Privacy Policy

2. Privacy-Specific Definitions

For the purposes of this Privacy Policy:

a) "Data Subject" means the individual to whom Personal Data relates and includes a "Data Principal" where that expression is used under applicable Indian law.

b) "Personal Data" means any information relating to an identified or identifiable individual, including digital personal data to which the Digital Personal Data Protection Act, 2023 applies.

c) "Process", "Processed" or "Processing" means any operation performed on Personal Data, including obtaining, collecting, recording, organising, enriching, analysing, generating, using, sharing, retaining, correcting, de-identifying or deleting it.

d) "Controller" includes a data fiduciary under applicable Indian law and means a person that determines the purposes and means of Processing Personal Data.

e) "Processor" means a person that processes Personal Data for or on behalf of a Controller and on its instructions.

A reference to Sensitive Personal Data includes sensitive personal data or information under the Information Technology Act, 2000 and the rules made under it, as well as special-category, biometric or other sensitive information protected under any other applicable law.

3. Who Is Responsible for Personal Data

The allocation of responsibility described in section 11 of Part A applies to this Privacy Policy. In summary, the Company generally acts as an independent Controller when it builds and maintains the Candidate database, obtains or enriches professional information, operates and secures the Platform, administers accounts, manages outreach preferences and complies with law.

A Client generally acts as an independent Controller when it determines a role, selection criteria, Candidate communications, review process and employment outcome. The Company may act as a Processor where it handles Client Data solely on the Client's documented instructions and the parties are bound by appropriate written data processing terms where required by applicable law.

Where the Company discloses Candidate database or profile data for purposes it independently determines, the Company and Client each act as an independent data fiduciary or Controller for their own processing and must independently satisfy applicable notice, lawful basis, purpose limitation, security, retention and Candidate-rights obligations.

4. Personal Data Processed

The categories of Personal Data processed will depend on the relevant individual, feature and stage of the recruitment process. They may include:

Identity and contact data: Name, email address, telephone number, location, professional network handle, profile URL and related identifiers.

Professional and educational data: Employment history, employers, roles, seniority, education, qualifications, skills, projects, portfolios, publications, code contributions, professional achievements, availability, role preferences and compensation expectations.

Source and verification data: Source URLs, public professional or business information, company information, regulatory filings, news, publications and indicators concerning recency, confidence or consistency.

Recruitment and communication data: Roles presented, responses, screening answers, status, recruiter notes, messages, scheduling information, call and chat logs, and interview or assessment responses.

AI Outputs: Matches, rankings, summaries, transcripts, scores, recommendation labels, inferred skills, job-fit indicators and flags for human review.

Audio and video data: Call audio, interview video where enabled, voice recordings, transcripts and related technical metadata. The Company does not create biometric templates unless the relevant feature is lawfully enabled and specifically disclosed.

Account, billing and support data: Business contact details, authentication records, plan and credit usage, invoices, payments and support correspondence.

Device, usage and security data: IP address, browser and device information, timestamps, pages, searches, clicks, cookie identifiers, logs, security events and approximate location derived from IP.

Rights and complaint data: Identity-verification information, request or complaint details, correspondence and records of the action taken.

The Platform is not intended to collect or process Sensitive Personal Data by default, including health or disability information, biometric identifiers, government identifiers, caste, religion, political opinions, trade union membership or similar protected information. Such data may be processed only where specifically enabled through an approved workflow, necessary and proportionate for the stated purpose, restricted to authorised personnel, legally permitted and subject to any additional notices, consents, access restrictions and safeguards required by applicable law. Data Subjects should not provide passwords, payment-account credentials or other Sensitive Personal Data unless specifically requested through such a workflow.

When you connect your Gmail account, FlashFox sends outreach emails to candidates on your behalf. We do not read, store, or access your existing emails or any email content. When you connect Google Sheets, FlashFox creates new spreadsheets in your Google Drive and writes candidate search results to them. We do not access, read, modify, or delete your existing files. Google user data accessed through these integrations is used solely to perform the action you initiate and is not shared with third parties, not used for advertising, and not retained on our servers beyond what is necessary to complete the action.

