Back to CalHire

Privacy Policy

Last updated: July 2025

1. Who We Are

CalHire (“we”, “us”) is an AI-powered hiring platform operated by Grewray Solutions, a company registered in India. This policy explains how we handle data when you use our services.

2. What We Collect

  • Account data: Email address (for OTP authentication only).
  • Company data: Company name, logo, job postings provided by employers.
  • Application data: Resumes, test answers, and interview responses submitted by candidates.
  • Usage data: Timestamps, anonymized event counts, and error correlation IDs. No IP addresses or device fingerprints are stored.

3. How We Use Data

  • Authenticate you via passwordless OTP.
  • Process job applications, score tests, and generate AI-powered scorecards.
  • Send transactional emails (OTPs, test invitations, offer letters).
  • Improve platform reliability via anonymous error logs.

4. AI Processing

We use AI models (Claude, GPT-4o, Gemini) to score resumes, generate job descriptions, and assess interviews. Zero PII is sent to any AI model. All data is anonymized before processing — no names, emails, or identifying information leaves our servers for AI inference.

5. Data Storage & Security

  • Data is stored in Supabase PostgreSQL (encrypted at rest) and Azure Blob Storage (encrypted at rest).
  • Authentication uses RS256 JWT tokens with zero PII in claims.
  • All connections use TLS 1.2+.
  • Rate limiting protects all endpoints. IP bans apply to repeated auth failures.

6. Data Sharing

We do not sell your data. We share data only with:

  • Cloud infrastructure providers (Azure, Supabase) as data processors.
  • AI model providers (Anthropic, OpenAI, Google) — anonymized data only.
  • Payment processors (Paddle, Razorpay) for subscription billing.

7. Cross-Border Data Transfers

Your data may be processed in regions outside India, including the United States and European Union, where our cloud infrastructure providers operate. All transfers are governed by appropriate data-processing agreements with these providers and comply with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 (DPDP Act).

8. Your Rights (DPDP Act 2023 & GDPR)

Under the Digital Personal Data Protection Act, 2023 and applicable international regulations, you have the right to:

  • Access: Request a summary of your personal data held by us at any time.
  • Correction: Request correction of inaccurate or incomplete personal data.
  • Erasure: Deactivate your account — permanent deletion within 30 days.
  • Portability: Contact us for a full data export in a machine-readable format.
  • Grievance redressal: Contact our Grievance Officer (details in Section 13) for any data-protection concerns.
  • Nomination: Nominate a person to exercise your rights in case of your death or incapacity, as provided under the DPDP Act.

If you are located in the EU/EEA, your rights under the General Data Protection Regulation (GDPR) also apply.

9. Cookies

We use only essential cookies for authentication (session tokens). No advertising or analytics cookies are used. No third-party tracking scripts are loaded. For further details, see our Cookie Policy.

10. Data Retention

  • Active accounts: data retained while account is active.
  • Deleted accounts: PII cleared immediately, hard delete after 30 days.
  • Application data: retained for 12 months after job closure, then anonymized.

11. Children

CalHire is not intended for users under 18. We do not knowingly collect data from minors. If we become aware that a minor has provided personal data, we will delete it promptly.

12. Changes

We may update this policy. Material changes will be communicated via the platform and, where required by law, with prior notice.

13. Grievance Officer & Contact

In accordance with the Information Technology Act, 2000 and the DPDP Act, 2023, the name and contact details of the Grievance Officer are:

We aim to resolve all grievances within 30 days of receipt.