Is Your Interview Being Used to Train AI?

Most hiring platforms do not promise that your interview stays out of their training data. They promise something narrower, and the gap between the two is where the useful detail sits. Read on 27 October 2026, the published policies of six platforms fall into four groups: one reserves the right to train on your interview outright, one built its scoring models on applicant interviews and says so, one makes a no-training promise to the employer rather than to you, and the rest say nothing about training at all — including Control.

This article is about model training specifically: whether your recorded answers, code, and transcripts become material that improves a vendor's models. What a platform captures during the session, and who reviews it afterwards, are separate questions covered elsewhere on this blog.

Where each platform stands, as of 27 October 2026

The table compresses six documents that are not written to the same template, so the groupings below matter more than the rows.

micro1 is the explicit case

micro1's Privacy Notice for Candidates, last updated 21 July 2026, states: "we reserve the right to use de-identified information collected from interviews, including audio, video, transcripts, and assessment results, to train and enhance our proprietary machine learning models."

The same notice draws a boundary around that: "we do not share your data, de-identified or otherwise, with AI model companies for the purposes of training their models," and says foundational model providers process data for micro1 "but never to train their models." The opt-out is blunt. Section 7 directs candidates who want to "opt-out of AI training on your information" to delete their account.

This is the clearest language of the six, and clarity cuts both ways: micro1 tells you what it does, and what it does is train on interviews. For what the session itself captures before any of this applies, see what a micro1 Zara interview records and who sees it.

"De-identified" is the word doing the work

The reason most policies can stay quiet about training is that de-identification moves the data outside the policy's scope before the question arises.

micro1 states it directly: de-identified data "is not subject to any restrictions under this Privacy Policy." CodeSignal's privacy policy, effective 4 September 2026, never uses the words "train" or "machine learning," but section 3.7 says CodeSignal "may create aggregated, de-identified or anonymized data from the Personal Data we collect" and may use it "to analyze, build and improve the Services."

Two things follow, and only the first is established by the documents. First, a policy that is silent on training is not a policy that prohibits it; the permission can sit inside a general product-improvement clause. Second — and this is inference rather than something any of these policies state — de-identification is a weaker protection for interview media than for tabular data, because a voice recording and a face are themselves identifiers. None of the policies reviewed here describes the de-identification method used, so a candidate cannot tell whether "de-identified" means a stripped name field or a genuinely non-reversible transformation.

HackerRank's no-training promise is made to the employer

HackerRank's AI Addendum is unambiguous: "HackerRank will not use Customer Data to develop, train, or improve any AI Features," and HackerRank "does not permit any AI Provider to use Customer Data" for the same purposes.

Customer Data is a contract term. The addendum is an agreement between HackerRank and the company that bought the platform, and the addendum states that AI feature inputs and outputs are "Customer Data owned by Customer." The candidate is the subject of that data, not a party to the agreement.

Read alongside it, HackerRank's Responsible AI page describes a pipeline in which training does happen: personal data is removed "before training any of our AI systems," which "ensures that training data cannot be linked back to individual candidates or users of our platform." The page also says candidate data "is not cross-pollinated between company assessments" and names OpenAI among the providers involved in platform testing.

Both statements can hold at once — a contractual restriction on identified Customer Data, plus a training pipeline that runs on data with personal details stripped out. What does not resolve the question is the document written for candidates. HackerRank's Candidate AI Notice does not mention training at all. It grants a right to "Request human review of decisions made or substantially assisted by AI," notes that this depends on your location, and says you may decline consent to biometric verification, though declining "may prevent participation in assessments requiring biometric verification."

HireVue's models were built on applicant interviews

HireVue's 2025 AI Explainability Statement is the one document in this set that quantifies the practice. It says HireVue's "AI assessment systems are trained on HireVue's own data," that the company "collects thousands of expert human rater evaluations of standardized interviews," and that it has "drawn upon over 900,000 applicant video interviews scored and evaluated for bias."

The statement also says data "collected during such interviews can later be mapped against the performance of those who were hired," recommends a two-year retention period while deferring to company policy, and says HireVue retains "all raw data necessary to rescore interviews when problems are found and fixed." Candidates "have the option to opt in or out of the use of AI in evaluating their responses."

What the statement does not say is whether a specific candidate's interview, recorded today, feeds future model development beyond those rater studies. It describes the corpus the models were built from, not the ongoing intake. For what a HireVue session captures in the first place, see how HireVue records and scores an interview.

Codility and Control say nothing about training

Codility's Trust Center, last reviewed 6 October 2026, says "Codility processes candidate and user data only to run assessments and interviews for you" and that "No AI or machine learning makes a hiring decision on Codility." Neither sentence addresses training. The page points to a Data Processing Agreement dated 13 August 2026 for the subprocessor list, summarizes deletion as occurring "within 90 days of the processing end date," and notes that the employer, not the candidate, "decide[s] how long candidate data stays identifiable."

Control is in the same group, and it is worth saying plainly rather than leaving to a footnote. Control's privacy policy, effective 24 September 2026, does not state whether submitted content is used to train AI models. It names no specific model providers, referring instead to "AI, model-routing, OCR, and speech providers" that "may vary based on availability, configuration, performance, and the model or feature selected." It sets retention by data type rather than by fixed period: saved sessions, messages, transcripts, screenshots, and files are "retained until you or Control delete them." Silence is not a commitment, and that applies to the policy on this site as much as to the five others.

What you can actually do about it

Find the candidate-facing document, not the trust page. Vendor trust centers and AI addenda are written for buyers. HackerRank's split across three documents shows how different the candidate-facing version can be. Search the vendor's site for a candidate privacy notice specifically.

Ask in writing, before the session. A recruiter can put the answer in email, which is more useful than a policy that may be revised. Two questions cover most of it: is my recording or transcript used to develop your models, and does that change if the data is de-identified?

Use the opt-in where one exists. HireVue documents an opt-in/opt-out for AI evaluation of responses. Most platforms in this set do not offer an equivalent.

Treat deletion as a partial lever. micro1 frames account deletion as the training opt-out, and most policies honor deletion requests. But where a policy states that de-identified data falls outside its restrictions, deleting your account does not obviously reach data already de-identified. If recovering or removing a recording is the goal, how to get your interview recording deleted covers the request mechanics and where they tend to stall.

What this review does not establish

These are published policies, read on one day. They describe permissions a vendor has reserved, not behavior anyone has observed or audited. No independent testing was performed for this article, and none of these claims were verified against a vendor's actual data pipeline.

Three further limits are worth stating. Subprocessor lists generally sit inside Data Processing Agreements that candidates never see. Several of these documents carry no effective date at all, so "current" is an assumption. And policies are revised without notice to candidates, which means the quotations here should be rechecked against the live page before anyone relies on them.

The practical conclusion

If you are deciding how much to worry, the honest answer is that it depends on the platform and that most of them have not told you. One vendor in this set says it trains on interview media and tells you how to opt out. One has published the scale of the corpus its models were built on. The rest have either promised the employer something they have not promised you, or have left training unmentioned inside a general improvement clause that de-identification already exempts.

The actionable part is narrow but real: read the candidate notice rather than the trust page, ask the recruiter in writing, and take any AI-evaluation opt-out that is offered. If you want to apply the same scrutiny to the tools you bring to an interview rather than the ones the employer brings, the candidate-side privacy checklist for AI interview assistants turns the same questions into a data-flow review you can run on any product, Control included.