Privacy Policy

1. Introduction

RecruitAlpa(“we,” “us,” or “our”) is a Recruitment CRM and Applicant Tracking System (ATS) platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our platform.

We are committed to protecting your privacy in compliance with the Indian Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable global privacy standards.

2. Our Role: Processor vs Controller

For candidate and applicant data— our customers (recruitment agencies, HR teams, and employers) act as Data Controllers. They decide what candidate data to collect, how to use it, and why. RecruitAlpa acts as a Data Processor, processing data solely on our customers' instructions.

For account and website data — RecruitAlpa acts as the Data Controller for information we collect directly from you (name, email, billing details, usage data).

3. Information We Collect

3.1 Account & Billing Information

• Name, email address, phone number
• Company name, company size, industry
• Billing address and payment information (processed via Razorpay; we do not store full card details)
• Account login credentials (password hashed; Google OAuth handled by Google)

3.2 Usage & Analytics Data

• IP address, browser type, operating system
• Pages viewed, features used, session duration
• Dashboard interactions, pipeline movements, search queries
• API request logs and error reports

3.3 Candidate Data (Processed on Behalf of Customers)

• Resumes/CVs and supporting documents
• Name, email, phone number, address
• Work experience, education, skills, certifications
• Application history, interview notes, pipeline stage changes
• Communication records (emails, messages sent through the platform)

3.4 Communication Data

• Email templates and correspondence sent through the platform
• Team comments and activity logs
• Notification preferences

4. How We Use Your Information

• Provide, maintain, and improve the Recruitment CRM / ATS platform
• Process transactions and manage subscriptions
• Send service-related communications (invoices, security alerts, updates)
• Respond to support requests and troubleshoot issues
• Analyze usage patterns to improve user experience and product features
• Comply with legal obligations and enforce our Terms of Service

We will never sell your personal data or candidate data to third parties.

5. Legal Basis for Processing (DPDP Act 2023)

Under the Digital Personal Data Protection Act, 2023, we process your personal data on the following bases:

• Consent — when you sign up, use Google OAuth, or agree to cookies
• Contractual necessity — to provide the platform and billing services you request
• Legal obligation — to comply with Indian laws and regulatory requirements
• Legitimate interest — to improve our platform, ensure security, and prevent fraud

6. Cookies & Tracking

We use cookies and similar technologies to operate, secure, and improve our platform. You can manage cookie preferences in your browser settings.

Third-party cookies may be set by Google OAuth (login), analytics providers, and payment processors. These are governed by their respective privacy policies.

7. Data Sharing & Third Parties

We share your data only with trusted service providers who help us operate the platform:

• Supabase— database hosting, authentication, and backend infrastructure (US/region of your choice)
• Razorpay— payment processing (we never store full card numbers)
• Google OAuth— optional social login (data shared with Google per their privacy policy)
• Email service provider(Zoho / SendGrid / Resend) — transactional emails, notifications, and email templates
• Analytics providers— aggregated usage data for product improvement

All third parties are contractually bound to process data only for the purposes we specify and to maintain adequate security measures. We do not sell your data to any third party.

8. Data Storage & Security

Data is stored on Supabase infrastructure with encryption at rest and in transit (TLS 1.2+). We implement industry-standard security measures including:

• Encrypted database connections and storage
• Row-level security policies ensuring data isolation between customers
• Role-based access control (admin, recruiter, viewer)
• Regular security audits and vulnerability assessments
• Secure session management via HTTP-only cookies

9. Data Retention & Deletion

We retain your account data for as long as your account is active. Upon account termination:

• Candidate and operational data is deleted within 14 days
• Backup copies are purged within 30 days
• Financial records may be retained longer to comply with Indian tax and legal obligations

Customers can export their data at any time from the platform settings. To request deletion, contact us at the email below.

10. Your Rights (DPDP Act 2023)

Under the Digital Personal Data Protection Act, 2023, you have the following rights:

• Right to know — what data we collect and why
• Right to access — request a copy of your personal data
• Right to correction — update inaccurate or incomplete data
• Right to deletion — request erasure of your data (subject to legal holds)
• Right to portability — receive your data in a machine-readable format
• Right to grievance redressal — lodge a complaint with us or the Data Protection Board of India

To exercise these rights, email us at privacy@recruitalpa.com. We will respond within 30 days as required by the DPDP Act.

11. Candidate Data & Data Subject Requests

If you are a candidate whose data has been submitted to RecruitAlpa by one of our customers (a recruitment agency or employer), please note:

• We process your data on behalf of our customer (the Data Controller)
• For access, correction, or deletion requests, please contact the organisation that submitted your data
• We will assist our customers in fulfilling your request within the legally required timeframe

12. Children's Privacy

Our platform is not directed at individuals under 18. We do not knowingly collect data from minors. If we become aware that a minor's data has been submitted, we will delete it promptly.

13. International Data Transfers

Your data may be processed in India and other countries where our infrastructure providers operate. When transferring data across borders, we ensure adequate safeguards are in place, including standard contractual clauses and compliance with applicable data protection laws.

14. Grievance Officer (DPDP Act 2023)

In compliance with the Digital Personal Data Protection Act, 2023, we have appointed a Grievance Officer to address concerns regarding your personal data:

Grievance Officer
RecruitAlpa
Email: "grievance@recruitalpa.com"
We will acknowledge your complaint within 24 hours and resolve it within 30 days.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or an in-app notice. Your continued use of the platform after changes constitutes acceptance of the updated policy.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy, please contact us:

RecruitAlpa
Email: "support@recruitalpa.com"