Privacy Policy

Last updated: February 3, 2026

Ducker Ltd. ("Ducker," "Company," "we," "us," or "our") runs a technical assessment platform for hiring software engineers. This Privacy Policy explains what personal information we collect, why we collect it, who we share it with, and what control you have over it.

It covers our website, the employer console, and the candidate assessment workspace (together, the "Platform").

If you are a candidate taking an assessment, start with the Candidate Privacy Notice. It is written for you and states exactly what is and is not recorded while you work. This policy still applies, but the candidate notice is the shorter answer.

Ducker Ltd. is established in Israel, our infrastructure runs in the European Union, and the organizations and individuals who use the Platform are located worldwide — so personal information moves across borders as a matter of course. This policy is designed to meet the requirements of the EU General Data Protection Regulation ("GDPR"), the UK GDPR, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), and the Israeli Privacy Protection Law, 5741-1981, together with the Israeli Privacy Protection Regulations (Data Security), 5777-2017. Rights that depend on where you live are set out under "Your Rights" below.

The Two Roles We Play

Ducker handles personal information in two distinct capacities, and your rights depend on which one applies.

We are the controller for information about the organizations that buy Ducker and the people who work for them — account holders, team members, billing contacts, sales prospects, and website visitors. We decide why and how that information is processed.

We are the processor for candidate assessment data. When an employer invites a candidate, runs an assessment, and reviews the resulting report, the employer decides why that processing happens and what to do with the outcome. The employer is the controller. We process that data on the employer's documented instructions under our Data Processing Addendum.

There is one narrow exception: we act as a controller over candidate data for a limited set of our own purposes — securing the Platform, preventing fraud and cheating, meeting legal obligations, and producing aggregated, de-identified statistics as described below under "How We Use Information".

If you are a candidate and you want your assessment data corrected or deleted, the employer who invited you is your first point of contact. We will help them respond, and we will act on their instruction.

Information We Collect

Employer Account Information

• Full name, work email address, and job title
• Organization name and organization settings
• Password, stored only as a salted hash — we never store it in a readable form
• Authentication method and, where you sign in with Google, GitHub, Apple, or Facebook, the basic profile information that provider releases to us (name, email address, profile picture)
• Team members you invite, their roles, and their permissions
• API keys and webhook endpoints you create

Billing Information

Payments are handled by our merchant of record, Lemon Squeezy, LLC. We never receive or store your full card number, card security code, or bank account details. Lemon Squeezy collects those directly, acts as the seller of record for your purchase, and handles sales tax and VAT.

What we store is the subscription state we need to run your account:

• Subscription plan, billing interval, status, and renewal or expiry dates
• Assessment usage counts, included units consumed, and overage quantities
• The identifiers Lemon Squeezy assigns to your customer, subscription, and order records
• Billing contact name and email address, and the country and tax region Lemon Squeezy reports back to us
• Invoice and receipt metadata, including amounts, currency, and payment status

Assessment Configuration

• Job and role definitions, assessment settings, and time limits
• Task selections from our library, and any custom tasks, starter repositories, or hidden tests you author
• Scoring rubrics and weightings
• Candidate names and email addresses that you upload or enter in order to send invitations

You control this information and you are responsible for having a lawful basis to give us candidate contact details in the first place.

Candidate and Assessment Data

During an assessment we record the working session so the employer can review how the work was actually done. This is the core of the product, and it is detailed in full in the Candidate Privacy Notice. In summary, we record:

• Prompts the candidate sends to the AI agent and the agent's responses
• Tool calls the agent makes and their results
• Code written by the candidate, code generated by the AI agent, and which is which
• File changes, diffs, and reverted changes
• Terminal commands and their output
• Tests executed and their results
• Application runs and database operations inside the assessment workspace
• Suggestions the candidate accepted or rejected
• Timestamps, time spent, token usage, agent iterations, and errors encountered
• The final submission, workspace snapshots, grader output, and the resulting report

We do not use a webcam, a microphone, screen recording, or keystroke logging. We do not see anything outside the assessment workspace — not your other browser tabs, not your files, not your browsing history.

Device and Technical Information

Before an assessment starts, the Platform runs a pre-flight check to confirm the candidate's device can actually run the workspace. It reports:

• Browser type and version, and operating system
• WebAssembly, Web Worker, SharedArrayBuffer, cross-origin isolation, and OPFS support
• Approximate device memory, number of logical processors, and available browser storage quota
• Runtime and filesystem benchmark results
• Download speed and network latency to our content delivery network

We also collect standard technical data whenever you use the Platform: IP address and the approximate location derived from it, device identifiers, and request logs.

