Privacy Policy

The following data points are collected from Candidates. This list is exhaustive.

• Full name
• Email address
• Phone number (mobile)
• Resume / CV file (PDF, DOCX, or other submitted format)
• Resume contents: work experience, educational qualifications, skills, certifications, projects, and references (as provided by the Candidate)
• IP address (collected automatically upon platform access)
• Browser type and version (collected automatically)
• Session activity logs (pages visited, timestamps, interactions)

The following data points are collected from Recruiters/Employers. This list is exhaustive.

• Full name of account holder
• Business email address
• Company / organisation name
• Phone number
• Company registration or GST details (for invoice and tax compliance)
• Payment information — Card numbers, UPI handles, and banking credentials are processed exclusively by Razorpay and are never stored on Purehire servers.
• IP address and browser metadata
• Job posting content authored by the recruiter

• Server logs (IP, timestamp, endpoint accessed)
• Analytics data (page views, click events) — collected in aggregate; not used to profile individuals
• Session cookies (functional only — see Section 10)

• Data shared: Transaction amount, payer identity metadata
• Data not shared: Resume content, job data, candidate personal information
• Prohibited from:Storing card or UPI data on Purehire's behalf beyond the regulatory minimum required under RBI guidelines
• Their policy: https://razorpay.com/privacy/

• Data shared: Resume text content and job description text — transmitted per-request, not batched or stored
• Data not shared: Candidate name, email, or phone number (Candidates are advised to redact directly identifying fields from resume body text)
• Prohibited from:Retaining data beyond the API call duration; using submitted data to train or improve AI models (governed by Google's enterprise API terms)
• Their policy: https://policies.google.com/privacy

• Data shared: Resume text content and job description text — transmitted per-request
• Data not shared: Directly identifying fields (same caveat as Section 7.2 above)
• Prohibited from: Retaining data beyond the API call; using submitted data to train AI models
• Their policy: https://groq.com/privacy-policy/

• Candidate data is shared only with the Recruiter who posted the specific job for which the Candidate submitted an application.
• Data shared with the Recruiter: full name, email address, phone number, resume file, and AI match score.
• Recruiters are prohibited by Purehire's Terms of Service from: sharing Candidate data with third parties; using it for unsolicited outreach unrelated to the applied role; and retaining it beyond their active recruitment process for that role.
• Purehire cannot technically enforce Recruiter conduct after data is downloaded. Candidates are made explicitly aware of this limitation at the point of application consent.

• Personal data will be disclosed to government or law enforcement authorities only upon receipt of a lawful order, court order, or statutory requirement under Indian law.
• Purehire will not cooperate with informal or voluntary requests for personal data without appropriate legal authority.
• Where legally permissible and not prohibited by the relevant order, Purehire will notify the affected Data Principal of such a disclosure.

• All data in transit is encrypted via TLS 1.2 or higher.
• Data at rest is encrypted using AES-256 or equivalent.
• Access to personal data is restricted to authorised personnel with role-based access controls. Access rights are reviewed quarterly.
• Passwords are hashed using bcrypt or an equivalent one-way function. Purehire staff cannot view plaintext passwords at any time.
• Internal security reviews are conducted on a regular scheduled basis.
• Data processing agreements with all three processors (Razorpay, Google, Groq) include binding data security obligations.

• In the event of a personal data breach that is likely to result in risk to Data Principals, Purehire will notify affected individuals within 72 hours of becoming aware of the breach, as required under DPDPA 2023.
• Notification will include: nature of the breach, categories of data affected, likely consequences, and remedial steps taken or planned.

Purehire has implemented reasonable and appropriate technical and organisational security measures. However, no digital system can guarantee immunity from all threats. Purehire is not liable for breaches caused by a Data Principal's own disclosure of credentials or by a Recruiter mishandling data after it has been lawfully downloaded from the platform.

This Privacy Policy and any disputes arising from it are governed by the laws of the Republic of India. The courts of Kozhikode, Kerala shall have exclusive jurisdiction.

Purehire operates as a Data Fiduciary under the DPDPA 2023. All processing activities described in this policy are conducted in accordance with the Act and rules notified thereunder. Purehire will update this policy within 30 days of any material new rule notification under DPDPA 2023.

Purehire complies with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, in particular with respect to collection, storage, and transfer of sensitive personal data.

As required under IT Act 2000 Section 43A and DPDPA 2023, a Grievance Officer is designated below. All privacy complaints and data rights requests must be directed to this contact.

If your grievance is not resolved within 30 days of submission, you may escalate to the Data Protection Board of India once constituted under DPDPA 2023.

• Resume content is transmitted to Google (United States) and Groq (United States) for AI scoring. This constitutes cross-border personal data transfer under DPDPA 2023.
• These transfers occur under: (a) the Candidate's explicit consent given at the point of application; and (b) data processing agreements with each processor that impose equivalent data protection obligations.
• Purehire will comply with any government-notified restrictions on cross-border transfer under DPDPA 2023 rules as they are published, and will update this policy and practices accordingly.