Metaview

GDPR overview

GDPR implementation is documented rather than merely claimed. The privacy policy, updated 27 March 2026, splits controllership between Metaview Global Limited for the EEA, UK and Switzerland and Metaview Labs Inc elsewhere, tabulates its lawful bases under Article 6, and names an Article 27 representative in Dublin, Osano International Compliance Services Limited. Candidates held in the sourcing database get an explicit rights map covering access, erasure, objection, rectification and restriction, answered within 30 days in the UK and EU and 45 days in the US. Transfers outside the EEA, UK or Switzerland rely on Standard Contractual Clauses. A public data processing agreement adds technical measures, a UK addendum and 14 days' notice before any subprocessor change. Metaview also claims CCPA, LGPD and PIPEDA compliance alongside SOC 2 Type II certification.

Who owns the data?

Under the terms of service, data you enter or upload remains yours, and Metaview receives only the licence it needs to run the service. The privacy and security pages restate this for interview material: all personal data relating to interviewers and candidates belongs to the customer, with Metaview acting as processor under a published data processing agreement. One exception matters. In its own sourcing database, Metaview Global Limited is the controller of professional profiles licensed from third-party data providers, not a processor. Once an employer receives a profile through the platform, that employer becomes an independent controller for everything it does next.

Reuse rights

Customers can use, export and delete their own interview data without asking Metaview: recordings are deleted at the touch of a button, and bulk transcript imports from a previous tool are supported. Metaview's own reuse is bounded by the data processing agreement, which states that personal data passing through its AI systems serves solely to deliver the service and is not used to train underlying third-party models. The terms of service are broader: they let Metaview collect, create and use aggregated or de-identified data derived from customer usage for machine learning, training, industry analysis, benchmarking and analytics, in a form that does not identify the customer. That carve-out is the clause to read closely before signing.

Data retention & training

Hosting summary

Metaview states that it hosts all customer data in an AWS environment in the United Kingdom, and its privacy policy confirms that its infrastructure sits in the UK. The data processing agreement is more precise: personal data is primarily processed in the United Kingdom, the United States and Germany, and may be transferred to any country where Metaview or its subprocessors keep facilities, provided the transfer relies on the safeguards set out in the agreement — Standard Contractual Clauses approved by the European Commission, or their UK and Swiss equivalents. Technical measures are documented: encryption in transit and at rest using TLS 1.3 or above and AES-256-GCM or equivalent, hosting restricted to cloud vendors with audited physical and environmental controls, network segmentation and intrusion detection. Metaview holds SOC 2 Type II certification and shares reports on request. The named list of subprocessors is not in the agreement itself: Annex 4 points to the company's Trust Center, which could not be reached for verification.