Website and Product Usage

• Pages visited, features used, and interaction timestamps
• Referring URLs and campaign parameters
• Session duration and frequency
• Error and performance data

Communications

• Support requests, bug reports, and the messages exchanged with us
• Sales enquiries and demo requests
• Survey and feedback responses, which are always voluntary
• Marketing preferences and the record of your consent

Where Assessments Actually Run

Assessment workspaces execute inside the candidate's own browser, using WebAssembly and, for some runtime profiles, an in-browser Linux emulator. The starter repository, the editor, the terminal, and the test runner all run locally on the candidate's machine.

This matters for privacy: code the candidate writes is executed on their device, not on our servers. What reaches us is the telemetry stream described above, the final submission, and workspace snapshots. Hidden tests are never delivered to the browser and are executed separately.

How We Use Information

Where we rely on legitimate interests, we have weighed those interests against your rights and concluded they do not override them. You can ask us for that assessment.

Aggregated and de-identified data. Over time we study which assessment behaviours correlate with strong engineering outcomes, and we use that research to improve tasks, rubrics, and scoring. We only use aggregated or de-identified data for this. We do not re-identify it, and we do not disclose one customer's candidate data to another customer.

We do not use your content, your custom tasks, or candidate assessment data to train foundation models, and we do not permit our AI providers to do so.

Artificial Intelligence Processing

The Platform uses AI in three places: the coding agent that works alongside the candidate, the reviewer agent that produces evidence-backed scoring, and internal tooling that helps author tasks.

To make this work, the relevant content — prompts, code, task definitions, telemetry, and grader output — is sent to our AI providers for inference. We currently use Amazon Bedrock and OpenAI, listed in our sub-processor list, behind an internal abstraction layer so we can change providers.

Under our agreements with these providers:

• Your content is used only to return a response to us
• Your content is not used to train or fine-tune their models
• Content is not retained by them beyond what is needed to run the service and meet their own abuse-monitoring obligations

Scores and reports produced with AI assistance are decision support, not decisions. See "Automated Decision-Making" below.

Cookies and Analytics

We use cookies and similar technologies for three things.

Strictly necessary cookies keep you signed in, protect against cross-site request forgery, and maintain your session. The Platform cannot function without them.

Preference cookies remember settings such as your display options.

Analytics cookies tell us how the Platform is used. We use Google Analytics 4 and Mixpanel. Mixpanel events are sent to our own domain first and relayed to Mixpanel's EU ingestion endpoint, so analytics keeps working for visitors who run content blockers. The relay does not change what is collected — it changes where the request goes.

You can block or delete cookies in your browser settings, and you can install Google's opt-out browser add-on for Analytics. Blocking strictly necessary cookies will break sign-in. Where the law requires consent before non-essential cookies are set, we ask for it before setting them and honour Global Privacy Control signals where we are required to.

How We Share Information

We do not sell personal information. We have not sold or shared personal information for cross-context behavioural advertising in the preceding twelve months, as those terms are defined under California law.

We share information in the following circumstances.

Sub-processors. We use vendors to host, run, and support the Platform — hosting, AI inference, payments, email, analytics, and error monitoring. Each is bound by a written contract that limits them to processing on our instructions with appropriate security. The current list, with each vendor's role and processing location, is published at ducker.ai/subprocessors.

Lemon Squeezy, our merchant of record. Lemon Squeezy sells the subscription to you, collects payment, and handles sales tax and VAT. For payment and tax data it acts as an independent controller under its own privacy policy, not as our processor.

Within your organization. Team members in your organization can see the assessments, candidates, and reports that their role permits.

Between employer and candidate. An employer sees the assessment session and report of the candidates it invited. A candidate does not see other candidates' work.

Legal and safety. We disclose information where we are required to by law, court order, or a valid request from a public authority, and where disclosure is necessary to investigate suspected fraud, protect the security of the Platform, or defend legal claims.

Corporate transactions. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. We will give you notice before your information becomes subject to a different privacy policy.

With your direction. We share information with third parties when you ask us to — for example, when you connect an applicant tracking system.

International Data Transfers

Our production infrastructure runs on Amazon Web Services in the eu-central-1 region (Frankfurt, Germany). Employer accounts, assessment records, telemetry, submissions, and artifacts are stored there. Some edge and certificate services also operate from AWS's us-east-1 region.

Because we are an Israeli company serving mainly United States customers, personal information necessarily moves across borders — to us in Israel, to our United States vendors, and to wherever your team and candidates are located.

