Privacy Policy

This Privacy Policy explains how 40X LLC (“40X”, “we”, “us”, or “our”) collects, uses, discloses, retains, and protects personal information in connection with the websites, assessments, courses, benchmarking, certification, employer dashboard, marketplace features, and related services available at 40x.ai and related domains (the “Service”).

Operator: 40X LLC
Mailing address: 3400 Cottage Way, Ste G2 #35834, Sacramento, California 95825, United States
Privacy requests: privacy@40x.ai
Security notices: security@40x.ai
Legal notices: legal@40x.ai
Accessibility and accommodation requests: accessibility@40x.ai

40X is based in the United States. Assessment, 40X-issued certification, and 40X-operated marketplace features are currently intended for individuals located in the United States unless 40X expressly enables another jurisdiction. Those features are not currently available to individuals located in the European Economic Area, the United Kingdom, Switzerland, or another unsupported jurisdiction. The public website may be accessible from other locations, and this Privacy Policy explains how we handle personal information where applicable.

1. Who this Policy covers

This Privacy Policy applies to visitors, job seekers, invited employees, candidates, contractors, employer administrators, prospects, support contacts, marketplace participants, and other individuals whose personal information is processed through the Service.

For Employer-sponsored Assessments, the Employer may also provide its own notices and may be responsible for certain privacy, employment, accessibility, accommodation, and automated-decision obligations. The 40X Data Use Agreement / Data Processing Addendum(“DPA”) governs customer-specific data-processing terms.

2. Product-specific privacy summary

40X Assessments are designed to measure demonstrated AI proficiency. 40X offers different assessment flows. Some assessments require an account, while others may be accessed through a shared link without creating an account. Depending on the assessment flow, 40X may collect information you provide or generate during the assessment, such as your answers, submitted work, name, work email, score or results, completion status, timing and progress data, technical metadata, and limited integrity signals such as page or tab changes, visible time per question, display or setup indicators, and, where enabled, copy-event signals.

Copy-event signals do not include the contents of what you copy unless you enter or paste that content into the assessment.

Some assessment flows may include shared-screen recording, but only if the start screen or consent screen says so. For assessment flows that include shared-screen recording, the Service records the screen that the participant chooses to share through browser or operating-system screen-sharing permission. If a participant shares a full monitor or full screen, unrelated browser tabs, desktop windows, notifications, messages, files, applications, personal information, confidential information, or third-party information visible on that screen may be captured.

Before screen recording begins, participants are shown a pre-assessment notice and consent screen. Participants should close or hide unrelated content, disable notifications, and avoid displaying content they are not authorized to share. If a participant does not consent to a required assessment recording, the participant cannot take that assessment.

Assessment, certification, and marketplace features may also include location or jurisdiction checks. If the Service determines that a participant is located in an unsupported jurisdiction, the participant may be blocked from starting or completing the Assessment, certification, or marketplace workflow.

40X does not ask for access to your webcam or microphone during Assessments. We do not use Assessment recordings to identify you by your face, voice, body, eyes, or other biometric characteristics, and we do not use them to infer emotions or affective state.

Assessments are scored using automated systems, including artificial-intelligence models and large-language-model evaluators. Results may include a score, percentile, skill-gap report, completion status, integrity or capture-confidence status, certification status, and marketplace eligibility.

For Employer-sponsored Assessments, Employers decide whether and how to use Results for their own employment, training, workforce, or similar decisions. 40X separately determines 40X-issued certification status and eligibility for 40X-operated marketplace features.

Employers do not receive raw screen recordings through standard dashboard features. Employer administrators, recruiters, or other authorized customer users may access authorized Results, reports, aggregates, progress information, integrity indicators, and approved exports through the employer dashboard or other approved reporting features, depending on customer configuration.

3. Categories of personal information we collect

Depending on how you use the Service, we may collect:

