VICTIG Connect — Privacy Policy

Effective date: June 29, 2026  ·  Last updated: June 29, 2026

1. Introduction & Scope

This Privacy Policy explains how Victig Background Screening (“VICTIG,” “we,” “us,” or “our”) collects, uses, shares, and protects information in connection with VICTIG Connect — our browser extension for Google Chrome and Apple Safari (the “Extension”) and the associated backend API and web portal (together, the “Service”).

VICTIG is an employment background-screening company. VICTIG Connect is a business-to-business (B2B) tool provided to VICTIG’s business clients — employers, human-resources teams, recruiters, and their authorized staff (each, a “Client User”) — to help them initiate employment background-check orders for job applicants and candidates (“Candidates”).

VICTIG Connect is not directed to individual consumers for personal use and is not directed to children. It is used by authorized personnel of VICTIG’s business clients in the course of their work.

This policy covers:

• The VICTIG Connect Extension (Chrome and Safari); and
• The VICTIG Connect backend API and web portal.

This policy does not cover:

• The applicant-tracking systems (ATS) or other third-party websites on which the Extension may be used (for example, Greenhouse, Lever, Workday, or BambooHR). Those services are operated by third parties under their own privacy policies.
• The screening platform that performs and stores the background check itself, except as described in Section 5. That provider operates as a consumer reporting agency under its own terms and notices.
• Your employer’s own privacy practices, where you are a Client User accessing VICTIG Connect through your employer’s account.

By using VICTIG Connect, Client Users agree to the practices described in this policy and represent that they are authorized to use the Service on behalf of their organization.

A note on roles (FCRA, GDPR, and CCPA/CPRA)

VICTIG Connect operates in a consumer-reporting context governed by the U.S. Fair Credit Reporting Act (“FCRA”) and analogous state laws. The information entered or captured in VICTIG Connect is used to initiate a background check (a “consumer report”). The permissible purpose for the report, and the disclosures and written authorizations that must be provided to and obtained from the Candidate, are the responsibility of the requesting employer/client and the screening platform provider (the consumer reporting agency). VICTIG Connect is the intake tool that transmits the order; it does not itself adjudicate, score, or make hiring decisions about any Candidate.

• Under the GDPR (where applicable), VICTIG is the controller of Client User account data and of the operational and audit data it maintains for security and compliance. With respect to Candidate personal data submitted to initiate an order, VICTIG acts on behalf of, and at the direction of, the requesting client and the screening provider in transmitting the order.
• Under the CCPA/CPRA, VICTIG is a “business.” Personal information collected, used, or disclosed pursuant to the FCRA is partially exempt from the CCPA to the extent that activity is regulated by the FCRA (Cal. Civ. Code § 1798.145(d)). Where that exemption applies, the FCRA — rather than the CCPA — governs the relevant personal information.

2. Information We Collect

We have intentionally designed VICTIG Connect to collect only the limited information needed to initiate a background-check order. We describe each category below.

2.1 Candidate personal data (collected through user-initiated page reading)

When a Client User is viewing a Candidate’s page in their ATS and chooses to open the VICTIG Connect Extension popup, the Extension reads the content of that single active browser tab to extract the Candidate’s contact details:

• First name
• Middle name (optional)
• Last name
• Email address
• Phone number (optional)

This page reading is strictly limited and user-initiated:

• It happens only when the Client User opens the Extension popup on the page. It does not happen in the background, on a schedule, or automatically as the user browses.
• It is one-shot: the Extension captures the relevant fields at the moment of invocation and does not continuously monitor the page or the user’s browsing.
• It reads only the active tab the user is viewing — never other tabs, windows, or sites.
• The Client User reviews and can edit the captured details before anything is submitted.
• There is no background monitoring and no cross-site tracking of any kind.

The captured Candidate contact details are used solely to initiate the requested background check (see Section 3).