We rely on the following safeguards:

• Israel benefits from a European Commission adequacy decision, so transfers from the EEA to us do not require additional safeguards
• Standard Contractual Clauses, with the UK International Data Transfer Addendum where relevant, for transfers to vendors outside the EEA and the UK
• EU-US Data Privacy Framework certification where a vendor holds it
• Transfer impact assessments, encryption in transit and at rest, and contractual security commitments from every vendor

How Long We Keep Information

Where an employer instructs us to delete candidate data sooner, we do. After deletion, residual copies may remain in encrypted backups for up to 90 days before they are overwritten.

Data Security

Technical measures. All traffic is encrypted with TLS. Data at rest is encrypted, including databases, object storage, and backups. Passwords are stored only as salted hashes. Internal service-to-service calls are cryptographically signed and never traverse the public internet. Access to production is controlled by least-privilege IAM roles and is logged. Secrets are held in AWS Parameter Store, never in source code. Hidden tests are never delivered to a candidate's browser.

Organizational measures. Access to personal information is limited to staff who need it. Staff are trained on data protection and bound by confidentiality obligations. We maintain an incident response procedure and review our security policies regularly.

We will notify affected customers and the relevant supervisory authority of a personal data breach without undue delay and within the timeframes the applicable law requires.

No system is perfectly secure. We use commercially reasonable measures, but we cannot guarantee absolute security.

Automated Decision-Making

Ducker produces scores, evidence-backed observations, and a hiring recommendation. These are generated by a combination of deterministic checks, behavioural telemetry, and AI-assisted review.

Ducker does not make hiring decisions, and our output must not be used as the sole basis for one. Employers who use the Platform agree in our Terms of Use to apply meaningful human review before rejecting, advancing, or otherwise deciding about a candidate, and to comply with the employment, anti-discrimination, and automated-employment-decision laws that apply to them.

If you are a candidate and you believe a decision about you was made by automated means alone, contact the employer that invited you. Under GDPR Article 22 and comparable laws, you may have the right to obtain human intervention, express your point of view, and contest the decision.

Your Rights

Your rights depend on where you live. Whatever your location, we will honour the rights below unless the law requires otherwise.

Access. Obtain confirmation of whether we hold information about you, and a copy of it.

Correction. Have inaccurate or incomplete information corrected. You can edit most account information yourself in your settings.

Deletion. Ask us to delete your information, subject to retention we are legally required to maintain.

Restriction and objection. Ask us to limit processing, or object to processing based on legitimate interests. You may object to direct marketing at any time, and we will stop.

Portability. Receive the information you provided in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible.

Withdraw consent. Where processing rests on consent, withdraw it at any time. This does not affect processing carried out before you withdrew.

California residents additionally have the right to know the categories of personal information collected, the sources, the business purpose, and the categories of recipients; the right to delete; the right to correct; the right to opt out of sale or sharing — noting that we do neither; the right to limit the use of sensitive personal information — we do not use personal information for purposes that trigger this right; and the right not to be discriminated against for exercising any of them. You may use an authorized agent, with proof of authorization.

Israeli residents have the rights of review and correction under the Israeli Privacy Protection Law, 5741-1981.

To exercise any right, email privacy@ducker.ai. We will verify your identity before acting and respond within 30 days, or within the shorter period the applicable law requires. If your request concerns assessment data, we will route it to the employer that controls it and support them in responding.

Children's Privacy

The Platform is not directed to anyone under 18, and we do not knowingly collect information from children. If we learn that we have, we will delete it. If you believe a child has given us personal information, contact privacy@ducker.ai.

Third-Party Links

The Platform links to third-party websites and services we do not control. Their privacy practices are their own. Review their policies before giving them personal information.

Changes to This Policy

We may update this policy as the product, the law, or our vendors change. When we do, we will post the updated policy, revise the "Last updated" date, and — for material changes — email you and show an in-app notice. Continuing to use the Platform after a change takes effect means you accept the updated policy.

Complaints

Contact us first at privacy@ducker.ai. We will investigate and respond.

If you are not satisfied, you may complain to a supervisory authority:

• EEA residents — the data protection authority of your country of residence, place of work, or the place of the alleged infringement
• UK residents — the Information Commissioner's Office, https://ico.org.uk
• Israeli residents — the Israeli Privacy Protection Authority, https://www.gov.il/en/departments/the_privacy_protection_authority
• California residents — the California Privacy Protection Agency, or the California Attorney General

Contact Us

Ducker Ltd. Privacy: privacy@ducker.ai Support: support@ducker.ai

We aim to respond to privacy enquiries within 48 hours on business days.

By using Ducker, you acknowledge that you have read and understood this Privacy Policy.