Privacy Policy

RecruitGPT (“RecruitGPT”, “we”, “us”, “our”) operates an AI-assisted talent discovery and verification platform focused on IT, SAP, AI, Data and Software Engineering hiring in India. For the personal data described in this policy, RecruitGPT acts as the Data Fiduciary within the meaning of the DPDP Act: we determine the purpose and means of processing your personal data.

Where an employer uses RecruitGPT to review candidates for its own hiring, the employer independently decides how it uses the candidate data made available to it and is responsible for that use under applicable law and our Employer Terms.

This policy applies to personal data we process when you:

• visit our website and public pages, including public Talent Passport pages;
• create a candidate account and build or share your Talent Passport;
• create an employer account or workspace, post jobs, search for talent, message candidates or purchase a plan;
• contact us for support, sales, privacy or grievance matters.

This policy should be read together with our Terms of Service, the Candidate Consent notice and the Employer Terms. It does not cover third-party websites you reach through links on our platform, such as a credential URL you add to your profile.

Candidates. When you use RecruitGPT as a candidate, we process:

• Account data: your name, email address, optional phone number, sign-in credentials (passwords are stored only in hashed form) or the identifier from a sign-in provider you choose, and your account role.
• Talent Passport: headline, summary, skills and proficiency, work experience, projects, certifications, credential IDs and URLs, evidence documents you upload (for example employment letters, certificates or project artefacts), and your resume.
• Job preferences: notice period, availability date, current and preferred locations, work-mode and employment-type preferences, industries of interest, and compensation expectations.
• Activity on the platform: job applications, messages with employers, interview responses, assessments you take, interview preparation you create, offers and joining signals you choose to record, and verification requests or disputes.
• Consent records: which notices you accepted, the version, the timestamp, and technical context (IP address and browser user agent) needed to evidence your consent.

Employers. When you use RecruitGPT as an employer, we process your name, work email, designation, workspace role, company details (name, website, size, industry, company type, description), the jobs you create and the job descriptions you paste, your searches, shortlists, notes, pipeline actions, messages, interviews, assessments and offers, and billing data (plan, payment status, order and payment references, GST invoice details). Card, UPI and bank details are collected and processed by our payment processor, not stored by us.

Technical data. We collect server and security logs (IP address, browser type, timestamps, pages and endpoints requested, error events) to operate, secure and debug the service. We use only essential cookies, such as the session cookie that keeps you signed in. We use first-party analytics stored in our own database (for example “job published” or “profile completed” events) to understand how the product is used. We do not use third-party advertising trackers, cross-site tracking pixels or social media tracking scripts.

RecruitGPT is designed to help employers focus on skills and evidence. For that reason:

• We do not ask for, and our product has no fields for, protected attributes such as age or date of birth, gender, religion, caste, marital status, disability, or photographs.
• We never infer age, gender, religion, caste, marital status or disability from your resume, name, or any other data, and we do not use such attributes in search, matching or summaries.
• There are no candidate profile photos anywhere in the product.

If a document you upload happens to contain such information (for example, a date of birth on a certificate), we do not extract it into your profile or use it for matching. We recommend redacting information you do not want to share before uploading evidence.

We process personal data only for specified, lawful purposes:

• creating and securing your account and authenticating you;
• building your Talent Passport, including AI-assisted extraction of your resume into suggestions you review;
• showing your Talent Passport to others strictly according to your visibility settings;
• helping employers structure job descriptions, search for talent and see evidence against each job requirement;
• enabling in-app messaging, interview scheduling, assessments, offers and notifications;
• performing human review of verification requests;
• processing payments, issuing GST invoices and maintaining financial records for employers;
• preventing fraud, fake profiles, fake jobs and abuse, and keeping audit trails of sensitive actions;
• improving the product using aggregated first-party analytics (demo data is excluded).

Legal basis. Our primary basis is your consent under section 6 of the DPDP Act, which you give when you create an account and accept the relevant notices. We also rely on the legitimate uses recognised in section 7 of the DPDP Act where applicable, for example where you voluntarily provide data for a specified purpose (such as submitting a support request), or where processing is necessary to comply with a law, a judgment or order, or to respond to a medical emergency or similar situation contemplated by the Act.

We ask for consent through clear, itemised notices. Each consent is recorded with its type (for example Terms, Privacy, Candidate Consent, profile sharing, assessment sharing), the policy version you agreed to, and a timestamp, together with basic technical context to evidence it.

You can withdraw consent at any time, and doing so is as easy as giving it. You can change your profile visibility, turn off sharing of individual assessments or interview preparation, withdraw specific consents in your privacy settings, or delete your account.

Consequences of withdrawal. Withdrawal is prospective: it does not affect processing carried out before you withdrew. If you withdraw consent that is essential to the service (such as consent to process your Talent Passport), we will not be able to continue providing the related features, and we will stop processing and delete the relevant data within a reasonable time unless retention is required by law. Employers who already received your information through an application may retain it under their own legal obligations, but they may no longer access your passport through RecruitGPT beyond what your new settings allow.

According to your visibility settings. Your Talent Passport is shared only as you choose:

• Private – visible only to you (and to employers for jobs you actively apply to).
• Public – visible to anyone with the link and may be indexed by search engines.
• Shared only with employers – visible only to signed-in employer accounts on RecruitGPT.

Your private email address and phone number are never shown to employers or on public pages. Employers contact you through in-app messaging, and you decide whether to share contact details. Compensation expectations are never shown on a public page. Evidence documents are shared with employers only if you mark them as shared with employers. Full details are in the Candidate Consent notice.

