Optional capture. Explicit consent.

Runtime capture is on. Candidates must agree before events are stored; declining still completes the assessment. Retention defaults to 90 days (30 if marked private). DSAR delete is candidate-owned. Manifest access is IDOR-guarded to the candidate or the linked recruiter.