Google API Services User Data Policy: Flashfox's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data accessed through Gmail, Google Sheets, or Google Calendar integrations is used solely to perform the specific action initiated by the logged-in user. This data is not used to develop, improve, or train generalised AI or machine learning models, not used for advertising, not shared with third parties for their independent use, and not used for any purpose other than providing the integration feature requested by the user.

The use of raw or derived user data received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not used to train, improve, or develop AI or machine learning models.

5. Sources of Personal Data

The Company may obtain Personal Data directly from a Data Subject when that person creates or updates a profile, responds to outreach, communicates with the Company, uses the Platform or participates in a recruitment interaction.

The Company may also obtain Personal Data from Clients and recruiters; the Company, its affiliates and related Candidate databases or services; colleges or other authorised organisations; contracted data partners; publicly accessible professional and business sources; providers supporting communications, voice, AI, hosting, security, analytics, support and payments; and the Data Subject's device or browser.

Public sources may include professional networks, code repositories, portfolios, publications, company and investor websites, research papers, news reports, regulatory filings and public professional videos. The Company will assess, as appropriate, the provenance, permitted use, transparency, opt-out practices, contractual protections, security, accuracy, correction and deletion procedures, and applicable notice, consent or other lawful-use requirements associated with an indirect source.

The Company will maintain an internal source and lawful-basis mapping for Candidate Personal Data obtained directly or indirectly. The mapping will distinguish data (a) provided directly by the Candidate; (b) provided by a Client; (c) made publicly available by the Candidate; (d) made publicly available by another person under a legal obligation to do so; (e) obtained from contracted data partners or authorised organisations, including affiliates, related Candidate databases or colleges; and (f) inferred or generated by the Platform. It will record the applicable purpose, source restrictions and any notice, consent or other lawful-use requirement. Public accessibility alone does not authorise unrestricted scraping, enrichment, scoring, disclosure or reuse.

6. Purposes of Processing

The Company may process Personal Data for the following connected purposes:

a) Provide the Services: Create and display professional profiles; enable search, matching and review; schedule or conduct screening; and manage recruitment workflows.

b) Contact Candidates: Present potentially relevant roles, identify the hiring context, obtain responses, schedule interactions and respect communication preferences.

c) Verify and enrich profiles: Compare professional information with appropriate sources, add source references, identify potentially outdated information and generate summaries or inferred skills.

d) Operate AI-assisted features: Generate searches, matches, rankings, transcripts, summaries, scores, recommendation labels, outreach drafts and job descriptions for human review.

e) Conduct recruitment interactions: Facilitate, record, transcribe, summarise and score calls, chats, interviews or assessments after giving the required notice and obtaining any required permission.

f) Administer the Platform: Authenticate accounts, allocate and measure credits, process payments, provide support and enforce the applicable plan and Terms.

g) Secure and improve the Services: Detect abuse, troubleshoot, audit access, measure performance, evaluate data quality and potential bias, and improve security, usability and reliability. Google user data obtained through Gmail, Google Sheets or Google Calendar integrations is not used for this purpose and is excluded from any product improvement or analytics activity.

h) Comply with law and protect rights: Respond to requests and complaints, maintain suppression records, establish or defend legal claims, comply with lawful requests and protect individuals, rights and systems.

The Company will not use Personal Data for a materially incompatible purpose without providing any further notice and obtaining any consent or other legal permission required under applicable law. It will not use Personal Data to train, fine-tune or improve a third-party foundation model, or to train a Company model in identifiable form, unless that use is disclosed, legally permitted and, where required, consented to. Aggregated, anonymised or de-identified data may be used for analytics, quality testing, bias testing, security, product improvement and reliability only where it cannot reasonably identify a Candidate, Client or other individual.

7. Legal Grounds and Permissions

The Company processes Personal Data only where permitted under the law applicable to the relevant activity. Where Indian law applies, the Company will rely on consent, a certain legitimate use expressly recognised under the Digital Personal Data Protection Act, 2023 and applicable rules, or another basis expressly permitted by applicable Indian law. References to 'legitimate interests' apply only where that ground is recognised under relevant non-Indian law, such as GDPR-style laws, and do not constitute a general basis under Indian law. Other grounds, including steps taken at the Data Subject's request, contract or legal obligation, will be relied upon only where recognised by the applicable law.