• Account, participant, and contact information, such as name, email address, work email, organization, role, login method, account settings, and contact details submitted through an account or link-based assessment flow.
• Employer-provided information, such as invitation details, work email, team, department, role family, cohort, employment or contractor status, and administrator permissions.
• Assessment information, such as submitted work or answers, shared-screen recording where enabled, assessment activity necessary to administer and score the Assessment, timing and progress data, completion status, technical metadata, limited integrity signals, scoring inputs and outputs, and related audit logs.
• Limited integrity and assessment-operation signals, such as page or tab changes, visible time per question, display or setup indicators, and, where enabled, copy-event signals. Copy-event signals do not include the contents of what you copy unless you enter or paste that content into the assessment.
• Link/session analytics for shared-link assessment flows, such as whether a link was opened, whether an assessment was started, question progress, submission, and result-view events. These analytics may be associated with a link, session, recruiter, Employer, organization, or participant where needed to operate the Service, report progress, or protect integrity.
• Results and reports, such as score, percentile, skill gaps, certification status, marketplace eligibility, integrity or capture-confidence status, retest history, and dashboard aggregates.
• Marketplace information, if you opt into marketplace features, such as profile details, skills, certification status, score band where enabled, availability, preferences, and matching information.
• Support, appeal, correction, and accommodation information, such as messages, request details, review records, outcome records, and information needed to evaluate or respond to a request.
• Website, device, cookie, location, and security information, such as IP address, approximate location inferred from IP address, device and browser details, pages viewed, referral source, session identifiers, log files, cookie identifiers, and security events.
• Payment and commercial information, such as subscription, order, invoice, payment status, and tax details. Payment-card details may be processed by payment providers rather than stored by 40X.
• Optional audit or demographic information, where lawfully collected or provided for bias-audit, validation, compliance, or reporting purposes.

40X does not intentionally collect sensitive personal information through Assessments unless it is provided by a participant, Employer, or, for assessment flows that include screen recording, visible on the shared screen. Participants should avoid submitting or displaying unnecessary sensitive or confidential information during an Assessment.

4. How we use personal information

We use personal information to:

• provide, operate, score, secure, and support the Service;
• administer Assessments, generate Results, and provide dashboards and reports;
• support shared-link assessment flows, including link/session analytics, progress tracking, result display, and authorized admin or recruiter reporting;
• verify account access, prevent misuse, and protect assessment integrity;
• enforce geographic availability, unsupported-jurisdiction blocks, security restrictions, and access controls;
• provide certifications, benchmarks, and marketplace features;
• respond to support, privacy, appeal, correction, and accommodation requests;
• maintain, validate, calibrate, and improve the Service, subject to customer agreements and applicable law;
• create aggregated or de-identified benchmarks and analytics that do not identify an individual or customer;
• manage subscriptions, billing, procurement, and customer relationships;
• comply with law, enforce agreements, preserve records, and protect rights, safety, and security.

5. Automated processing, AI scoring, certification, and marketplace decisions

40X uses automated systems, including AI models, to analyze Assessment Data and generate Results. Automated processing may evaluate submitted work or answers, assessment progress, task completion, and other assessment-relevant signals.

For Employer-sponsored Assessments, the Employer is responsible for deciding whether and how Results are used for employment or personnel purposes and for providing any notices, alternatives, accommodations, audits, risk assessments, human review, or other safeguards required for the Employer's use. Depending on how an Employer configures and uses Results, the workflow may be subject to laws relating to automated decision-making technology, automated employment decision tools, AI systems, employment selection procedures, profiling, or significant decisions. 40X may provide information and support to Employers through the DPA, customer compliance kit, and other contractual materials.

40X separately controls 40X-issued certification status and eligibility for 40X-operated marketplace features. If 40X uses automated processing to determine your 40X certification status or your eligibility for marketplace visibility, matching, or related 40X-operated opportunities, you may request information about the main factors used to make that determination, request correction of inaccurate personal information, and request human review or appeal of the determination where required by applicable law or made available by 40X.

Where applicable law gives you a right to opt out of automated decision-making used for a decision that has legal or similarly significant effects, 40X will provide a way to exercise that right or will provide another legally recognized safeguard, such as human review with authority to change the decision. Opting out of automated processing may affect whether 40X can provide certain certification or marketplace features.

Before 40X uses automated processing for a 40X-controlled certification or marketplace eligibility determination where a pre-use notice is required, 40X will provide a notice describing the purpose of the automated processing, the categories of personal information that affect the output, the type of output generated, how the output is used, and how to request review or exercise available rights. 40X does not disclose confidential rubrics, prompts, source code, trade secrets, security-sensitive information, or information about other individuals in response to these requests.

6. Cross-customer benchmarking and aggregated data

40X may use assessment outputs and related data to maintain role-based benchmarks, scoring calibration, reliability monitoring, and product quality controls. Cross-customer benchmarking is designed to use aggregated or de-identified data, not raw screen recordings or customer-identifiable employee data shown to other customers.

40X does not disclose a customer's identifiable employee data, raw screen recordings, submitted work, individual Results, team-level Results, or customer-identifiable statistics to other customers. 40X does not publish benchmarks for cohorts so small that an individual or customer could reasonably be identified.

7. Model training, scoring improvement, and product improvement

40X does not authorize service providers or subprocessors to train or fine-tune their general-purpose models on production Assessment Data except as expressly authorized by 40X under the applicable customer agreement and law.

