Privacy Policy

Hireschema ("Hireschema", "we", "us") operates an AI-powered recruiting platform for candidates and recruiters in India (+91 phone collection; SMS OTP verification when enabled). This Privacy Policy explains how we collect, use, store, and protect your personal data in compliance with India's Digital Personal Data Protection (DPDP) Act 2023. By using Hireschema, you consent to the practices described in this policy. If you do not agree, please do not use the platform.

Professional profile data: Name, email, phone (market dial code verified), work history, skills, education, and salary expectations — collected via LinkedIn OAuth or manual entry. Resume and documents: Files you upload (PDF/DOCX). Stored securely in Supabase Storage (AWS ap-south-1) with signed URL access only. Conversation data: Chat messages and voice transcripts from your interactions with Hireschema AI. Retained for 90 days. Usage data: Pages visited, features used, session timestamps. Used for product improvement only. Not sold. LinkedIn OAuth data: Public profile fields authorised by you at sign-in. We store only what is displayed in your public LinkedIn profile. Google OAuth data: We store OAuth tokens to send intro emails on your behalf and to create calendar events for voice-session bookings you request. We never read your inbox or existing calendar contents. Scopes: gmail.send and calendar.events only.

We process your data for the following purposes (DPDP Act §6): • Profile creation and job matching (core service) • Sending warm intro emails to hiring managers (with your explicit approval) • Sending transactional notifications (job matches, intro status, interview reminders) • Platform security, fraud prevention, and abuse detection • Product analytics and improvement (anonymised) • Legal compliance and dispute resolution Every data collection event is logged in our consent_log table with purpose, timestamp, and your IP address.

We do not sell your personal data. We share data only in the following cases: • With hiring managers (name, headline, skills summary — when you request an intro) • With our technical vendors (Supabase, OpenRouter, Deepgram, Apify, SendGrid, MSG91, Google Analytics) solely to provide the service — all are contractually bound by data processing agreements • When required by Indian law or a court order • In aggregate, anonymised form for research or product improvement We do not share data with advertisers, data brokers, or third-party marketers.

All data is stored in AWS ap-south-1 (Mumbai, India). We do not transfer personal data outside India except to our technical sub-processors (listed in our DPA, available on request). Security measures: TLS 1.3 in transit, AES-256 at rest, Row Level Security on all Postgres tables, signed-URL-only file access, no plain-text secrets in code.

Active accounts: We retain your data while your account is active and for 30 days after deletion (to handle disputes). Soft delete: When you delete your account, your data is marked deleted_at and purged from our databases after 30 days via automated pg_cron job. Conversation history: Chat and voice transcripts are deleted after 90 days. Right to deletion: You can request immediate deletion by emailing privacy@hireschema.com or using the in-app "Delete my account" button.

Under the DPDP Act 2023, you have the right to: • Access: Request a copy of all personal data we hold about you. • Correction: Request correction of inaccurate data. • Erasure: Request deletion of your data (see §6). • Nomination: Nominate a person to exercise your rights on your behalf. • Grievance redressal: Lodge a complaint with our DPO (below). To exercise these rights: Email privacy@hireschema.com or use the in-app "Data & Privacy" settings. We respond within 72 hours.

We use essential cookies for authentication (via Supabase Auth) and CSRF protection. We also use Google Analytics 4 (property G-BX7MT5EE6E) to measure visits and in-product usage. Google may set cookies and process that data on servers outside India. We do not use Google Ads or other advertising pixels.

Hireschema is not available to persons under 18. We do not knowingly collect data from minors. If you believe a minor has created an account, contact privacy@hireschema.com immediately.

Hireschema has designated a Data Protection Officer as required under DPDP Act 2023. DPO Contact: privacy@hireschema.com Response time: 72 hours for privacy-related requests, 30 days for formal DPDP Act requests.

We may update this policy. Material changes will be notified by email and in-app at least 7 days before they take effect. Continued use after the effective date constitutes acceptance. Last updated: August 2026