privacy notice

oorik recruit, at recruit.oorik.in, is run by oorik ("we", "us"). For the personal data described here we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (the DPDP Act). You can reach us about anything in this notice at hello@oorik.in.

A company that receives a candidate's contact details through oorik recruit decides for itself how it uses them for its hiring, and is responsible for that use under the DPDP Act. Our terms bind companies to use them only for the role the candidate applied to.

From candidates:

• Your account: your email address, verified with a one-time code or by Google sign-in if you choose it.
• The resume you upload (PDF or DOCX) and the profile built from it: name, phone, location, headline, links, work history, education, skills, languages and a short brief. You can edit every field.
• Your consent record: the notice version you agreed to, the purposes you agreed to, the time and the IP address.
• Your applications: which jobs you applied to, the stage each one is at, and the match score for each.

From people who hire:

• Your account: your work email address and name.
• Your company details: name, website, size, billing country, your role and, in India, your GSTIN if you add it.
• The jobs you post and what you do in each pipeline, such as moving candidates between rounds. Moving a candidate into the last round and downloading a resume are recorded in an audit log.
• Payment records: amount, receipt number and the Razorpay payment reference. Card and bank details are entered with Razorpay and never reach us.

From everyone: the cookies needed to keep you signed in, and your IP address and request logs, which we use for security and rate limits. We do not use advertising or analytics cookies.

Candidates give itemised consent when they confirm their profile. Each purpose is separate, and you can withdraw any of them later:

• To store and process your profile so your account works.
• To show your profile to the companies whose jobs you apply to.
• To keep you in the talent pool and email you about roles that may fit.

For company accounts we use personal data to provide the hiring service you sign up for, to bill you and to keep the records Indian tax law requires. For everyone, we also use it to keep the service secure, to prevent abuse and to answer your messages.

A company sees a candidate only after that candidate applies to one of its jobs. From the first round it sees:

• Full name, headline, location and years of experience.
• Work history and education, including company and college names.
• Skills, the match score, and the brief and highlights with any email address or phone number removed.
• GitHub, LinkedIn, portfolio and other links, unless the candidate chooses to hide them.

The email address, phone number and resume file stay hidden until the company moves the candidate into the last interview round of that job, or marks them hired. A candidate can choose, in their profile, to share any of these sooner, or to hide their links until the last round. The choice applies to all of their applications and can be changed at any time; turning a setting off hides that detail again before the last round.

We email the candidate each time a company moves their application, including when it reaches the last round and the company can see their contact details. A candidate's profile is never shown to a company the candidate did not apply to.

For each application we compute a score from 0 to 100 that compares the text of the profile with the job: the headline, brief, work history, skills, education and city on one side, and the job title, location and required skills on the other. Names, contact details and links are not part of it. The score is frozen when you apply, so later edits to your profile do not change an application you already sent.

Scores help a company sort applicants. People at the company make every decision about who moves forward, and you can see and correct the profile a score is based on at any time before you apply.

These service providers process personal data on our behalf, only to run oorik recruit:

Our database runs in Railway's Singapore region and files are stored with Cloudflare. Processing outside India is permitted under section 16 of the DPDP Act, and we will stop any transfer to a country the Government of India restricts.

Under the DPDP Act you can:

• Get a summary of the personal data we hold about you and how we process it.
• Correct, complete or update it. Candidates can edit their profile directly.
• Have it erased. Candidates can delete their account from the profile page, which removes the profile, resume and consent records and anonymises applications.
• Withdraw consent for any purpose as easily as you gave it, from your profile or by writing to us. Withdrawing does not affect processing that happened before.
• Nominate another person to exercise these rights if you die or are unable to.
• Raise a grievance with us, and if you are not satisfied with our answer, complain to the Data Protection Board of India.

To use any of these rights, write to hello@oorik.in from the email address on your account, so we can confirm the request is yours.

oorik recruit is for people aged 18 and over. Candidates confirm their age when they confirm their profile. We do not knowingly collect personal data from children, and we delete it if we learn that we have.

Traffic is encrypted in transit. The database is reachable only over Railway's private network, files sit in a private bucket, and a resume download is a signed link that expires after two minutes. Unlocking contact details and downloading resumes are logged. If a personal data breach affects you, we will tell you and the Data Protection Board as the DPDP Act requires.

Our grievance contact is hello@oorik.in. Tell us what happened and which account it concerns, and we will reply to you at that address.

See also the terms of use.

When we change this notice we update the date at the top. If a change affects how we use data you have already given us, we email you and, where the law needs it, ask for your consent again before the change applies to you.