How we handle your application data

Who we are

XYZ MGMT LLC, a company based in the United States, runs this assessment to hire chatters, and decides how the information in it is used. For any privacy question, or to use any of your rights below, email dim@xyzofm.xyz. Our data protection officer, one of our founders, can be reached at the same address.

Who can apply

The role involves adult content, so this assessment is only for people 18 or older. We don't knowingly accept an application from anyone younger, and if we find we have one, we delete it.

It's also only for work done outside the United States and its territories, by people who don't live in a country or region under comprehensive US sanctions: currently Cuba, Iran, North Korea, Crimea, and the so-called Donetsk and Luhansk People's Republic regions of Ukraine.

What we collect

• Your details: your name, email address and the country you'll work from, and, if you give them, your time zone, months of chat sales experience, and where you found us.
• What you confirm: that you understand the role involves adult content and you're 18 or older; that you'll work from outside the United States and don't live in a sanctioned country or region; and the requirements on the schedule page. We record when you confirmed the first page's statements.
• Your ID check video: a short video, with sound, of you holding your government photo ID next to your face and saying a line we give you. We keep it only if you agree, on the ID check page, and we record when you agreed.
• Your questionnaire answers: which CRMs you've used; whether you chat for anyone else (for whom, and how many hours a week); your average weekly sales over your last 4 weeks and a sale you're proud of, or that you're new to chatting; and whether one day off a week works for you. We ask you to leave every name, username and personal detail of fans and creators out of your answer about a sale.
• Your assessment: your shift choices, English answers, typing test results and what you typed, your internet speed results, your mock chat replies, which chats you opened and in what order, when you opened and answered each one and how long each reply took, and your rewrite.
• Integrity signals: paste attempts, large blocks of text appearing at once, leaving the page during timed tasks, and how similar your answers are to each other, each recorded with the time and the question it happened on. They help us spot copied or automated answers.
• Technical data: your browser type, to check you're on a laptop or desktop; your IP address, for the bot check and to limit repeat submissions (we store only a scrambled one-way code made from it, never the address itself); and the country and region your connection comes from, worked out from your IP address for the sanctions check. We keep the country with your application.
• Our review: the notes, scores and decisions our managers record about your application, whether we've checked your ID, when you reached our NDA stage if you did, and the date you stop working with us.

What you have to give us

Everything the assessment asks for, including the ID check video, is needed to consider your application, except your time zone, experience and where you found us, which are optional. If you'd rather not give something that's needed, we can't consider your application.

Why we use it

• To assess your application, decide whether to offer you work, and contact you about it. These are steps you ask us to take before we might work together.
• To confirm who you are and that you're 18 or older, from your ID check video, as the law requires for work involving adult content. We keep the video only with your agreement, which you give on the ID check page, and you can withdraw it at any time.
• To keep the assessment fair and secure, by stopping bots, repeat submissions, and copied or automated answers. This is our legitimate interest in a fair and secure hiring process.
• To check where you'll work, because our pay terms are for work done outside the United States. This is our legitimate interest in engaging people on terms that apply to them.
• To comply with US sanctions law, which bars us from engaging anyone in a country or region under comprehensive US sanctions. The law requires it, and it's why we also check where your connection comes from.
• To see where applicants hear about us, from your answer to "where did you find us", so we know which job posts work. This is our legitimate interest in running our recruitment well.

We don't sell your data or use it for advertising.

Checks that happen automatically

Some checks run on their own and can stop an application: the bot check, the limits on repeat submissions from one connection and on how many applications we take in a day, the laptop-or-desktop check, and the checks on the country you'll work from and on where your connection comes from. If one of them stops you, you'll see why on screen. If you think a check got it wrong, email us and a person will look at it.

Our review desk also works out an "integrity risk" level (low, medium or high) from the integrity signals, missed replies in the mock chat, and typing faster than a person types, and it points out a slow internet connection or typing under 40 words a minute. These are prompts for a manager to look more closely, not decisions. They never reject you on their own: our managers make the decisions about your application.

Who can see it

Only XYZ MGMT's managers can see your application and ID video. They're kept in private storage that the public can't reach. Managers can download a copy to review applications; they keep those copies private and delete them on the same timeline as the rest (see below).

These service providers run parts of the assessment and handle data for us:

• Netlify hosts the website and runs the code that receives your application.
• Supabase stores applications and ID videos.
• Cloudflare runs the bot check (Turnstile). Cloudflare also uses some bot-check information for its own purposes, to improve its bot detection; its Turnstile Privacy Addendum explains how.
• Google provides our email.

They are established services with independent security certifications (such as SOC 2) and their own data protection terms, and each gets only what its part of the service needs.

The internet speed test runs between your browser and Cloudflare's public speed test, which sees your IP address under Cloudflare's own privacy policy.

We may also share information when the law requires it, for example with a regulator or a court.

Where it's stored, and how we protect it

Your application and ID video are processed and stored in the United States, so they leave your own country; our email and bot-check providers may also handle data in other countries. They travel over encrypted connections and are stored by a provider that encrypts data at rest. Only signed-in managers can open them, and the sign-in is protected against password guessing.

If a breach puts your data at risk, we'll tell you and the authorities as the law requires.

How long we keep it

• If you don't reach our NDA stage, we delete your application, including your ID video, within 90 days of when you submitted it.
• If you reach our NDA stage, we keep your information while you're onboarding or working with us, and for one year after that ends, then delete it.
• If you withdraw your agreement to keep your ID video, we delete the video, and the rest of your application stays.
• Copies our managers download, and emails between you and us, are deleted on the same timeline, unless we need an email to deal with a legal claim.
• The scrambled code made from your IP address is deleted within a week.
• Our service providers keep technical logs, such as IP addresses, for a limited time to run and protect their services.

Your rights

You can:

• ask what data we hold about you, and for a copy of it;
• ask us to correct it;
• ask us to delete it, or to stop using it. If you ask before we've reviewed your application, we can't consider it;
• object to how we use it;
• ask for a copy in a format you can take elsewhere;
• ask a person to review any automatic check that stopped you: we don't make decisions about you by automated means alone;
• withdraw your agreement to us keeping your ID video: we'll delete it, and the rest of your application stays;
• claim compensation if you're harmed by a breach of your privacy rights, as the law allows.

Email dim@xyzofm.xyz. We may ask you to confirm who you are first. We'll reply as soon as we can, and within the time the law allows.

You can also complain to a data protection authority: in the Philippines, the National Privacy Commission (privacy.gov.ph); in Nigeria, the Nigeria Data Protection Commission (ndpc.gov.ng); in Kenya, the Office of the Data Protection Commissioner (odpc.go.ke); anywhere else, your local data protection authority.

Cookies

We don't use cookies or similar tools to track you or for advertising, and there's no analytics on this site. The bot check reads information from your browser to tell people from bots. The only cookie this site sets itself is for managers who sign in.

Applications made on an earlier version

An earlier version of this assessment asked for screenshots of sales and chats instead of typed answers. If you applied then, they're kept privately and deleted on the same timeline as the rest of your application.

Changes

If we change how we handle your data, we'll update this page and the date at the top. If a change affects applications we already hold, we'll email those applicants before it applies to them.