Where consent is the applicable ground, it must be capable of being withdrawn for future processing. Acknowledging the Terms or this Privacy Policy does not by itself amount to consent to an optional recording, AI analysis or unrelated communication. Any separate consent required for such an activity will be requested through an appropriate affirmative action.

Where Personal Data is obtained indirectly and applicable law requires additional transparency, the Company will provide the required information within the prescribed period, ordinarily when it first communicates with the Data Subject or before the first disclosure, unless a lawful exception applies.

8. AI, Profiling and Human Review

The Platform may use automated methods to search, match, rank and summarise professional profiles and to analyse recruitment interactions. Relevant inputs may include role requirements, professional history, skills, responses, transcripts and assessment results, and AI Outputs may influence the order in which Candidates are presented or indicate a suggested degree of fit.

AI Outputs are intended to assist, rather than replace, professional judgement. The Platform is not intended to make a final decision to shortlist, select, offer, hire, dismiss or reject a Candidate. The relevant Client must provide meaningful human involvement as required by the Terms and applicable law.

A Data Subject may request correction or deletion of inaccurate Personal Data and may raise a concern about an AI Output with the Company or the relevant Client. The responsible Controller will, as appropriate, correct, suppress or flag disputed data pending resolution. Where applicable law grants a right not to be subject to a solely automated decision producing legal or similarly significant effects, the responsible Controller will provide the required human review and an opportunity to contest the outcome.

9. Calls, Interviews, Assessments and Recordings

Before a recorded or AI-analysed interaction begins, the Company or the relevant Client will provide a notice through the Platform, Candidate outreach flow or applicable call, interview or assessment flow. The notice will explain the identity of the relevant Client, the role of AI, whether audio or video will be recorded, the outputs generated, the persons receiving them, the applicable retention information and any alternative process available.

Where consent or another specific permission is required, the recording or analysis will not begin until that requirement has been met. The Company does not use facial recognition, emotion recognition, voiceprints or other biometric identification or categorisation features except in the limited circumstances permitted by the Terms.

10. Disclosure of Personal Data

The Company may disclose Personal Data, to the extent reasonably necessary for the purposes described above, to:

a) the relevant Client and its authorised recruiters or personnel reviewing or engaging a Candidate for a role;

b) providers of cloud hosting, databases, communications, AI, voice, transcription, analytics, security, support, payment and professional services that process Personal Data under appropriate contractual restrictions;

c) the Company's affiliates, investors, professional advisers or a successor involved in a financing, merger, restructuring, sale or transfer, subject to appropriate confidentiality and legal safeguards;

d) courts, regulators, law-enforcement bodies or other persons where disclosure is required by law or reasonably necessary to protect rights, safety or the integrity of the Services; and

e) another person where the Data Subject authorises or directs the disclosure.

Making a Candidate profile or contact detail available to an authorised Client for a disclosed recruitment purpose forms part of the Services. It does not authorise the Client or any service provider to resell the information or use it for advertising or another unrelated purpose.

11. International Processing

The core Platform is intended to be hosted in India. Personal Data may nevertheless be accessed by a Client or authorised provider in another country, obtained from a source outside India or processed through a global service. Such remote access or provider processing may constitute an international transfer even where the primary database remains in India.

Where required, the Company will use appropriate contractual, organisational and technical safeguards, which may include data-processing terms, approved contractual clauses, transfer assessments, access restrictions and encryption. The Company will also comply with any transfer restriction notified under Indian law and with applicable requirements in the jurisdiction from or to which Personal Data is transferred.

12. Retention and Deletion

The Company retains Personal Data only for as long as reasonably necessary for the purpose for which it was obtained, including to provide the Services, support an active recruitment process, maintain an accurate professional profile, meet legal or contractual obligations, resolve disputes, maintain security and honour communication preferences.

