Effective Date: September 22, 2026 Last Updated: October 8, 2026
16Signals ("Company," "we," "us," or "our") operates the EBTA platform (the "Platform"), which helps Employers obtain supplementary, evidence-based context about a Candidate they are already considering. This Policy explains what personal data we collect from Employers and Candidates, how we use it, how long we keep it, and your rights.
This Policy should be read with our Terms of Service. Capitalized terms not defined here have the meaning given there.
Controller/Processor Note. For Employer account and billing data, we act as the data controller (or "business," under the CCPA). For Job Descriptions and Candidate materials an Employer submits, we generally act as a processor/service provider on the Employer's behalf. For data we collect directly from a Candidate through their own account-connection and repository-designation actions, we act as an independent controller, since the Candidate — not the Employer — authorizes and controls that data.
1. Data We Collect
1.1 From Employers
- Identity and contact data: name, work email, job title, company name.
- Billing information: billing contact and address; payment card/bank details are collected and processed by our third-party payment processor, and we retain only limited billing metadata (e.g., invoice history) for our own accounting.
- Account and usage data: login credentials (stored in hashed form), account configuration, subscription tier, and records of your interactions with the Platform.
- Content you submit: Job Descriptions and any Candidate materials (e.g., a resume) you choose to submit, which we process on your behalf.
- Technical data: IP address, browser/device information, and similar data collected automatically when you access the Platform.
- Fraud-prevention signals: at signup, a device signal (derived from browser/device attributes) and a randomly generated visitor identifier, combined with your network (IP-derived) information, used solely to assess signup risk. See Section 3 for retention.
1.2 From Candidates
- Contact and invitation data: the email address used to invite you, and records of invitation issuance, expiration, and use.
- Account-connection data: information confirming that you have connected your code hosting account and which repositories are available for you to use with the Platform. Connecting your account, by itself, does not involve any evaluation of a repository's content.
- Repository identifiers. When you designate a specific repository for a specific Brief request, we record an identifier for that repository. No repository content is accessed, transmitted, or stored at this stage — only the identifier, so the Platform knows which repository to evaluate if and when analysis is later triggered.
- Repository content — accessed only during analysis, never stored. When a designated repository is actually analyzed (see Section 2), its content is accessed solely for that purpose and is not written to persistent storage. It is discarded immediately once analysis is complete, and is never provided to any third-party AI model or used to train any model, for this or any other purpose.
- Evidence. The retained output of analysis is a set of abstracted, derived measurements — such as indicators of structure, complexity, and demonstrated proficiency in particular technical areas. Evidence does not include, and is not designed to permit reconstruction of, your source code or any underlying business logic. This is what is stored in your Vault, described further in Section 3.
- Candidate Portal activity: actions you take in the Candidate Portal, such as connecting your account and designating a repository for a specific Brief request.
- Technical data: IP address and similar data collected automatically when you access the Candidate Portal or an invitation link.
1.3 What We Do Not Collect
We do not access repositories you have not specifically designated, and we do not access or evaluate any repository content before you have both connected your account and designated that repository for a specific Brief request.
2. How We Use Data
- To generate a Brief: matching a Candidate's Evidence against a Job Description to produce supplementary, evidence-based context for the requesting Employer.
- To maintain the Vault: so a Candidate's previously evaluated repositories can support future Brief requests without re-accessing or re-evaluating the underlying content, as long as a repository has not changed since it was last analyzed; a changed repository is analyzed again when it is next designated for a Brief.
- To operate the Candidate Self-View: showing Candidates the status of their own application and a summary of any private verification they completed for it.
- To manage accounts and billing.
- To communicate with you: invitations, status updates, and service notices.
- To maintain security and integrity: detecting fraud, abuse, or manipulation, and protecting the Platform and its users.
- To improve the Platform: using aggregated, de-identified usage data. Repository content is never used for this purpose.
- To comply with legal obligations.
Shared GitHub accounts. If a GitHub account used for verification is linked to another application under a different name, the employer may see that other name to help prevent fraud. The employer sees only the name entered for that other application: never the GitHub username you proved in the verification, and nothing else about that other application. This note asks the employer to review; it never blocks or rejects an application. If you think it is wrong, email info@16signals.com; if our review finds no account sharing, we remove the note.
How AI is used. A limited, separate process may be used to render already-extracted Evidence into readable narrative for an Employer. This process operates only on abstracted Evidence — it does not access, view, or evaluate repository content, and it does not determine the Evidence itself. Any Brief provided to an Employer includes the underlying Evidence, not merely an AI-generated narrative of it.
Legal bases (where GDPR or similar law applies). (i) Consent — for a Candidate's connection of their account and designation of a repository, withdrawable at any time; (ii) contract performance — for Employer account administration and billing; (iii) legitimate interests — for security, fraud prevention, and Platform improvement; and (iv) legal obligation.
