HireZeta

Last updated 18 September 2026

Privacy Policy

This policy explains what HireZeta collects, why, and the choices you have. It is written for the people who use HireZeta at work and for the candidates whose information our customers store in it.

1. Who we are

HireZeta is operated by Nishtya Infotech Private Limited, 379, Vardhman Grand Plaza, Plot No. 7, Manglam Place, Sector-3, Rohini, New Delhi, Delhi 110085, India. For anything about privacy, write to privacy@hirezeta.io.

2. Two roles: controller and processor

For the accounts of people who sign in (recruiters, admins, owners), HireZeta is the data fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP) and the controller under the GDPR where it applies.

For candidate data that a customer uploads, imports or receives into their workspace, the customer is the data fiduciary and HireZeta is a data processor: we process that data only on the customer's instructions and under our Terms of Service.

3. What we collect

Account data

  • Name, work email, password (hashed with Argon2id), optional Google sign-in identity, organisation name and role.
  • Sign-in metadata: IP address, browser, timestamps, kept for security and audit.

Candidate data (processed for customers)

  • Whatever a customer adds: name, contact details, resume files, work history, education, skills, compensation, notes, interview feedback and pipeline history.
  • AI-extracted fields derived from resumes, stored alongside the original file.

Usage and billing

  • Feature usage (pages, actions) and diagnostic logs, to run and improve the service.
  • Billing identity and invoices. Card and bank details are handled by Razorpay and never stored by us.

4. How we use data

  • To provide the service: pipelines, search, scheduling, notifications and emails you or your organisation trigger.
  • To run AI features: resume text is sent to our AI provider (Google Gemini via API) solely to extract structured fields. API data is not used by the provider to train models. We keep the extracted result and a usage record; we do not send data to AI for any other purpose.
  • To send transactional email (verification, invitations, interview invites, reminders) through Amazon SES.
  • To secure the service: fraud and abuse detection, audit logs, backups.
  • To bill and support you.

We do not sell personal data and we do not use candidate data to build a shared talent pool across customers. Each organisation's data is isolated.

5. Where data lives

Primary storage and backups are in Amazon Web Services, Mumbai region (ap-south-1). Sub-processors: Amazon Web Services (hosting, storage, email), Google (AI API, optional sign-in), Razorpay (payments), Cloudflare (DNS). We will update this list before adding a sub-processor.

6. Retention

  • Customer workspaces: for the life of the account. If a plan lapses the workspace becomes read-only; data is deleted 90 days after the account is closed, or earlier on request.
  • Candidate records deleted by a customer are recoverable for 30 days, then purged.
  • Audit and security logs: 12 months.
  • Backups: rolling 14 days.

7. Your rights

Account holders can view and edit their profile in Settings, export their organisation's data, and close the account. Candidates who want to access, correct or erase information a customer holds about them should contact that customer; where they contact us, we will forward the request to the customer and assist. You may also raise a grievance with our Grievance Officer at privacy@hirezeta.io; we respond within 30 days.

8. Cookies

We use strictly necessary cookies for sign-in sessions (scoped to hirezeta.io) and a preference cookie for light/dark mode. Marketing pages may use privacy-respecting analytics without cross-site tracking. No advertising cookies.

9. Security

Encryption in transit (TLS 1.2+) and at rest, per-organisation data isolation enforced in the application layer, role-based access, signed time-limited file links, hashed passwords, and an append-only audit trail. See our Security page.

10. Children

HireZeta is a workplace tool for adults. We do not knowingly process data of anyone under 18 except as candidate records lawfully held by a customer.

11. Changes

We will post updates here and, for material changes, email account owners at least 14 days in advance.