Version 2026-10-v1 · Last updated: October 7, 2026
This Data Processing Addendum ("DPA") forms part of the agreement between Belal Ahmed, doing business as Cohera AI, a sole proprietorship registered in British Columbia, Canada ("Cohera") and the customer that uses the Cohera platform (the "Customer") and describes how Cohera processes personal information on the Customer's behalf.
1. Scope and roles
When the Customer uses Cohera to match, contact, schedule, interview or evaluate candidates for its Roles, Cohera processes candidate personal information — role matches and scores, outreach records, bookings, interview recordings, transcripts, assessment work (including, in AI-Assisted assessments, the candidate's prompts to AI coding tools and their responses, terminal commands and code snapshots), evaluations and the Customer's notes and decisions — on the Customer's behalf as a service provider or processor. The Customer determines the purposes and means of that processing and is the controller (or business) of it.
Cohera is the controller (or business) of the personal information it processes for its own purposes: Customer account and user data, billing records, platform-security and abuse-prevention data, the operational logs needed to run the service, and the professional profile information and personal contact information (an email address and, only when a Customer's recruiter asks for it, a mobile phone number) that Cohera collects from talent data providers and contact-data providers in order to source candidates. Cohera holds that sourcing information in a single pool, may match a profile to Roles of more than one Customer, and refreshes a profile from its providers when it is more than about six months old at the time it is next matched to a Role. That processing is described in sections 2 and 7 of the Privacy Policy. Cohera's matching and scoring of candidates for the Customer's Role, and everything Cohera does with a candidate for the Customer once the candidate is Introduced (as defined in the Client Agreement) — outreach, bookings, interviews, assessments and evaluations — is processed on the Customer's behalf under this DPA.
2. Relationship to the Terms and the Client Agreement
This DPA is the Data Processing Addendum referred to in section 11 of the Terms of Service and forms part of the Client Agreement under its Section 8.2. If this DPA conflicts with the Terms or the Client Agreement on the processing of personal information, this DPA governs to the extent required by applicable privacy law. Capitalised terms not defined in this DPA have the meanings given in the Client Agreement.
3. Processing instructions
Cohera processes the Customer's candidate personal information only on the Customer's documented instructions. The Customer's documented instructions are (a) the agreement between the Customer and Cohera, including this DPA, and (b) the configuration the Customer applies in the platform — the Roles it opens, the interview rounds and rubrics it sets, the candidates it invites or adds, and the actions its users take. Cohera will inform the Customer if, in its opinion, an instruction infringes applicable privacy law.
The Customer also authorises Cohera to use candidate personal information internally to secure, debug, monitor and improve the reliability and quality of the service, in de-identified or aggregated form wherever practicable. Cohera will not use candidate personal information to train artificial-intelligence models or for marketing.
Business purpose and service-provider terms. The business purpose of the processing is to provide the recruiting services described in the Client Agreement to the Customer. Cohera will: (a) not sell or share (as those terms are defined in the California Consumer Privacy Act) the Customer's candidate personal information; (b) not retain, use or disclose it for any purpose other than that business purpose and the internal uses authorised above, or outside the direct business relationship with the Customer, except as applicable privacy law permits; (c) not combine it with personal information it receives from another customer or collects from its own interaction with the candidate, except that the sourcing pool described in section 1 is processed by Cohera as controller and as applicable privacy law permits; (d) comply with the obligations that applicable privacy law places on a service provider or processor and provide the level of privacy protection that law requires; (e) notify the Customer within five (5) business days if it determines that it can no longer meet those obligations; and (f) on the Customer's reasonable request, stop and remediate any unauthorised use of the Customer's candidate personal information, and allow the Customer to take reasonable and appropriate steps to ensure Cohera uses it consistently with the Customer's own obligations. Cohera certifies that it understands these restrictions and will comply with them.
4. Confidentiality
Cohera is operated by its proprietor, who is currently the only person with access to candidate personal information. Before any employee or contractor of Cohera is given such access, Cohera will bind them by written confidentiality obligations no less protective than this DPA. Access to Customer data inside the platform is limited to what is needed to provide support and operate the service and goes through Cohera's administration console, whose sensitive reads are written to an append-only audit trail, including a time-limited, read-only "view as customer" facility that records who accessed which account, when and why. Direct access to Cohera's databases, storage and hosting consoles is limited to named Cohera administrators and is used only to operate, secure and support the service.
5. Security measures
Cohera maintains technical and organisational measures appropriate to the risk, including:
- encryption of personal information in transit (TLS) and at rest;
- role-based access controls and least-privilege access for Cohera personnel;
- logging and monitoring of platform and administrative activity;
- review of the security and privacy commitments of each subprocessor before engagement;
- secure development practices, including dependency vulnerability scanning and secret scanning in the build pipeline.
The current measures are summarised in the Security section of the Privacy Policy.
