The short version: We collect only what we need to run RecruitEasy. We never sell your data. Your candidates' data is yours. We're DPDP-compliant and India-hosted.
1. What We Collect
When you use RecruitEasy, we collect:
- Account data: name, email address, phone number, and GST number (if provided for invoicing)
- Usage data: features used, jobs created, candidates added, and AI calls made — used to improve the platform
- Candidate data: résumés, contact details, and pipeline notes that you upload and manage
- API keys: stored encrypted (AES-256-GCM); never logged in plain text, never visible to our team
- Payment data: processed via Razorpay; we store only the invoice reference and plan status, never your card details
2. How We Use It
- To operate and improve the RecruitEasy platform
- To process your AI requests (résumé screening, copilot, JD analysis)
- To send product updates, billing notifications, and support responses
- To generate GST-compliant invoices for your account
- To provide customer support when you contact us
3. What We Never Do
- We never sell your data or your candidates' data to any third party
- We never use your candidate data to train AI models
- We never share your data with other RecruitEasy customers
- We never display ads inside RecruitEasy based on your data
4. AI & Third-Party Models
When you use AI features with our shared pool, résumé text is sent to our AI providers (Groq / Anthropic) for processing. If you use your own API key, requests go directly from your browser to your provider — we do not see the content. All providers we use are contractually prohibited from using your data for model training.
5. Data Storage & Security
- All data encrypted at rest (AES-256) and in transit (TLS 1.3)
- Servers hosted in India (AWS ap-south-1, Mumbai region)
- API keys encrypted with AES-256-GCM, never logged in plaintext
- Regular security audits and penetration testing
- Role-based access controls; only engineers with a demonstrated need can access production systems
6. Google OAuth & Gmail Integration
RecruitEasy optionally connects to your Google account via OAuth 2.0. When you authorise this integration, we request access to the following Google scopes:
- Gmail — Send on Behalf: To send interview invitations, offer letters, and candidate communications directly from your Gmail address inside RecruitEasy. We do not read, index, or store your inbox messages.
- Google Calendar: To create interview events, sync scheduling, and send calendar invites to candidates and hiring managers on your behalf.
- Google Drive & Files: To let you attach JDs, offer letters, and candidate documents from your Drive, and optionally save exported reports back to your Drive.
Important disclosures regarding Google user data:
- RecruitEasy's use of Google user data is limited strictly to the features described above. It is not used for advertising, profiling, or any purpose unrelated to recruitment workflow.
- We do not use Google user data to train AI or machine learning models.
- Google data is not shared with third parties except as necessary to deliver the specific feature (e.g., sending a calendar invite creates a Google Calendar event on your behalf).
- You can revoke Google access at any time from myaccount.google.com/permissions or from inside RecruitEasy under Settings → Integrations → Google.
- On revocation or account deletion, all stored OAuth tokens are immediately and permanently deleted from our systems.
Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
7. Cookies & Analytics
We use minimal, functional cookies to keep you logged in and remember your preferences. We use privacy-respecting analytics (no third-party ad trackers). We do not use Google Analytics or Facebook Pixel.
8. Data Retention
We retain your data for as long as your account is active. On cancellation, you can export all your data within 30 days. After 30 days, account data is permanently deleted. Backups are purged within 90 days.
9. Your Rights (DPDP Act 2023)
Under India's Digital Personal Data Protection Act 2023, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Erase your personal data (right to be forgotten)
- Withdraw consent for data processing at any time
- Nominate a representative to exercise these rights on your behalf
To exercise any of these rights, email partner@talentpros.in with the subject line "Data Rights Request". We will respond within 72 hours.
10. Changes to This Policy
We may update this policy from time to time. We'll notify you by email and show a banner in the app for material changes. The "Last updated" date at the top of this page reflects the most recent revision.
11. Contact
Data Protection Officer
Talentpros Consulting Pvt Ltd
Bangalore, Karnataka, India
partner@talentpros.in