EN
ENKR
theori.io ↗

Previous Privacy Policies and Addendums

Below is the history of previous privacy policies and key addendums for Theori and its services. Each current version links to the consolidated policy or to the individual policy currently in force.

Ver. 1.1 Revision Notice

We have revised the Consolidated Privacy Policy and the GDPR Policy to Ver. 1.1. The revised versions were posted on September 28, 2026 and take effect on October 5, 2026. Until then, Ver. 1.0 applies.

Comparison of the previous and revised text

Comparison of the previous and revised text
Document · Section Before (Ver. 1.0) After (Ver. 1.1)
Privacy Policy Section 2.2 (Job Applicants) Only the careers site (careers.theori.io, GreetingHR) Groups applicants by hiring entity (Theori Korea / Theori, Inc.) and adds Theori, Inc. roles (Ashby) — data collected, data collected automatically for fraud prevention and the limits on its use, interview recording (with consent), AI-assisted review and how to opt out, no sale or sharing, retention periods
Privacy Policy Section 2.5 (How We Collect Personal Data) No job application route listed Adds job application submission (GreetingHR, Ashby) and interview recording and transcription for Theori, Inc. roles (with consent)
Privacy Policy Section 3 (How We Use Your Data) Recruitment: Art. 6(1)(b) Adds Art. 6(1)(f) for AI-assisted review, fraud prevention and retention after the hiring decision; adds interview recording, transcription and summaries for Theori, Inc. roles (consent); the Recruitment purpose now covers AI-assisted review and fraud prevention
Privacy Policy Section 7.1 (Processing Activities We Entrust) Recruitment intake and applicant tracking — provider located in the Republic of Korea Providers located in the Republic of Korea and the United States
Privacy Policy Sections 8.1 and 8.2 (Retention) Job application data: until the hire is confirmed or 90 days from receipt, whichever is earlier Unchanged for Theori Korea roles. Theori, Inc. roles: after the hiring decision, for the record-keeping period or the claims deadline under the law of the country where the role is based (no longer than 1 year; 4 years for California residents; until final resolution if a charge or lawsuit is filed), with the legal basis added
Privacy Policy Sections 3.1 and 9.1 (Automated processing) Automated-processing notice and the right to explanation and human review: Xint, aprism Adds AI-assisted review of applications for Theori, Inc. roles
Privacy Policy Section 9.5(a) (CCPA table) H (sensory) and K (inferences) not collected; no precise location collected Reflects interview recordings (H), AI-generated application evaluations and summaries and fraud-signal summaries (K), location for fraud prevention (G, L), job application data (A, F, I, J) and their retention; marks those categories as disclosed for a business purpose; extends the permitted use of Sensitive Personal Information to responding to security incidents and fraud
Privacy Policy Section 10 (Location Data) No precise location collected or used Adds location collected when an application for a Theori, Inc. role is filled in and submitted from a browser that has already been allowed to share location
Privacy Policy Section 11.1 (Behavioral Data) — Adds Ashby fraud detection
Privacy Policy Section 14 (Scope) — Adds Theori, Inc. Careers (jobs.ashbyhq.com/Theori)
GDPR Policy Sections 1.2(a), 1.3, 2.2 and 7.5 Route for applications from EU residents: theori.io. Scope: EU/EEA and UK Adds the Theori, Inc. job board (Ashby); applies the policy to data subjects in Switzerland (adds the FDPIC)
GDPR Policy Sections 5.2, 5.3, 5.5, 5.6 and 5.7 Recruitment: (b) pre-contractual steps, 90 days Adds interview recording under (a) consent; AI-assisted review, fraud prevention and retention of hiring records based on (f) legitimate interests, with LIA summaries; retention for the record-keeping period or the claims deadline under local law (no longer than 1 year; 4 years for California residents)
GDPR Policy Section 6.8 ADM and profiling tables: Xint, aprism; GA4, PostHog Adds AI-assisted review and fraud detection for applications for Theori, Inc. roles (not ADM under Art. 22; disclosed as profiling)
GDPR Policy Sections 6.1 and 9.2 (International transfers) — Adds Ashby, Inc. (United States) — not a Chapter V transfer because you provide the data directly on the application form; adds Theori, Inc. careers to the Theori, Inc. row
Service Providers list — (o) Recruitment — adds Ashby, Inc. (United States); adds application data for Theori, Inc. roles to the inter-entity transfer (US → Korea)

Theori (theori.io)

Dreamhack (dreamhack.io)

Xint (xint.io)

aprism (aprism.io)

ChainLight (chainlight.io)

Video Surveillance (CCTV) Operations & Management Policy (discontinued 2026-08-03)

From 4 August 2026 we no longer maintain a separate video surveillance policy. Our cameras are installed in office areas accessible only to employees and authorized visitors, which are not "publicly accessible places" under Article 25 of the Korean Personal Information Protection Act, so the separate policy required by Article 25(7) does not apply. Office video surveillance is now covered in Privacy Policy Section 2.3.

Version numbers for individual services were assigned by Theori for record-keeping purposes; the service pages themselves may show only an effective date.

Key Global Addendums

EEA/UK GDPR Privacy Policy

Service Providers and International Transfers

This list forms part of Section 7 of the Privacy Policy and is updated independently of the policy body when service provider arrangements change. Updates are recorded on this page.

Service Provider List updates

Service Provider List updates
Posted Change
2026.09.28 (o) Recruitment — added Ashby, Inc. (United States); added application data for Theori, Inc. roles to the inter-entity transfer (US → Korea). Updated under Privacy Policy Ver. 1.1 (effective 2026.10.05)
2026.09.29 (o) Recruitment — retention period restated by reference to the law of the country where the role is based (no longer than 1 year; 4 years for California residents) and wording aligned to Theori, Inc. roles; inter-entity transfer wording aligned (correction before the effective date)
2026.09.30 (n) Business Tools / HR — added Anthropic PBC (Claude, United States) for work assistance (also reflected in the Anthropic PBC row of GDPR Policy Section 9.2). Engagement began in September 2026; this update applies from the posting date

Data Processing Addendum (DPA)