6. Subprocessors
The Customer authorises Cohera to engage the subprocessors listed at /subprocessors to process candidate personal information. Cohera imposes on each subprocessor, by written contract, data-protection obligations no less protective than those in this DPA, and remains responsible to the Customer for each subprocessor's performance.
Cohera will update the subprocessor list at least thirty (30) days before a new subprocessor processes candidate personal information and will notify Customers who have asked to be notified (by emailing privacy@coheraai.com). A Customer may object to a new subprocessor on reasonable data-protection grounds by writing to that address within the thirty-day period. Cohera will work with the Customer in good faith to resolve the objection; if it cannot be resolved before the new subprocessor begins processing, the Customer may close the affected Roles in the platform before that subprocessor begins processing candidate personal information for them. Closing a Role under this section ends Cohera's processing of candidate personal information for that Role, and section 9 of this DPA applies to its deletion; the Role's term, accrued fees and attribution continue to be governed by Sections 3, 4 and 9 of the Client Agreement. If no Introduction has yet been made for a Role closed under this section, Cohera will refund the Activation Fee paid for that Role; no other fee is refunded.
7. International transfers
Cohera is based in Canada. Its subprocessors operate principally in the United States and Canada; the candidate-sourcing providers on the subprocessor list also process candidate data in the European Union, and relayed interview media may transit Cloudflare's global network in encrypted form. Candidate personal information may therefore be stored and processed outside Canada, principally in the United States and, for sourcing data, in the European Union. Cohera relies on contractual safeguards with each subprocessor — including data-protection terms, confidentiality and security commitments — to protect personal information wherever it is processed. Cohera's candidate search covers people located in the United States and Canada. The Customer will not add to a Role, or otherwise instruct Cohera to process, personal information of candidates located in the European Economic Area, the United Kingdom or Switzerland unless the parties have first put in place the transfer safeguards that applicable law requires for that processing (such as the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum).
8. Assistance with candidate rights requests
Candidates may contact Cohera at privacy@coheraai.com, or through the help link on their interview or scheduling page, to request access to, correction of, or deletion of their personal information, or a human review of an AI-assisted evaluation as described in How the AI Interview Works. Cohera forwards such requests to the Customer without undue delay and, taking into account the nature of the processing, assists the Customer in responding within the time required by applicable law. Cohera does not respond to a candidate's request on the Customer's behalf unless the Customer instructs it to or the law requires it.
9. Deletion and return
Cohera deletes the Customer's candidate personal information for a Role — role matches and scores, outreach records, bookings, interview recordings, transcripts, assessment work, evaluations and the Customer's notes — no later than 24 months after the Role closes, as described in the data retention section of the Privacy Policy. When the Customer's relationship with Cohera ends, Cohera deletes that information for all of the Customer's Roles within ninety (90) days after the Customer's written notice that the relationship has ended. On the Customer's written request at any time, Cohera will delete it earlier, or provide a copy of it in a commonly used format before deletion, except to the extent applicable law requires Cohera to retain it. A candidate's underlying sourced profile is held by Cohera as controller (section 1) and may also be matched to other Customers' Roles; deletion for one Customer removes the records of that Customer's Roles about the candidate, and the profile itself is retained or deleted as described in the Privacy Policy or at the candidate's own request. Backups are deleted on their normal rotation schedule.
10. Audits and reports
On the Customer's written request, Cohera will make available the documentation reasonably necessary to demonstrate compliance with this DPA, including a description of its security measures and its current subprocessor list. Not more than once in any twelve-month period, and on at least thirty (30) days' written notice, the Customer (or an independent auditor it appoints who is bound by confidentiality) may review that documentation and put reasonable written questions to Cohera about it, which Cohera will answer within a reasonable time. Cohera does not offer on-site audits. Each party bears its own costs of any review.
11. Personal-information breach notification
If Cohera confirms a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to the Customer's candidate personal information, Cohera will notify the Customer without undue delay and no later than 72 hours after confirming the breach. The notice will include, to the extent known, the nature of the breach, the categories and approximate number of candidates and records affected, the likely consequences, the measures Cohera has taken or proposes to take, and a contact point — so the Customer can meet its own notification obligations. Cohera will supplement the notice as further information becomes available.
12. Term and changes
This DPA applies to each Role for as long as Cohera processes candidate personal information on the Customer's behalf for that Role, and section 9 continues to apply until that information is deleted. Cohera may publish a new version of this DPA from time to time. Each version carries a version identifier; this version is 2026-10-v1. The version in effect when a Role is Unlocked governs that Role, in the same way as Section 12 of the Client Agreement, except that where applicable privacy law requires a change to this DPA, Cohera may apply the change to existing Roles by publishing the new version on this page and giving the Customer at least thirty (30) days' notice by email to the account owner, unless the law requires it sooner.
13. Contact
Questions about this DPA: privacy@coheraai.com, or write to Belal Ahmed, doing business as Cohera AI, 9088 Halston Court, Burnaby, BC V3N 0A7, Canada.