Back to home
Legal
Privacy Policy
Last updated: 24 September 2026
This Privacy Policy explains how SmashTaps LLC ("SmashTaps", "we", "us", or "our"), a limited liability company incorporated in the State of Delaware, United States, collects, uses, shares, and protects personal data in connection with Molly, our AI-assisted hiring and skills-assessment service (the "Service"), available at hellomolly.io and related domains.
We take your privacy seriously. This policy is written to meet the standards of the EU/UK General Data Protection Regulation (GDPR) and Sri Lanka's Personal Data Protection Act, No. 9 of 2022 (PDPA), and applies to everyone who uses Molly regardless of where you are located.
Please read this policy alongside our Terms of Use.
1. Who we are and our role
SmashTaps LLC is the data controller for the personal data described in this policy. This means we determine why and how your personal data is processed.
Molly is a service where:
- Candidates create a profile, complete AI-assisted interviews and assessments, and receive a Molly rating — a portable, reusable indication of demonstrated skill level (comparable to a certificate) that a candidate can use when applying for jobs.
- SmashTaps uses candidate profiles and ratings for its own recruiting and to help match candidates to opportunities. We store and control candidate data within our systems and allow candidates to apply to jobs using that stored data.
If you have any questions about this policy or how we handle your data, contact us at:
Email: molly-support@smashtaps.com
Entity: SmashTaps LLC, Delaware, USA
2. The personal data we collect
We collect the following categories of personal data.
2.1 Data you provide directly
- Account and identity data: name, email address, password/authentication credentials, and profile photo.
- Application and profile data: CV/résumé, work history, education, skills, links (e.g. portfolio, LinkedIn), and any other information you add to your profile or submit in an application form.
- Interview and assessment content: your answers to aptitude tests, written assignments, and questions posed during video or live AI interviews.
- Communications: messages, support requests, and correspondence you send to us.
2.2 Audio, video, and interview recordings
- When you take part in a live AI interview or an asynchronous video interview, we record your audio and video, and we generate transcripts of what is said.
- Recordings are captured and stored through our recording provider, Recall.ai, and accessed by our systems on demand. Transcripts and derived data may also be stored in our own systems.
- We collect these recordings only with your consent, which we request at the point you begin the interview (see Section 4).
2.3 Data generated by the Service
- Molly ratings and evaluations: skill ratings, scores, summaries, and assessment outputs generated from your interviews and assessments using AI.
- Embeddings and matching data: mathematical representations of your profile and job data used to match candidates to opportunities.
2.4 Data collected automatically
- Usage and device data: IP address, browser type, device information, pages visited, and interactions with the Service.
- Cookies and similar technologies: used to keep you signed in, remember preferences, and understand how the Service is used. You can control cookies through your browser settings.
2.5 Data from third parties
- If you choose to import your LinkedIn profile using our browser extension, we collect the profile information you elect to import (e.g. work history, education, photo).
- If you sign in or connect your calendar using Google, we receive basic account information and, where you grant it, calendar availability for scheduling.
3. How and why we use your data
We use your personal data for the following purposes, each with a lawful basis under the GDPR and PDPA.
| Purpose | Examples | Lawful basis |
|---|---|---|
| Provide the Service | Create and maintain your account and profile; run interviews and assessments; generate your Molly rating; let you apply to jobs | Performance of a contract; legitimate interests |
| Conduct interviews and generate ratings | Record and transcribe interviews; use AI to evaluate answers and produce ratings | Consent (for recording); legitimate interests / contract (for evaluation) |
| Recruiting and matching | Use your profile and rating to consider you for roles and match you to opportunities | Legitimate interests; consent where required |
| Communicate with you | Send transactional emails, interview invitations, results, and support responses | Contract; legitimate interests |
| Improve and secure the Service | Troubleshoot, prevent abuse and fraud, analyse usage | Legitimate interests |
| Comply with law | Meet legal, tax, and regulatory obligations | Legal obligation |
We do not sell your personal data.