Service providers (Data Processors). We use carefully selected providers who process personal data on our behalf and under our instructions, including cloud hosting and database infrastructure, file storage, email delivery for notifications, AI model providers used to power the assistive features described below, and, for employers, our payment processor Razorpay. These providers may only use the data to provide their services to us and must protect it with appropriate safeguards.

Legal requirements. We may disclose personal data where required by law, a court order or a lawful request by a government authority, or where reasonably necessary to protect the rights, safety or property of our users, the public or RecruitGPT, including to investigate fraud or abuse.

Business transfers. If RecruitGPT is involved in a merger, acquisition or sale of assets, personal data may be transferred as part of that transaction, subject to this policy and applicable law. We will notify you before your data becomes subject to a materially different policy.

RecruitGPT uses AI to reduce busywork, not to judge people. Specifically:

• Resume extraction: AI reads your resume and proposes skills, experience, projects and certifications as suggestions. They stay labelled “AI Extracted” until you review and confirm them. We never silently change what you have stated.
• Job structuring: AI turns an employer’s job description into structured requirements, which the employer reviews and confirms.
• Evidence summaries: AI summarises, per job requirement, which evidence in a passport relates to it and where evidence is missing, so recruiters can read faster.

AI never makes hiring decisions. It never auto-rejects or auto-advances candidates, never produces hireability, fit or suitability scores, and never recommends hiring a particular person. Every pipeline decision, including rejection, is taken by a human and logged with who made it and when.

Every data point carries a provenance label so everyone can see where it came from: Candidate Provided, AI Extracted, Candidate Confirmed, Verified or Not Verified. “Verified” appears only after a human reviewer has examined the submitted evidence. No third-party verification provider is connected today; all verification is performed by human review.

AI outputs can be incomplete or wrong. That is why candidates confirm extractions and recruiters make all decisions. We do not use your personal data to train third-party foundation models.

Under the DPDP Act, you have the right to:

• Access a summary of the personal data we process about you and the processing activities, and the identities of Data Fiduciaries and Data Processors with whom it has been shared (section 11). You can also export your data in a portable format.
• Correction, completion and updating of inaccurate or incomplete data (section 12). Most of your profile can be edited directly.
• Erasure of personal data that is no longer necessary, including deletion of your account (section 12), subject to legal retention requirements.
• Withdraw consent at any time (section 6).
• Grievance redressal through our grievance officer (section 13).
• Nominate another individual to exercise your rights in the event of your death or incapacity (section 14).

How to exercise your rights. Signed-in users can raise a data request (export, correction, deletion or restriction) from the privacy settings in the app, where you can also track its status. You can also email privacy@recruitgpt.in from the address associated with your account. We may need to verify your identity before acting on a request. We do not charge for reasonable requests.

If you have a concern about how your personal data is handled, contact our Grievance Officer at privacy@recruitgpt.in. Please include your account email, a description of the issue and any relevant details.

• We aim to acknowledge your grievance within 48 hours.
• Our policy is to resolve grievances within 30 days of receipt, or sooner where required by applicable rules. If we need more time, we will tell you why.

If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India in accordance with the DPDP Act, after exhausting our grievance redressal process.

• Active accounts: we keep your data for as long as your account is active and it is needed to provide the service.
• Deletion requests: when you delete your account or request erasure, we delete or irreversibly anonymise your personal data within 30 days, except where we must retain it by law.
• Financial records: invoices, payment and tax records for employers are retained for the period required under Indian tax and accounting laws, generally around 8 years.
• Audit and security logs: records of sensitive actions (such as verification decisions, pipeline moves, visibility changes and data requests) and consent records are retained for security, accountability and dispute resolution, and are minimised to what is necessary.
• Backups: deleted data may persist in encrypted backups for a limited period until overwritten in the normal backup cycle.

Where an account has been inactive for an extended period, we may contact you and, if you do not respond, delete personal data that is no longer necessary for the purpose it was collected.

We implement reasonable security safeguards appropriate to the nature of the data, including:

• encryption in transit (HTTPS/TLS) for all traffic to and from the platform;
• role-based access controls so candidates, employers and administrators see only what they are allowed to;
• audit logs of sensitive actions, recording who acted and when;
• time-limited signed URLs for uploaded files instead of permanent public links;
• file type and size validation on uploads;
• rate limiting on AI, upload and public endpoints to deter scraping and abuse;
• hashed passwords and secure session cookies.

No system is perfectly secure. In the event of a personal data breach, we will notify affected users and the Data Protection Board of India as required by the DPDP Act and its rules.

We never sell personal data. We do not rent or trade candidate databases, we do not share data with data brokers, and we do not allow employers to build or maintain blacklists of candidates through our platform. Bulk export and scraping of candidate data are prohibited by our Employer Terms.

RecruitGPT is intended for professionals and is not directed to anyone under 18 years of age. We do not knowingly process personal data of children. If you believe a child has created an account, contact privacy@recruitgpt.in and we will delete it.

Some of our service providers (for example cloud hosting, email delivery or AI model providers) may process data on servers outside India. We transfer personal data outside India only as permitted by the DPDP Act and any restrictions notified by the Government of India, and we require providers to protect it with safeguards consistent with this policy.

We may update this policy to reflect changes in our product, law or practices. Each version is dated and versioned at the top of this page. If a change materially affects how we process your data, we will notify you in the app or by email and, where required, ask for your fresh consent before the change applies to you.

For privacy questions, data requests or grievances, email privacy@recruitgpt.in. For general support, email support@recruitgpt.in. You can also reach us through our contact page.