40X does not train or fine-tune general-purpose AI models on Employer-sponsored raw screen recordings, submitted work, or identifiable Assessment Data unless the Employer has expressly authorized that use in a written agreement and required notices, rights, and legal bases are in place.

40X may use aggregated, de-identified, or minimized data to test, validate, calibrate, monitor, secure, and improve scoring rubrics, benchmarks, reliability, quality controls, and Service performance, subject to the DPA, customer restrictions, and applicable law.

8. Marketplace visibility and sharing

If you opt into 40X marketplace or talent-matching features, 40X may display selected profile, certification, skill, score-band, availability, preference, and contact or matching information to participating employers, customers, or partners. Marketplace profiles do not display raw screen recordings.

Marketplace eligibility and visibility may be determined using 40X criteria and automated systems. You may withdraw from marketplace visibility, update your profile, request deletion, request correction of inaccurate personal information, and request human review or appeal of marketplace eligibility or visibility decisions where required by applicable law or made available by 40X, subject to legal, security, audit, and contractual retention limits.

9. How we disclose personal information

We may disclose personal information to:

• Employers, recruiters, organizations, or administrators that invited, authorized, or administer an Assessment or shared-link assessment flow, through dashboard, report, export, or contractually approved workflows;
• service providers and subprocessors that host, process, score, secure, support, or operate the Service;
• marketplace participants, customers, or partners, when you opt into marketplace visibility;
• professional advisors, auditors, insurers, and legal or compliance reviewers;
• authorities, courts, regulators, or other parties where required by law or necessary to protect rights, safety, security, or legal interests;
• parties involved in a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate protections.

For shared-link assessment flows, the organization, recruiter, or administrator that sent or administers the link may receive submitted identifying information, score or result, completion status, progress information, and related reporting or integrity indicators, depending on dashboard configuration. 40X does not disclose the content of what a participant copied because 40X does not collect copied content unless the participant enters or pastes that content into the assessment.

40X does not sell personal information in the ordinary meaning of the word. 40X does not share raw screen recordings with Employers through standard dashboard features. 40X does not use assessment pages for cross-context behavioral advertising.

10. Incidentally captured third-party content

Some assessment flows include screen recording. For those assessment flows, recordings may incidentally include third-party personal information, confidential information, or sensitive content that was visible on the screen a participant chose to share. Participants should close unrelated applications, tabs, documents, and notifications before recording begins.

If 40X identifies or is notified that a recording contains clearly unrelated third-party personal information, confidential information, or sensitive content not needed for assessment, integrity, appeal, security, legal, or compliance purposes, 40X may restrict access, redact, delete, or otherwise minimize that content where feasible.

11. Cookies, analytics, and opt-out preference signals

The Cookie Policy explains how 40X uses cookies and similar technologies. Assessment pages and shared-link assessment flows are designed to use only cookies and technologies needed for authentication, security, assessment operation, consent, accessibility, analytics necessary to operate the Service, geographic availability, or legal compliance.

Where required by law, 40X honors applicable opt-out preference signals, such as Global Privacy Control, for processing that is subject to those signals. 40X does not use assessment pages for targeted advertising or cross-context behavioral advertising.

12. Retention and deletion

40X retains personal information for as long as reasonably necessary for the purposes described in this Privacy Policy, the DPA, the Data Retention and Deletion Policy, the applicable order form, or applicable law. Retention periods vary depending on the data category, customer configuration, legal obligations, security needs, appeal or review status, and whether a legal hold applies.

Raw screen recordings are retained for a shorter period than many derived Results and compliance records unless law, a customer agreement, appeal, investigation, audit requirement, or legal hold requires longer retention. Score-level data used for rolling benchmark calibration is handled separately from raw recordings as described in the Data Retention and Deletion Policy and applicable DPA.

You may request deletion as described below. Deletion may be limited by legal, contractual, security, audit, fraud-prevention, dispute, backup, or compliance obligations.

13. De-identified and aggregated data

40X may create and use aggregated or de-identified data for benchmarking, validation, analytics, security, research, product improvement, and business reporting. 40X maintains de-identified data in de-identified form and does not attempt to reidentify it except to test or validate de-identification controls or as otherwise permitted by law. 40X requires recipients of de-identified data to comply with applicable de-identification restrictions where required.

Screen-recording-derived data can be difficult to de-identify. 40X treats raw recordings and recording-derived artifacts with heightened controls and does not treat raw recordings as de-identified merely because names or obvious identifiers are removed.

14. Security

40X uses administrative, technical, and organizational safeguards designed to protect personal information. These safeguards may include access controls, encryption, logging, monitoring, vendor review, secure development practices, restricted raw-recording access, and incident-response procedures.

