Storage for applicant video submissions | | Telnyx | SMS, MMS, and voice communications | | Twilio | SMS, MMS, and voice communications (legacy accounts during provider transition) | | Anthropic | AI analysis and scoring | | Recall.ai | Interview recording and transcription | | Resend | Transactional email | | Stripe | Payment processing | | Railway (n8n) | Workflow automation |

The current list, including any changes, is maintained at zerva.us/legal.

Carriers and messaging registration. To enable text messaging, we submit your business information — legal name, EIN, address, website, and sample messages — to our messaging provider and to The Campaign Registry and mobile carriers, acting on your behalf and with your authorization under the MSA. This is a mandatory industry requirement (A2P 10DLC); messaging cannot be enabled without it.

Legal and safety. We may disclose information if required by law, subpoena, or legal process, or where we believe disclosure is necessary to protect our rights, our customers, or anyone's safety.

Business transfers. If Divinify is involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction. We'll notify affected customers.

5. Cookies and Analytics

Our website uses cookies and similar technologies that are necessary for the site to work (session management, security, load balancing) and basic analytics to understand traffic and improve the site.

You can control cookies through your browser settings; blocking necessary cookies may break parts of the site. We do not use advertising cookies or sell data to advertisers.

6. Applicant Data We Process for Our Customers

This section describes information we handle on behalf of our customers — the hiring offices using Zerva. They control it; we process it under their instructions.

What's involved

Depending on how a hiring office configures Zerva, this can include: name, email address, phone number, mailing or general location, résumé and its contents, work history, application form answers, interview scheduling data, interview recordings and transcripts, AI-generated scores and summaries, text and call records with the hiring office, and status in the hiring pipeline.

How it's handled

• We use it only to provide the Service to the hiring office — never for our own marketing, never sold, never used to train AI models.
• AI analysis produces advisory scores and summaries. These are decision-support only. Under our agreement, hiring offices may not use them as the sole basis for any employment decision, and remain responsible for compliance with laws governing automated employment decision tools. A plain-language description of what each AI feature evaluates is published at zerva.us/legal.
• Two kinds of interview media may be involved, and they work differently:
  • One-way video submissions. An applicant records answers to set questions on their own, at their own convenience, and submits them. These videos are stored in private, access-controlled storage and are available to the hiring office.
  • Live interview recording and transcription. When a hiring office enables it, a recording assistant joins a scheduled video interview and produces a recording and transcript. The hiring office is responsible for telling all participants they're being recorded and obtaining consent as required by law, including in all-party-consent states.
• AI analysis of video interviews is regulated in some places. For example, Illinois law requires that applicants be told before an AI-analyzed video interview how the AI works and what it evaluates, that they consent, and that the video and all copies be destroyed within 30 days of an applicant's request. The hiring office is responsible for meeting these requirements; Zerva provides the deletion capability they use to do so.
• We do not perform facial recognition, facial-expression or emotion analysis, or voiceprint identification, and we do not create biometric identifiers. Interview transcripts use speaker names provided by the meeting platform, not analysis of anyone's voice.
• Text messages and calls are sent by the hiring office through the platform. They choose the recipients, content, and timing, and are responsible for consent, message content, and opt-outs.

Applicants under 18

Zerva doesn't set a minimum age for applicants. Where an applicant is a minor, the hiring office is responsible for any parent or guardian consent required — including for recording and AI analysis — and for complying with laws on minors' data.

How long it's kept

Applicant data is kept for as long as the hiring office keeps it. They control retention and deletion within the platform. When a customer's account ends, they have 30 days to export their data, after which we delete it as described in our DPA — subject to routine backup cycles and any retention the law requires.

Applicant requests

Send requests about your information to the company you applied to. They decide what happens to it. If you contact us, we'll help route you to them and, where the law requires, forward your request. We generally can't grant access, correction, or deletion directly, because the data isn't ours to give away or destroy.

7. How We Protect Information

We use safeguards appropriate to the sensitivity of the data, including:

• Encryption in transit and at rest
• Row-level security in our database so each customer's data is isolated from every other customer's
• Private storage for interview media, accessible only through short-lived authorized links
• Access controls limiting employee access to what's needed for their role
• Audit logging of significant actions in the platform
• Vendor review of the providers listed in Section 4

No system is perfectly secure, and we can't guarantee absolute security. If a breach affects personal information, we notify affected customers as described in our DPA and as required by law.

8. Your Privacy Rights

These rights apply to information we control — your website, contact, and customer account information. For applicant data, see Section 6: those requests go to the hiring office.

Depending on where you live, you may have the right to:

• know what personal information we hold and how we use it
• request a copy of it
• correct inaccurate information
• request deletion
• opt out of marketing communications
• opt out of "sale" or "sharing" of personal information — we don't sell or share personal information, so there's nothing to opt out of
• limit use of sensitive personal information
• not be discriminated against for exercising these rights

California residents (CCPA/CPRA): the categories we collect, our purposes, and the parties we disclose to are described in Sections 2 through 4. We do not sell personal information or share it for cross-context behavioral advertising, and we do not knowingly sell the personal information of anyone under 16.

To exercise a right: email info@zerva.us with what you're asking for. We'll respond within the time the law requires, and may need to verify your identity first. You may use an authorized agent where the law permits.

9. Data Location and Transfers

Zerva is designed and offered for use in the United States. Our infrastructure and service providers are located in the U.S., and all information is processed there. We do not offer the Service to customers outside the United States, and Zerva is not intended for processing information about individuals located in the European Union or United Kingdom. Our customers agree under the MSA not to use Zerva to process information about individuals located outside the United States.

If you access Zerva from outside the U.S., you understand your information will be processed in the U.S., which may have different privacy laws than your country.

10. Retention

We keep information for as long as we need it for the purposes described here:

• Customer account information — for the life of the account, plus a reasonable period afterward for legal, tax, and dispute purposes
• Billing records — as required by tax and accounting law
• Applicant data — controlled by the hiring office; see Section 6
• Website and analytics data — for a limited period, then deleted or aggregated
• Support communications — as long as useful for support history and dispute resolution

Backups follow their own rotation and are overwritten on a schedule.

11. Changes to This Policy

We may update this policy. Material changes get a new version number and effective date, and we'll notify customers by email or in the Service at least 30 days in advance. The current version is always at zerva.us/legal.

12. Contact Us

Questions, requests, or concerns:

Divinify LLC — Zerva Email: info@zerva.us

If you applied for a job and have questions about your information, please contact the hiring office you applied to. See Section 1.