3. Data Retention
| Data Category | Retention Approach |
|---|---|
| Repository content | Never persisted. Accessed only during analysis and discarded immediately upon completion. |
| Repository identifiers (designated, not yet analyzed) | Retained with your Candidate account until it is erased, at your request (see Section 4) or automatically after the period of inactivity described below. Triggering analysis or disconnecting your account does not by itself delete them. |
| Evidence (the Vault) | Retained indefinitely so repositories remain reusable across Brief requests, until you request deletion (see Section 4), after which we delete it within the timeframe described there. |
| Briefs delivered to an Employer | Retained per the Employer's own account settings and obligations under the Terms of Service. Deletion of your Vault data does not retroactively remove Briefs already delivered before your request. |
| Employer account and billing data | Retained while the subscription is active, and for a reasonable period afterward (generally up to 7 years) for tax and accounting purposes. |
| Invitation and session data | Retained for a limited operational period tied to invitation validity, then deleted. |
| Technical/log data | Retained for a limited period (generally up to 12 months), then deleted or aggregated. |
| Signup fraud-prevention data (device/network signals) | Retained for 90 days from collection, then automatically purged. |
If a Candidate has not signed in and none of their applications has changed for 24 months, their Candidate account, including their Vault data, is erased automatically, after a notice sent 30 days beforehand to the email address we hold for them, if any; signing in before then keeps the account.
We may retain data longer where necessary to comply with law, resolve a dispute, or enforce our agreements.
4. Your Rights
4.1 GDPR / UK GDPR and Similar Frameworks
You have the right to: access your data; rectify inaccurate data; erase your data (including Evidence in the Vault); restrict or object to certain processing; port your data; withdraw consent at any time (for Candidates, this includes disconnecting your account); and lodge a complaint with your supervisory authority.
4.2 CCPA/CPRA and Similar U.S. State Laws
You have the right to: know what categories of personal information we collect, use, and disclose; delete personal information, subject to exceptions; correct inaccurate information; opt out of sale or sharing — we do not sell or share personal information for cross-context behavioral advertising; limit use of sensitive personal information where applicable; non-discrimination for exercising these rights; and appeal a denial.
4.3 Candidate-Specific Controls
You can, at any time, without a formal request: disconnect your account through your code hosting provider's settings, which the Candidate Portal links to; and view the status of your application, and a summary of any private verification you completed for it, through the Candidate Self-View. To request deletion of your Vault data, or a copy of your data, contact info@16signals.com.
4.4 Employer-Specific Controls
You may delete your Employer account at any time through your account settings or by contacting info@16signals.com. Deletion is subject to a 30-day grace period, during which it can be reversed by logging back in or contacting us; after that period, your account and associated personal data are permanently deleted, subject to the retention exceptions described in Section 3 (e.g., billing/tax records).
4.5 How to Exercise Your Rights
Email info@16signals.com or use in-product controls. We may verify your identity before fulfilling a request. We respond within the timeframe required by law — generally 30 days for GDPR-based requests and 45 days (extendable by 45 days) for CCPA-based requests, at no cost, subject to limited exceptions for manifestly unfounded or excessive requests.
5. Data Sharing and Third Parties
We share data only as necessary to operate the Platform, with categories of recipients including: cloud infrastructure and hosting providers; your code hosting provider (governed by its own privacy practices); service providers that support the limited AI-assisted narrative step described in Section 2, which receive only abstracted Evidence, never repository content; payment processors; professional advisors and successors in a corporate transaction, under confidentiality obligations; and regulators or law enforcement where required by law.
We do not sell personal information, and repository content is never shared with any third party under any circumstances.
5.1 International Data Transfers
Where we transfer personal data across borders, we rely on appropriate safeguards such as Standard Contractual Clauses or other recognized transfer mechanisms.
6. Automated Processing
The Brief is generated through a combination of our internal analysis process and a limited, downstream text-generation step. We want to be clear about what this does and does not involve:
- The internal analysis process identifies only measurable, code-derived indicators — it does not "decide" anything about a Candidate.
- The downstream text-generation step operates solely on already-extracted Evidence to produce readable narrative; it does not access repository content and does not itself determine the underlying Evidence.
- The Platform does not rank, score, compare, sort, or shortlist Candidates against one another, and the Brief does not constitute, automate, or substitute for a hiring decision. It is supplementary context provided to an Employer about a single Candidate the Employer has already chosen to evaluate further; the Employer's own personnel make all hiring decisions.
- Where applicable law (such as GDPR Article 22) provides rights regarding decisions based solely on automated processing with legal or similarly significant effects, you may contact info@16signals.com to ask about the human-review practices in place or to raise questions about a specific Brief.
- Employers are separately responsible for determining whether laws governing automated tools in hiring apply to their specific use of the Platform and for complying with any applicable requirements — see Section 2.5 of the Terms of Service.
