Privacy Policy
DRAFT: pending legal review. This text is a placeholder and is not legally vetted. Do not rely on it as final.
Last updated: [TBD]
This policy explains how [TBD: legal entity name, registration number and registered address] ("HireFlow", "we") handles your personal data. We aim to follow India's Digital Personal Data Protection Act, 2023 (DPDP Act).
1. What we collect and why
| What | Why |
|---|---|
| Name, email (from Google sign-in) | To create and identify your account |
| Phone number | To reach you about matching roles |
| Current company, experience, notice period | To match you with suitable roles |
| 3 to 5 rated skills | To match you with suitable roles |
| WhatsApp consent choice and time | To record whether we may message you |
| Referral code and who referred you | To run referrals and show referrers how many friends joined |
| UTM attribution (signup source) | To understand where signups come from |
| Pseudonymous candidate id in analytics | To understand how the product is used |
We ask only for what we need to run the service.
2. WhatsApp consent
WhatsApp messages about job matches are opt-in. We send them only if you tick the consent box at signup. You can withdraw consent at any time by replying STOP to a message or by emailing privacy@konapalli.dev. Withdrawing consent does not affect your account or the lawfulness of earlier messages.
3. Where your data is stored
Your data is stored in Supabase, hosted in AWS ap-south-1 (Mumbai, India).
4. Who processes your data
| Processor | Role | Location |
|---|---|---|
| Supabase | Authentication and database | India (Mumbai) |
| Sign-in | [TBD] | |
| Vercel | Hosting of the web app | [TBD] |
| PostHog | Product analytics | Outside India [TBD: region] |
PostHog receives only a pseudonymous candidate id. It never receives your name, email or phone number. We do not sell your data.
5. How long we keep it
We keep your data while your account is active. If you ask us to delete it, we delete it within [TBD: period, for example 30 days], except where the law requires us to keep something. [TBD: inactive-account retention period.]
6. Your rights under the DPDP Act
You can:
- ask for a summary of the personal data we hold and how we use it;
- ask us to correct or complete your data;
- ask us to erase your data;
- withdraw consent at any time;
- nominate someone to exercise your rights if you die or become unable to;
- make a grievance to us, and if it is not resolved, complain to the Data Protection Board of India.
Email privacy@konapalli.dev. We will reply within [TBD: period].
7. Deletion requests
Email privacy@konapalli.dev from the address on your account and ask us to delete it. We may ask you to confirm it is you.
8. Children
HireFlow is not for anyone under 18.
9. Changes
We will change the date above when this policy changes, and tell you about material changes.
10. Contact
Grievance contact: [TBD: name], privacy@konapalli.dev