2.2 Client User account data

To use VICTIG Connect, Client Users sign in to a VICTIG Connect account. We collect and process:

• Email address (used as the account identifier and for account-related communications).
• Authentication credentials and tokens. Authentication is handled through Supabase. After sign-in, authentication tokens are stored locally in the browser’s extension storage on the Client User’s own device. Passwords are not stored by VICTIG in plain text; credential handling follows Supabase’s authentication mechanisms.

2.3 Operational and audit data

To operate the Service securely and to meet our compliance obligations (including FCRA-related recordkeeping and security best practices), we collect and retain:

• Cached order records — a record of orders initiated through the Service (for example, the screening package selected and order status), which may include the Candidate contact details described in Section 2.1.
• Audit logs, which for each action taken in the Service record the acting Client User’s user ID, the action performed, the timestamp, the IP address, and the browser/user-agent string.

We use this operational and audit data for security, fraud prevention, troubleshooting, integrity of the order trail, and compliance — not for advertising or profiling.

2.4 Web portal cookies and similar technologies

The VICTIG Connect web portal uses strictly necessary/session cookies (or equivalent local storage) to keep Client Users signed in and to operate the portal securely. The portal does not use any analytics, advertising, performance-tracking, or other non-essential cookies or third-party tracking technologies.

2.5 What we do NOT collect or do

For clarity, VICTIG Connect does not:

• Continuously monitor your browsing or read pages unless you open the Extension popup;
• Read tabs, windows, or sites other than the active tab you are viewing when you invoke the Extension;
• Track you across websites or build advertising or behavioral profiles;
• Sell or rent personal information;
• Use personal information for advertising or marketing of any kind;
• Use the information for any purpose beyond fulfilling the background-check order and operating the Service securely.

3. How We Use Information

VICTIG Connect has a single, specific purpose: to let authorized Client Users initiate employment background-check orders. We use the information we collect only to deliver and support that purpose:

• To initiate background-check orders. We use the Candidate’s first name, optional middle name, last name, email, and optional phone number to place the order with VICTIG’s screening platform provider. The provider then contacts the Candidate directly to complete the Candidate’s portion of the screening process.
• To authenticate and manage Client User access. We use account data and locally stored authentication tokens to sign you in, keep you signed in, and control access to the Service.
• To operate, secure, and support the Service. We use operational and audit data to maintain security, detect and prevent fraud or misuse, troubleshoot problems, maintain an accurate order/audit trail, and meet our FCRA-related compliance and security obligations.
• To comply with legal obligations and to establish, exercise, or defend legal claims.

Legal bases (GDPR). Where the GDPR applies, we rely on the following legal bases:

• Performance of a contract (or steps taken at the request of our client) — to provide the Service and process orders;
• Legitimate interests — to secure the Service, prevent fraud, maintain audit integrity, and operate our business, balanced against individuals’ rights; and
• Compliance with a legal obligation — including recordkeeping and responding to lawful requests.

No automated decision-making about Candidates. VICTIG Connect does not make automated decisions producing legal or similarly significant effects about Candidates. Hiring and adjudication decisions are made by the employer/client, not by VICTIG Connect.

4. Extension Permissions, and the Chrome Web Store “Limited Use” Statement

4.1 Permissions the Extension requests, and why

The Extension requests the minimum permissions needed to perform its single purpose. We do not request broad or persistent access to your browsing.

The Extension also declares host permissions limited to (a) the VICTIG Connect backend API origin and (b) the Supabase authentication endpoint — used solely to make the authenticated API calls that place orders and manage your session. The Extension does not request broad host access to arbitrary websites.

4.2 Single-purpose declaration

The single purpose of VICTIG Connect is to enable authorized Client Users to initiate employment background-check orders by capturing, reviewing, and submitting a Candidate’s contact details to VICTIG’s screening platform. All permissions and data handling described in this policy exist to serve that single purpose.