7. Security
We use administrative, technical, and physical safeguards designed to protect personal data, including the immediate, non-persistent handling of repository content described in Section 1.2. No system is completely secure. If we become aware of a data breach affecting your personal data, we will notify you and/or relevant authorities as required by applicable law.
8. Children's Privacy
The Platform is not directed to individuals under 18. If we learn we have collected personal data from someone under 18, we will delete it.
9. Cookies and Similar Technologies
We use cookies and similar technologies for authentication, session management, security, and, where permitted, analytics. Where required by law, we provide a cookie consent mechanism.
10. 16signals Verify Browser Extension
"16signals Verify" (the "Extension") is our Chrome browser extension. A Candidate can use it to prove facts about their GitHub work to us, as part of an application, without giving us their GitHub password or access to their GitHub account. It uses open-source cryptography to create a proof that data really came from github.com. This section explains what the Extension does with your data. The rest of this Policy also applies to the data we receive through it.
10.1 When the Extension Runs
- The Extension does nothing on its own. A check starts only when you press Continue in the verification step on https://app.16signals.com, and it ends when the check is done or you close its window.
- The Extension only has access to github.com and app.16signals.com. It does not run on any other website.
- During a check, the Extension opens one small github.com window of its own and uses the GitHub account you are already signed in to in that browser. It only looks at the GitHub requests of that window, never at your other tabs.
10.2 What the Extension Reads
In its own GitHub window, and only for the GitHub organization you chose, the Extension reads:
- Your signed-in GitHub username, from your GitHub session, to check that the check runs on the account you chose. If a different account is signed in, the Extension stops before reading anything else and tells the 16signals page which account is signed in, so you can switch accounts.
- Your membership of the organization: from the organization's people page and your own organizations page, whether you are a member or an owner of that organization. Other organizations listed on those pages are not revealed.
- Facts about the organization: whether GitHub shows it as Verified, its repository and member counts, and the programming languages GitHub lists for some of its repositories.
- Your activity in the organization: your yearly contribution totals, the mix of your activity there (for example commits, pull requests, issues and code reviews, as percentages), and your activity counts for the current month. These are numbers only.
- Your pull requests in the organization: the merged pull requests you authored there before the date you were invited to apply, with their titles (when title reading is enabled for the check), labels, repository names, pull request numbers, comment counts, state and dates. For some of them, the Extension also reads the changed files' types (for example ".ts"), lines added and deleted, and whether a file is generated, vendored, a package manifest or CI configuration. It does not read file names, source code or file contents.
10.3 What Leaves Your Browser
- The Extension sends only the parts of those GitHub pages that the check needs, plus the addresses of the pages it requested, to our verifier at verify.16signals.com. The verifier checks the proof and passes the result to us. The Extension sends nothing to anyone else, and nothing at all when no check is running.
- Your GitHub cookies, password and sign-in tokens are never revealed or sent to us. Your GitHub session is used only inside the encrypted connection to GitHub, so that GitHub returns your pages; it passes through our verifier only in encrypted form, which the verifier cannot read. A proof that would reveal sign-in data is discarded.
- The connection to GitHub is routed through our verifier, which fetches the GitHub pages on your behalf. GitHub therefore sees our verifier's network address, not yours. The verifier passes the encrypted traffic through and can read only the parts that are revealed.
- While a check runs, the Extension also tells the 16signals page its progress (for example "step 3 of 8"). It sends nothing from GitHub's pages that way.
10.4 What the Extension Does Not Do
- It does not collect your browsing history, and it does not track you across websites.
- It contains no analytics and no advertising.
- We do not sell or transfer data received from the Extension, and we do not use it for anything other than the verification you asked for. It is never used for advertising or to determine creditworthiness.
- Our use of information received from the Extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.
10.5 What Is Stored on Your Device
The Extension does not store your GitHub data, your proofs or their results on your device; it holds them in memory only while a check runs. The only thing it may keep in the browser's storage for the Extension is one technical setting (how detailed its own diagnostic logs are), until you remove the Extension.
10.6 Retention, Deletion and Your Rights
Verification results we receive through the Extension are kept and deleted as described in Section 3, and you can exercise your rights over them as described in Section 4, including asking us to delete them. Employers you apply to see only a summary of a completed verification, never your pull request titles, repository names, pull request numbers or GitHub sign-in data.
10.7 Removing the Extension
You can remove the Extension at any time: open chrome://extensions in Chrome, find 16signals Verify, and click Remove. This also removes its stored setting. Removing the Extension does not delete verification results we already received; to delete those, see Section 4.5.
11. Changes to This Policy
We may update this Policy from time to time. Material changes will be reflected in the "Last Updated" date and, where required by law, communicated by additional notice.
12. Contact Us
16Signals Email: info@16signals.com
We have not designated a formal EEA/UK representative at this time. If you are located in the EEA or UK, you may still contact us at the email above, or lodge a complaint with your local data protection authority.
*End of Privacy Policy.* ~