When determining the appropriate period, the Company considers the nature and sensitivity of the Personal Data; the date of the most recent verification, interaction or Client activity; the duration of the relevant recruitment process or account; the risk of harm from continued retention; applicable limitation, tax, employment and record-keeping periods; the need to preserve evidence of consent, requests or security events; and whether the purpose can be achieved through deletion or de-identification.

Recordings and related AI Outputs will be retained for the period communicated in the notice presented before the relevant interaction. A minimal suppression record may be retained after an opt-out so that the preference can continue to be honoured. Information may also remain temporarily in secure backups or be preserved for a legal claim, investigation or other lawful requirement, after which it will be deleted or de-identified in accordance with the Company's procedures.

13. Rights and Communication Choices

Depending on applicable law, a Data Subject may have the right to obtain information about processing and a summary or copy of Personal Data; correct, complete or update inaccurate information; request deletion; withdraw consent for future processing; object to or restrict certain processing; receive portable data; request human review of an automated significant decision; nominate another person to exercise rights where Indian law permits; and complain to the Company's Grievance Officer or a competent regulator.

Recruitment outreach will provide an opt-out method appropriate to the relevant channel. After receiving an effective opt-out, the Company will stop non-required outreach covered by that request and may maintain a minimal suppression record to prevent recontact.

Requests may be submitted to the privacy or grievance contact identified in section 18 below. The Company may request information reasonably necessary to verify identity, locate the relevant Personal Data and confirm the authority of a person acting for a Data Subject. Requests will be handled within the period required by applicable law, subject to lawful exceptions.

14. Cookies and Similar Technologies

The Platform may use cookies and similar technologies that are necessary for authentication, security, session management and preferences. Where enabled and lawfully permitted, analytics technologies may also be used to understand use of the Platform and improve the Services.

The cookie notice made available through the Platform will identify the relevant categories, providers, purposes and durations and will explain how non-essential technologies may be managed.

15. Security and Personal Data Breaches

The Company will maintain reasonable and appropriate administrative, technical and organisational safeguards having regard to the nature of the Services and the Personal Data processed. These safeguards will include, as applicable, access controls and authentication; encryption in transit and at rest or equivalent protection; logging and monitoring; backups; incident response procedures; provider due diligence and controls; restrictions based on a need to know; and contractual safeguards with processors and service providers.

The Company will maintain incident-response and escalation procedures to identify, assess, contain, remediate, document and respond to suspected Personal Data breaches. Where required by applicable law, the Company will notify affected Data Subjects, affected Clients and competent authorities, including the Data Protection Board of India and affected Data Principals, without delay and within the applicable statutory timelines. Where a cyber incident is reportable to CERT-In or another competent authority, the Company will comply within the applicable statutory timeline, including, where applicable, the six-hour reporting period under applicable CERT-In directions. No transmission or storage method is completely secure, and the Company cannot guarantee that an incident will never occur.

16. Children

The Platform is intended for adult recruitment workflows. The Company does not intentionally source, profile, contact or assess persons under 18 through the Services. If the Company becomes aware that a person is under 18, it will take appropriate steps to delete, suppress or otherwise handle the Personal Data in accordance with applicable law.

If the Services are used for campus, internship, fresher or early-career hiring where persons under 18 may reasonably be involved, the relevant workflow must include appropriate age checks and obtain verifiable parental consent and any other consent required by applicable law before processing, unless a lawful exception applies.

17. Changes to This Privacy Policy

The Company may update this Privacy Policy to reflect changes in the Services, processing practices or applicable law. The revised version will be posted with an updated "Last updated" date, and an additional notice will be provided where a change materially affects the rights of Data Subjects or the manner in which Personal Data is used.

Where a proposed change requires fresh consent or another affirmative action under applicable law, the Company will obtain it before carrying out the relevant processing.

18. Contact and Complaints

Company: Veerwal GetWork Services Private Limited

Registered office: 545, 2nd Floor, S Lal Tower, Udyog Vihar Phase 1, Sector 20, Gurugram, Haryana 122001

Privacy / grievance: privacy@Flashfox.ai

Security contact: privacy@Flashfox.ai

A Data Subject may also complain to the Data Protection Board of India when the relevant complaint mechanism applies, or to another competent supervisory or regulatory authority in the jurisdiction applicable to the processing.