4. AI, interviews, and human oversight
Molly uses artificial intelligence to help evaluate interviews and assessments and to generate your Molly rating.
- Consent before recording: we ask for your explicit consent before we record any audio or video interview. You can decline, though this may mean you cannot complete that interview format.
- Human in the loop: AI-generated ratings and evaluations are used to assist decision-making. A person reviews outcomes before any hiring decision that produces legal or similarly significant effects for you. You are not subject to a decision based solely on automated processing without human involvement.
- Your rights regarding AI: you may ask us for a meaningful explanation of how a rating was produced, express your point of view, and request human review of an outcome. Contact molly-support@smashtaps.com.
5. Who we share your data with
We share personal data with the following categories of recipients.
5.1 Service providers (processors)
We use trusted third-party providers who process data on our behalf and under contract. These currently include:
| Provider | Purpose |
|---|---|
| Convex | Primary application database and backend |
| Clerk | Authentication and account management |
| UploadThing | Hosting of uploaded files such as CVs and profile photos |
| Brevo | Transactional and notification email |
| Anthropic (Claude) | AI evaluation of interview answers and transcripts |
| Pinecone | Vector search and candidate/job matching |
| Recall.ai | Recording and transcription of live and video interviews |
| Sign-in (OAuth) and calendar scheduling, where you connect it |
Our providers may process data outside your country. Where we transfer data internationally, we rely on appropriate safeguards such as Standard Contractual Clauses.
5.2 Employers and opportunities
Where you apply for a job or ask us to share your Molly-rated profile with an employer, we share the relevant parts of your profile, rating, and application with that employer for the purpose of that opportunity.
5.3 Legal and safety
We may disclose data where required by law, to enforce our terms, or to protect the rights, safety, and security of SmashTaps, our users, or the public.
5.4 Business transfers
If SmashTaps is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, subject to this policy.
6. International data transfers
We are based in the United States and our providers operate globally. If you are located in the European Economic Area, the United Kingdom, Sri Lanka, or elsewhere, your data may be transferred to and processed in countries with different data protection laws. Where we do so, we use recognised safeguards (such as Standard Contractual Clauses) to protect your data.
7. How long we keep your data
We keep personal data only as long as necessary for the purposes described in this policy:
- Profile and rating data: for as long as you maintain an account, and thereafter as needed to provide portable ratings, meet legal obligations, or resolve disputes.
- Interview recordings and transcripts: retained to support your rating and any active applications; deleted or anonymised when no longer needed for those purposes or on valid request.
- Legal and financial records: for the period required by applicable law.
You may ask us to delete your data at any time (see Section 8). Note that recordings stored with Recall.ai are deleted in accordance with our request and their retention controls.
8. Your rights
Depending on your location, you have rights over your personal data, including the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Delete your data ("right to erasure").
- Restrict or object to certain processing.
- Portability — receive your data in a portable format (this is central to Molly: your rating is designed to be portable to you).
- Withdraw consent at any time, where processing is based on consent (this does not affect processing already carried out).
- Request human review of AI-assisted outcomes.
- Lodge a complaint with your local data protection authority — in Sri Lanka, the Data Protection Authority established under the PDPA.
To exercise any of these rights, email molly-support@smashtaps.com. We will respond within the timeframes required by applicable law (generally within 30 days). We may need to verify your identity before acting on a request.
9. How we protect your data
We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, and vetted service providers. No method of transmission or storage is completely secure, but we work to protect your data and to notify you and the relevant authorities of any breach where required by law.
10. Children
Molly is not intended for individuals under the age of 16, and we do not knowingly collect data from them. If you believe a child has provided us data, contact molly-support@smashtaps.com and we will delete it.
11. Cookies
We use cookies and similar technologies to operate the Service, keep you signed in, remember your preferences, and understand usage. You can manage or disable cookies through your browser, though some features may not work without them.
12. Changes to this policy
We may update this policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.
13. Contact us
If you have questions, concerns, or requests regarding this policy or your personal data:
SmashTaps LLC
Email: molly-support@smashtaps.com