This is a template, not legal advice. It was drafted from how this product actually works, but it has not been reviewed by a lawyer. Have one review it — and fill in the blanks marked on the contact page — before you rely on it or submit it to a payment gateway.

Privacy Policy

Last updated 7 September 2026 · Version 1.0

This notice explains what personal data Interview Portal collects, why, who it goes to, how long we keep it, and what you can ask us to do about it. It is written to meet the itemised-notice requirement of India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”).

1. Two different roles

For workspace users — owners, recruiters and interviewers — we are the Data Fiduciary: we decide why and how your account data is processed, and this notice is our notice to you.

For candidate data uploaded by a company — résumés, contact details, interview feedback, assessment answers, video recordings — the company that runs the workspace is the Data Fiduciary and we are its Data Processor. If you are a candidate and want your data changed or removed from a particular company’s workspace, we will pass your request to that company; we act on their instruction, not our own judgement. Where you created your own candidate account and profile with us directly, we are the Fiduciary for that profile.

2. What we collect, and why

Data	Why we process it
Email address, name, password hash, the workspaces you belong to and your role	To create and authenticate your account and scope what you can see.
Candidate profile: name, email, phone, location, notice period, current and expected salary, skills, résumé file and its extracted text	To let a candidate apply once and be assessed for a role, and to let recruiters search their own talent database.
Application data: stage history, interviewer ratings and written feedback, assessment answers and scores, AI summary and fit score, rejection reasons	To run the hiring pipeline the company configured.
Recorded video answers (one-way video screening) and their transcripts/summaries	To let recruiters review a screening answer asynchronously. Recording only happens after the candidate starts it themselves from an invite link.
Background verification data: identity, address, employment, education and criminal-record check results, plus the candidate’s consent record	To fulfil a verification a company ordered, only after the candidate consents through their own link.
Scheduling data: interviewer availability, interview times, and calendar events where a Google or Microsoft calendar has been connected	To schedule interviews and send invites.
Billing data: plan, seats, metered usage counts, GSTIN, billing state, invoices and payment references	To bill the company and issue GST invoices. Card and bank details are handled by the payment gateway and never reach our servers.
Technical data: IP address, user agent, request paths, timestamps, error traces	Security, abuse prevention and debugging.
Cookies: a session cookie, a CSRF token, and a theme preference in local storage	To keep you signed in and to protect forms. We do not use advertising cookies.

3. Who we share it with

These are our sub-processors. We share the minimum each one needs:

Recipient	What it receives
Anthropic (Claude), or Google (Gemini) where that key is configured instead	The text sent for AI screening: résumé text, the job description, free-text answers and video transcripts. Sent per request over their API; we do not send files, and we rely on their API terms, under which API inputs are not used to train their models. We do not control their practices beyond those terms.
Resend	Recipient email address and the content of transactional email (invitations, interview invites, notifications).
Razorpay and Stripe	Billing contact, amount, invoice reference. They collect payment details directly from you.
WhatsApp Business Cloud (Meta)	Phone number and message content, only where the company enabled WhatsApp notifications.
Sentry	Error traces, which can contain request metadata and the signed-in user’s id. Off entirely unless a DSN is configured.
PostHog	Product analytics events for signed-in workspace users only. It is deliberately never loaded on candidate-facing pages — careers pages, assessments, offer signing, video screens or BGV consent.
Object storage (Amazon S3 or Cloudflare R2)	Uploaded résumés, video recordings, offer letters and invoice PDFs.
Background verification provider	The candidate identifiers needed for the checks in the ordered package, after consent.
Job boards and calendar providers	Job postings you choose to distribute; interview events on a calendar you connected.

We do not sell personal data and we do not share it for advertising. We disclose data to a government agency only where a law requires it.

4. Transfers outside India

Some of these processors — the model provider, the email provider, Sentry, Stripe — operate outside India, so data described above may be processed abroad. The application database and uploaded files are hosted in the region the deployment is configured for.

5. How long we keep it

Workspace and candidate records — for as long as the workspace is active, because a hiring history is the point of the product. When a workspace is closed we delete or return its data on request.
Candidate accounts — until the candidate asks us to delete them.
Invoices, GST records and payment references — retained for the period Indian tax and company law requires, even after an account closes.
Error traces and technical logs — short-lived, per the retention of the logging and error tools.

We are being straight with you: there is no automated purge job today. Deletion happens when it is requested, by hand.

6. Your rights under the DPDP Act

You may ask us to:

Access — a summary of the personal data we process about you and who it has been shared with;
Correct or complete — fix data that is wrong, incomplete or out of date;
Erase — delete data we no longer need for the purpose it was collected for, or where you withdraw consent (subject to the retention we are legally required to keep);
Withdraw consent — as easily as it was given; this does not undo processing already carried out;
Nominate — name someone to exercise these rights if you die or become incapacitated;
Complain — to our Grievance Officer, and after that to the Data Protection Board of India.

How to make a request: email support@interviewportal.in from the address on your account. There is no self-service export or delete button in the product yet — we are not claiming one exists. Requests are handled manually and we aim to respond within 30 days. If your data sits in a company’s workspace, we will route the request to that company, since they decide what happens to it.

7. Grievance Officer

Named Grievance Officer — to be filled in
Contact in the meantime: grievance@interviewportal.in

8. Children

The Service is for working adults. We do not knowingly process the data of anyone under 18. If you believe a child’s data is here, write to us and we will delete it.

9. Security

Traffic is served over HTTPS, passwords are stored as salted hashes, every query is scoped to the workspace it belongs to, and candidate-facing links (offers, booking pages, BGV consent, client portals) are unguessable signed tokens that expire. No system is perfectly secure; if a breach affects your data we will notify you and the Data Protection Board as the law requires.

10. Changes

We will update this notice as the product changes. The version and date at the top show the current text, and we record which version each user accepted at signup.