4.3 Chrome Web Store “Limited Use” statement

VICTIG Connect’s collection and use of information from the Extension comply with the Chrome Web Store User Data Policy, including its Limited Use requirements. Specifically:

1. Limited use of data. We only collect and use the data described in this policy, and we use it solely to provide and improve the single purpose of VICTIG Connect — initiating background-check orders. We do not use it for any unrelated purpose.
2. No unauthorized transfer. We do not transfer this data to third parties except: (a) as necessary to provide or improve the single purpose (for example, transmitting order details to our screening platform and infrastructure sub-processors, as described in Section 5); (b) to comply with applicable law or a valid legal request; (c) to protect against security threats, fraud, or abuse; or (d) as part of a merger, acquisition, or sale of assets, with notice to affected users as required by law.
3. No advertising use. We do not use or transfer this data for personalized, targeted, or any other form of advertising, and we do not use it for creditworthiness or lending purposes.
4. No unauthorized human reading. We do not allow humans to read the data, except: (a) where necessary to provide or support the Service at your request or with your consent; (b) for security purposes (such as investigating abuse); (c) to comply with applicable law; or (d) where the data has been aggregated and de-identified for internal operations.

4.4 Safari and other distributions

Where VICTIG Connect is distributed for Apple Safari (via the App Store) or other browsers, we apply equivalent data-minimization and limited-use practices, and we comply with the applicable platform’s developer and privacy program requirements.

5. How Information Is Shared

We share personal information only as needed to provide the Service and to meet legal and security obligations. We do not sell or rent personal information, and we do not share it for cross-context behavioral advertising.

5.1 Screening platform provider

To fulfill an order, we transmit the Candidate’s contact details to VICTIG’s screening platform provider, TazWorks (InstaScreen), which performs and stores the background check. This provider acts as the system of record for background-check data and operates as a consumer reporting agency subject to the FCRA, including FCRA recordkeeping and retention requirements (typically up to approximately seven (7) years).

5.2 Infrastructure sub-processors

We use trusted service providers (“sub-processors”) to host and operate the Service under contractual confidentiality and data-protection obligations. They may process personal information only on our instructions and only to provide their services to us:

We keep this sub-processor list current. If we add further providers, we will update it here or on a separately linked sub-processor page.

5.3 Legal, safety, and corporate transactions

We may disclose information: (a) to comply with applicable law, regulation, legal process, or an enforceable governmental or court request; (b) to enforce our terms or protect the rights, property, security, or safety of VICTIG, our clients, Candidates, or others; and (c) in connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case we will require the recipient to honor this policy or provide notice as required by law.

5.4 At your client’s direction

Because VICTIG Connect is a B2B tool, we may share information with, or as directed by, the business client whose account a Client User is using (for example, the employer or organization that authorized the Client User’s access).

5.5 No sale or sharing for advertising

We do not sell personal information and do not share it for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA or similar laws. We have not done so in the preceding 12 months.

6. Data Retention

We retain personal information only as long as necessary for the purposes described in this policy or as required by law.

• Background-check records: Retained by the screening platform provider in accordance with FCRA and other legal requirements — typically up to approximately seven (7) years.
• Cached order records (within the Service): Retained for up to seven (7) years to support the order/audit trail and align with FCRA-related recordkeeping, then deleted or de-identified.
• Audit logs: Retained for up to seven (7) years for security and compliance, then deleted or de-identified.
• Client User account data: Retained for the life of the Client User’s account and for up to two (2) years thereafter, subject to legal-hold and compliance requirements.
• Locally stored authentication tokens: Stored on the user’s device until sign-out, token expiry, removal of the Extension, or clearing of browser/extension storage.

When personal information is no longer needed, we delete, anonymize, or securely retain it as required by applicable law.

7. Data Security

We maintain administrative, technical, and organizational safeguards designed to protect personal information, including:

• Encryption in transit (e.g., TLS/HTTPS) for data transmitted between the Extension, the backend API, and our sub-processors, and encryption at rest for stored data (our Supabase-managed database encrypts data at rest).
• Access controls and least-privilege, including role-based access and row-level security (RLS) in our database so that Client Users can access only the data they are authorized to access.
• Authentication managed through Supabase, with authentication tokens stored locally on the user’s device rather than centrally exposed.
• Audit logging of key actions (user ID, action, timestamp, IP address, user agent) to support security monitoring and accountability.
• Rate limiting and abuse protections on the backend API, and ongoing review of our security practices.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting personal information, we will respond and provide notifications as required by applicable law and our contracts.

