iR iRecrut

Privacy Policy

Effective 1 June 2026

This policy explains how iRecrut collects, uses, stores, and protects your personal information — including data submitted by employers, job seekers, and WhatsApp users. We are committed to transparency and responsible data stewardship.

At a glance: We collect the minimum data needed to run our recruitment platform. We do not sell your personal data. You have rights to access, correct, and delete your information. Full details below.
1

Who We Are

iRecrut ("we", "our", "us") is an AI-powered recruitment platform for small and medium enterprises (SMEs), headquartered in Gujarat, India. We provide employer dashboards, AI-driven candidate matching, and a WhatsApp-first hiring workflow.

For purposes of applicable data protection law, iRecrut is the Data Controller for personal data processed through its Services.

2

Information We Collect

From Employers

  • Account details (company name, contact person, email, phone)
  • Job postings, descriptions, and requirements
  • Subscription and billing records (excluding card/bank details — processed by our payment provider)
  • Usage logs and activity on the platform

From Candidates / Job Seekers

  • Resume / CV documents and extracted text
  • Contact details (name, email, phone, location)
  • Work history, education, skills, and preferences
  • WhatsApp interactions and messages sent to our platform number

Automatically Collected

  • IP address, browser type, device information
  • Pages visited, time on site, referral URL
  • Session and authentication tokens (stored securely; not shared)
3

How We Use Your Data

  • Provide, operate, and improve the recruitment Services
  • Match candidates to job opportunities using AI and rule-based algorithms
  • Parse and enrich resumes, job descriptions, and candidate profiles
  • Send transactional messages via email and WhatsApp (account updates, matches, notifications)
  • Process subscription payments and maintain billing records
  • Detect and prevent fraud, abuse, and security incidents
  • Comply with legal obligations and respond to lawful requests
4

AI Processing of Personal Data

Certain personal data — including resume text, skill profiles, and job-match scoring — is processed using third-party large language models (LLMs) via secure, encrypted API calls for the sole purpose of delivering our recruitment features.

Our AI provider (OpenAI) is bound by a data processing agreement. Resume and profile data passed to the AI is not used by the model provider to train future models.

AI-generated profiles and scores assist matching but do not constitute automated decision-making with legal effect — employers retain full discretion over all hiring choices.

5

Data Sharing & Third Parties

We do not sell your personal data.

We share personal data only in these limited circumstances:

  • Employers: Candidate profiles and match data are shared with relevant employers only within the platform.
  • Service Providers: Cloud hosting, email delivery, AI inference, analytics, and payment processing — subject to data processing agreements.
  • Legal Requirements: Where required by court order, law enforcement request, or applicable legislation.
  • Business Transfer: In the event of a merger, acquisition, or sale of assets, with prior notice to affected users.
6

Data Retention

  • Active accounts: Retained for as long as the account is active or until deletion is requested.
  • Closed accounts: Core personal data deleted or anonymised within 90 days, except where required by law.
  • Financial records: Billing data retained for a minimum of 7 years to comply with Indian tax law.
  • Backups: Encrypted backups purged on a rolling 30-day cycle.
7

Security Measures

We implement industry-standard technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction.

  • All data transmitted over HTTPS (TLS 1.2+)
  • Passwords hashed using bcrypt; secrets encrypted at rest
  • Role-based access control limiting internal data access
  • Regular automated backups with encryption

While we take every reasonable precaution, no system is completely immune to breaches. If a security incident affecting your personal data occurs, we will notify you as required by law.

8

Cookies & Tracking

We use essential cookies to maintain your login session and protect against CSRF attacks. These are strictly necessary and cannot be opted out of while using the platform.

We do not currently use third-party advertising or tracking cookies. Any future use of non-essential cookies will be disclosed and subject to your consent.

9

WhatsApp Data

If you interact with iRecrut via WhatsApp, your phone number, messages, and session state are stored to facilitate the conversation flow (job registration, candidate onboarding, notifications).

WhatsApp interactions are also subject to Meta's privacy policy. We do not access your personal WhatsApp chats — only messages sent directly to our registered business number.

10

Your Data Rights

Subject to applicable data protection law, you have the right to:

Access

Request a copy of personal data we hold about you.

Correction

Ask us to correct inaccurate or incomplete data.

Deletion

Request erasure of your data, subject to legal retention obligations.

Portability

Receive your data in a structured, machine-readable format.

Objection / Restriction

Object to or restrict certain processing activities.

To exercise any of these rights, contact us at support@irecrut.com. We will respond within 30 days.

11

Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, or applicable law. The updated policy will be posted here with a revised effective date.

For material changes that expand how we use personal data, we will notify active users via email or in-app notification prior to the change taking effect.

12

Contact & Complaints

For privacy enquiries, data requests, or to report a concern, contact our data team. We aim to respond within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the relevant data protection authority in your jurisdiction.