Privacy Policy

HireRoom is operated by Trenith Technologies Private Limited, a company incorporated under the Companies Act, 2013 of India (“HireRoom”, “we”, “us”). We are the Data Fiduciary(India’s Digital Personal Data Protection Act, 2023) and the data controller (GDPR) for the personal data described here. Contact: privacy@hireroom.tech.

This Policy covers the HireRoom web application at hireroom.tech, the HireRoom browser extension, our marketing pages, transactional emails, and the installable mobile (PWA) app. It does not cover third-party websites you reach through links or the job-application pages you visit on employer/ATS sites — those are governed by their own policies.

We collect only what the product needs to work:

• Identifiers — name, email, account ID (via Clerk).
• Profile & career records— work history, education, skills, projects, certifications, and the “proof bank” evidence you add.
• Documents — resumes and cover letters you upload or generate.
• Application activity — jobs you save, statuses, notes, interview rounds, offers, and outcomes.
• Connected inbox data — if you connect Gmail or Outlook, message metadata and the classification of recruiting-related messages (we do not store full message bodies).
• Immigration / work-authorization status — e.g. OPT/STEM-OPT/H-1B, if you choose to provide it, to power visa timelines. Treated as sensitive (see below).
• Billing data — plan, transaction and subscription identifiers. Card data is handled by our payment processors and never touches HireRoom servers.
• Usage & device data — pages viewed, feature usage, AI-generation counts, IP-derived country, and diagnostic/error events.

• Directly from you — everything you type, upload, or clip with the extension.
• Generated for you — tailored resumes, cover letters, and analyses produced from your own verified profile.
• From services you connect — Gmail/Outlook (only after you authorize OAuth), limited to recruiting-related message metadata.
• Automatically — usage, device, and diagnostic data as you use the product.

We process your data to provide, secure, and improve HireRoom. Lawful bases (GDPR Art. 6 / DPDP consent & legitimate uses):

• Deliver the service — store your profile, generate documents, track applications (performance of contract / consent).
• AI features — send the relevant profile slice and job text to our AI processors at request time to tailor documents and analyses (consent; you can decline individual generations).
• Communications — transactional email and, if you opt in, product updates.
• Billing & fraud prevention — process payments and prevent abuse (contract / legitimate interests / legal obligation).
• Security & diagnostics — detect errors and abuse (legitimate interests).
• Product analytics — aggregate usage to improve the product (legitimate interests; no selling of personal data).

• Account & profile data — while your account is active, then deleted within 30 days of account deletion (a short grace window allows recovery).
• Security / audit logs — up to 12 months, then deleted or de-identified.
• Billing records — retained as required by applicable tax and accounting law.
• Connected-inbox classifications — deleted when you disconnect the inbox.

The processors below are wired into HireRoom in this release. New processors appear here only when the code that uses them ships. We require each to protect your data under a data-processing agreement.

HireRoom is hosted on infrastructure in the United States (Vercel and Turso US regions). If you use HireRoom from India, the EU/UK, or elsewhere, your data is transferred to and processed in the US and other countries where our sub-processors operate. Where Astra (currently “Coming soon”) is enabled, its discovery agents may use DeepSeek, whose processing occurs in China; that cross-border transfer is disclosed here and gated by consent and an environment flag. We rely on appropriate safeguards for such transfers (e.g. Standard Contractual Clauses for GDPR, and permitted transfers under the DPDP Act).

Resumes and profiles can reveal sensitive information — for example immigration/work-authorization status, or details that could infer health, religion, or other protected characteristics from an employer name or accommodation history. We commit to: (a) collecting immigration status only when you choose to provide it, and only to power visa timelines; (b) not deriving ranking or targeting features from inferred sensitive characteristics; and (c) letting you redact or remove any field at any time. EEO responses are never persisted (see the EEO notice).

As a Data Principal under India’s Digital Personal Data Protection Act, 2023 and its Rules, you have the right to:

• Access a summary of the personal data we process and the processing activities.
• Correct, complete, update, and erase your personal data.
• Withdraw consent at any time (as easily as you gave it) via the consent dashboard; withdrawal does not affect prior lawful processing.
• Nominate another individual to exercise your rights in the event of death or incapacity.
• Grievance redressal — raise concerns with our Grievance Officer (below) before approaching the Data Protection Board of India.

We process personal data on your consent or other legitimate uses permitted by the Act, and we give notice of the personal data and purposes at or before collection.

If you are in the EU/UK, you have the rights of access, rectification, erasure, restriction, portability, and objection, and the right not to be subject to solely automated decisions with legal or similarly significant effect. HireRoom does not make such automated decisions about you. You may lodge a complaint with your supervisory authority.

• Right to know what personal information we collect, use, and disclose.
• Right to delete and to correct your personal information.
• Right to limit the use of sensitive personal information.
• Right to opt out of any “sale” or “sharing”.
• Right to non-discrimination for exercising these rights.

Texas residents have rights under the Texas Data Privacy and Security Act to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of the sale of personal data and of targeted advertising. HireRoom does not engage in targeted advertising.

HireRoom does not sell your personal data for money. A future opt-in Talent Marketplace would let you choose to share a profile with paying recruiters; it is off by default, unbundled from other consents, and reversible at any time via the consent dashboard, the Do-Not-Sell page, or a Global Privacy Control signal. Until you opt in, nothing about you is shared with recruiters.

HireRoom honors browser-sent Global Privacy Control signals as an opt-out of any sale or sharing. The signal is detected via the Sec-GPC header and applied for the browsing session, and persistently for signed-in users.

We use encryption in transit, scoped access controls, tenant isolation, signed webhooks, and server-side request validation. AI calls send only the relevant profile slice plus the job text to the processor at request time; our default AI routing is zero-retention. No system is perfectly secure, but we design to limit exposure and we investigate incidents promptly.

HireRoom is not directed to children. We do not knowingly collect data from anyone under 18. If we learn we have collected a child’s data without verifiable parental consent (as required by the DPDP Act and applicable law), we delete it.

We may update this Policy. For material changes we will notify you by email and an in-app notice before they take effect. The “Effective” date above reflects the current version.

To exercise any right, use the in-app consent dashboard or email privacy@hireroom.tech. We verify your identity before acting and respond within the timelines required by applicable law. For grievances under India’s DPDP Act, contact our Grievance Officer at grievance@hireroom.tech.