8. Your Privacy Rights

Your rights depend on where you live and on the nature of the information. Important: where information is governed by the FCRA, certain rights are exercised through the FCRA framework (for example, disputing the accuracy of a consumer report is handled through the screening platform/consumer reporting agency and the employer, not through VICTIG Connect). The CCPA also exempts FCRA-regulated activity to the extent described in Section 1.

8.1 California (CCPA/CPRA)

Subject to applicable exemptions (including the FCRA exemption), California residents may have the right to:

• Know/Access the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of recipients;
• Delete personal information we have collected, subject to exceptions;
• Correct inaccurate personal information;
• Opt out of sale/sharing — note that we do not sell or share personal information for cross-context behavioral advertising;
• Limit the use of sensitive personal information — note that we limit our use of any sensitive information to what is necessary to provide the Service; and
• Non-discrimination for exercising these rights.

8.2 EEA / UK (GDPR / UK GDPR)

Subject to applicable conditions and exemptions, individuals in the EEA or UK may have the right to: access; rectification (correction); erasure; restriction of processing; data portability; objection to processing (including processing based on legitimate interests); rights related to automated decision-making (which we do not perform, as noted in Section 3); and the right to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with your local supervisory authority (or, in the UK, the Information Commissioner’s Office).

8.3 Other U.S. states and jurisdictions

Residents of other U.S. states with comprehensive privacy laws (and individuals in other jurisdictions) may have similar rights. We honor applicable rights and disclosures required by the laws of the jurisdictions in which our users are located.

8.4 How to exercise your rights

To make a request, contact us at support@victig.com (see Section 12). Please tell us what right you wish to exercise and provide enough information for us to locate the relevant records.

• Verification. To protect your information, we will take reasonable steps to verify your identity before responding. We may need to confirm your relationship to the data (for example, as a Client User or a Candidate).
• Authorized agents. You may use an authorized agent to submit a request where the law allows, subject to verification.
• Candidates. If you are a Candidate and have a question or request about your background check, the employer that requested the check and the screening platform provider are the primary points of contact under the FCRA. We will help direct your request appropriately and will respond to requests for which VICTIG is responsible.
• Timing and fees. We will respond within the timeframes required by applicable law. Requests are generally free, though we may charge a reasonable fee or decline where permitted (for example, for manifestly unfounded or excessive requests).
• No retaliation. We will not discriminate or retaliate against you for exercising your rights.

9. Children’s Data

VICTIG Connect is a B2B tool intended for use by authorized adult personnel of VICTIG’s business clients. It is not directed to children, and we do not knowingly collect personal information from children. The Service is not intended for anyone under the age of 16 (or the applicable age of majority in your jurisdiction). If you believe a child’s information has been provided to us in error, please contact us at support@victig.com so we can address it.

10. International Data Transfers

VICTIG is located in Utah, United States, and we and our sub-processors process personal information in the United States. If you access the Service from outside the United States, your information may be transferred to, stored in, and processed in a country whose data-protection laws differ from those of your own.

Where required (for example, for any transfer of personal data subject to the EEA or UK GDPR), we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs) or the UK International Data Transfer Addendum.

11. Changes to This Policy

We may update this policy from time to time to reflect changes to the Service, our practices, or legal requirements. When we make material changes, we will update the “Last updated” date above and, where appropriate or required, provide additional notice (for example, through the Service or by email to Client Users). The version published at https://connect.victigdevelopment.com/privacy-policy.html is the current version. Your continued use of VICTIG Connect after an update takes effect constitutes acceptance of the revised policy, to the extent permitted by law.

12. Contact Information

If you have questions about this policy or our privacy practices, or wish to exercise a privacy right, contact us at:

Victig Background Screening
Attn: Privacy
14442 S Center Point Way, Bluffdale, UT
Email: support@victig.com