Privacy Notice

When individuals access the Platform directly — including without limitation participants in MEVA-administered pilot programs and users who register through gomeva.com — MEVA acts as the data controller. In this capacity, MEVA independently determines the purposes and means of processing personal information, including the collection of assessment data, audio and video recordings, and derived biometric data. All rights described in this Notice apply fully to users interacting with MEVA in its capacity as data controller.

When MEVA provides the Platform to institutional clients (“Customers”) — including universities, employers, and other organizations — pursuant to a Master Service Agreement and Data Processing Addendum, MEVA acts as a data processor on behalf of the Customer, who serves as the data controller. In this capacity, MEVA processes personal information solely pursuant to the documented instructions of the Customer. Customers are responsible for: (a) establishing the lawful basis for collecting personal information from their candidates; (b) obtaining all required consents from candidates prior to initiating an assessment session, including any consents required under BIPA, CCPA/CPRA, or other applicable law; and (c) providing candidates with any required privacy disclosures. Candidates participating in assessments administered by an institutional client should also review any privacy notices provided by that institution.

Verbal responses to assessment prompts, including spoken and text-based content, linguistic patterns, and semantic characteristics captured during your session.

Full audio recordings of your voice and full video recordings of your face and upper body captured during each assessment session. These recordings constitute the raw source data from which biometric data is derived.

Data derived from your audio and video recordings, including without limitation: (a) voiceprint characteristics, including prosodic features such as tone, cadence, pitch, and tremor; and (b) facial expression pattern data, including facial action units used to determine valence states. This biometric data constitutes “biometric information” as defined under BIPA (740 ILCS 14/3) and “Sensitive Personal Information” (“SPI”) as defined under CCPA/CPRA (Cal. Civ. Code § 1798.140(ae)). MEVA processes biometric data solely for the purposes described in Section 3 of this Notice.

Your name, personal email address, IP address, and device identifiers provided at registration or collected automatically during Platform use.

Session timestamps, login activity, session duration, page interactions, and related usage logs.

Cookies, analytics data, and browsing behavior collected when you visit gomeva.com, as further described in our Cookie Policy at gomeva.com/cookies.

MEVA collects the following biometric identifiers and biometric information as defined under BIPA: (a) scans of facial geometry derived from video recordings captured during assessment sessions; and (b) voiceprints derived from audio recordings captured during assessment sessions. MEVA does not collect fingerprints, retina scans, iris scans, or hand geometry.

MEVA collects biometric identifiers and biometric information solely to evaluate emotional valence, arousal, and behavioral congruency as part of a structured assessment, and to train and improve MEVA’s proprietary AI-based assessment system. Biometric identifiers and information are not collected for identification purposes and are not used to identify any individual.

MEVA retains biometric identifiers and biometric information until the first of the following events occurs:

• The initial purpose for which the biometric data was collected has been fulfilled (e.g., the applicable assessment has been completed and the Emotional Readiness Score has been generated and delivered);
• Three (3) years have elapsed since the individual’s last interaction with the Platform; or
• A verified deletion request is received and processed in accordance with Section 4.4 of this Notice.

Upon the occurrence of the applicable triggering event, MEVA will permanently destroy biometric identifiers and biometric information using a method that renders the data irretrievable, except to the extent such data has been incorporated into aggregated, de-identified AI training datasets, in which case individual retrieval may not be technically feasible.

Individuals may submit a verified request for the deletion of their biometric identifiers and biometric information prior to the expiration of the applicable retention period by contacting MEVA at support@gomeva.com. MEVA will process verified deletion requests within forty-five (45) calendar days and will provide written confirmation of the deletion.

MEVA will not sell, lease, trade, or otherwise profit from an individual’s biometric identifiers or biometric information. MEVA will not disclose or disseminate biometric identifiers or biometric information to any third party unless: (a) the individual provides a written release; (b) disclosure is required by applicable law or valid legal process; or (c) disclosure is to a sub-processor acting on MEVA’s behalf pursuant to a written agreement that imposes at least the same level of protection as this policy.

MEVA stores, transmits, and protects biometric identifiers and biometric information using a reasonable standard of care within its industry, and in a manner that is at least as protective as the manner in which MEVA stores, transmits, and protects other confidential and sensitive personal information in its possession. All biometric data transmitted through the Platform is encrypted in transit, and access is restricted to authorized personnel with a legitimate business need.

Prior to collecting biometric identifiers or biometric information from any individual, MEVA (where acting as data controller) or the applicable institutional client (where acting as data controller) will: (a) inform the individual in writing that biometric identifiers or information are being collected or stored; (b) inform the individual in writing of the specific purpose and length of term for which the biometric identifiers or information are being collected, stored, and used; and (c) receive a written release executed by the individual or the individual’s legally authorized representative. Institutional clients are contractually required to satisfy these obligations with respect to their candidates prior to initiating any assessment session.

For direct registrations and MEVA-administered pilots, MEVA retains raw audio and video recordings for up to twelve (12) months from the date of collection, and assessment response data and identity data for up to thirty-six (36) months from the date of collection, unless an earlier deletion is required by law or requested by the individual, or a longer retention period is required by a legitimate business purpose such as pending legal claims or regulatory inquiry. In no event will MEVA retain biometric identifiers or biometric information beyond the limits specified in Section 4.3.

Where MEVA processes personal information on behalf of an institutional client, MEVA retains such information only as long as instructed by the Customer pursuant to the applicable Master Service Agreement and Data Processing Addendum, and in any event no longer than the periods described in Section 7.1. Upon termination of the Customer agreement, MEVA will delete or return Customer data within ninety (90) days, except to the extent retention is required by applicable law. Personal information collected in processor mode is not used to train MEVA’s AI system unless the applicable Customer agreement expressly permits such use or the data has been de-identified in a manner that satisfies CCPA/CPRA de-identification standards (Cal. Civ. Code § 1798.140(m)).

California residents have the right to: (a) know the categories and specific pieces of personal information collected, the purposes for collection, and the categories of third parties with whom it has been shared; (b) access a copy of their personal information; (c) correct inaccurate personal information; (d) request deletion of personal information, subject to applicable legal exceptions; (e) limit the use and disclosure of Sensitive Personal Information, including biometric data, pursuant to Cal. Civ. Code § 1798.121; (f) opt out of the sale or sharing of personal information; (g) opt out of automated decision-making technology (“ADMT”) used for significant decisions, as required under CCPA regulations effective January 1, 2026; and (h) non-discrimination for exercising any of these rights.

Illinois residents whose biometric information has been collected by MEVA have the rights described in Section 4 of this Notice, including the right to receive written notice of collection, the right to execute a written release prior to collection, and the right to request deletion of biometric identifiers and information as set forth in Section 4.4.

All users may withdraw consent to processing at any time by contacting support@gomeva.com. Withdrawal of consent will not affect the lawfulness of processing that occurred prior to such withdrawal, but will prevent further processing and may prevent the user from completing an assessment session. All users may also request deletion of their personal information as described in this Notice.

Users who do not wish to have their assessment responses evaluated by MEVA’s AI system may select the human review option at the start of their session, where available, or contact support@gomeva.com prior to their session. Opting out of AI-based evaluation will not disqualify a user from the assessment process.