No system is perfectly secure. If 40X becomes aware of a security incident involving personal information, 40X will provide notices to affected customers, individuals, regulators, or authorities as required by applicable law and contractual commitments.

15. U.S. state privacy rights

Depending on where you live and how your information is processed, you may have rights to access, correct, delete, obtain a copy of, or opt out of certain processing of personal information, including sale, sharing, targeted advertising, profiling, or automated decision-making. You may also have a right to appeal a privacy-rights decision.

To exercise rights, contact privacy@40x.ai or use an in-product rights mechanism where available. If your request relates to an Employer-sponsored Assessment, 40X may direct or forward the request to the Employer where the Employer is responsible for responding. If your request relates to a 40X-controlled certification or marketplace decision, 40X will handle the request directly unless another allocation is required by law or contract.

16. California privacy notice

California residents may have rights under California privacy law to know, access, correct, delete, obtain a copy of, limit certain uses of sensitive personal information, and opt out of certain sale, sharing, targeted advertising, profiling, or automated decision-making uses where applicable.

For Employer-sponsored Assessments, the Employer may be responsible for certain employment-related notices and decisions. 40X supports Employers as described in the DPA and applicable customer agreements.

For 40X-issued certification status and 40X-operated marketplace eligibility or visibility decisions, California residents may contact 40X directly to request access to information about automated processing, correction of inaccurate personal information, human review or appeal, or opt-out of automated decision-making where such rights apply and subject to legal exceptions. If opting out would prevent 40X from providing a certification or marketplace feature, 40X will explain the impact at the time of the request.

40X does not use assessment pages for cross-context behavioral advertising. 40X will honor applicable opt-out preference signals where required.

17. International transfers

40X is based in the United States, and personal information may be processed in the United States and other countries where 40X or its service providers operate. Where required, 40X uses appropriate transfer mechanisms and contractual protections, such as standard contractual clauses, data-processing terms, or other approved mechanisms.

18. Additional information where EEA, UK, or Swiss privacy laws apply

Where the GDPR, UK GDPR, Swiss FADP, or similar laws apply, this section provides additional information about our processing of personal data. Assessment, 40X-issued certification, and 40X-operated marketplace features are not currently available to individuals located in the European Economic Area, the United Kingdom, or Switzerland unless 40X expressly enables those features for the applicable jurisdiction.

For job-seeker accounts, 40X-issued certifications, 40X-operated marketplace features, account administration, security, fraud prevention, benchmarking, service improvement, and legal compliance, 40X generally acts as a controller of personal data. For Employer-sponsored Assessments, the Employer or organization that invited you generally acts as the controller, and 40X processes Assessment Data on that organization's behalf, except where 40X acts as an independent controller for security, fraud prevention, service integrity, benchmarking, certification, marketplace eligibility, legal compliance, direct user relationships, or other purposes described in this Policy.

Our legal bases may include performance of a contract, our legitimate interests, your consent where required, compliance with legal obligations, and, where applicable, explicit consent or another lawful basis for any special-category data.

Depending on where you live and subject to applicable limits, you may have the right to request access, correction, deletion, restriction, portability, objection to processing, withdrawal of consent, and complaint to a supervisory authority.

If automated processing is used to make a decision about you that has legal or similarly significant effects, you may have rights to obtain meaningful information about the logic involved, request human intervention, express your point of view, and contest the decision.

We process personal data in the United States and may use service providers in the United States and other countries. Where required, we use appropriate safeguards for international transfers, such as standard contractual clauses or other approved transfer mechanisms.

Where applicable law requires us to appoint an EU representative, UK representative, Swiss representative, or data protection officer, we will publish the relevant contact details in this Policy.

19. Your choices and rights

You may update account information, change communication preferences, request privacy rights, withdraw marketplace visibility, or request review or correction where available. Employer-sponsored participants may also contact their Employer regarding Employer-controlled processing.

To submit a request, contact privacy@40x.ai. For security, 40X may need to verify your identity or authority before responding.

20. Children and minors

Assessment features are intended for individuals who are at least 18 years old. The public website is not directed to children. 40X does not knowingly collect personal information from children under the age at which parental consent is required under applicable law. If you believe a child provided personal information to 40X, contact privacy@40x.ai.

21. Changes to this Privacy Policy

40X may update this Privacy Policy from time to time. The updated version will be posted with a new “Last updated” date. Where required, 40X will provide additional notice or obtain consent.

22. Contact

40X LLC
3400 Cottage Way, Ste G2 #35834, Sacramento, California 95825, United States

• Privacy: privacy@40x.ai
• Security: security@40x.ai
• Legal: legal@40x.ai
• Accessibility: accessibility@40x.ai