Privacy policy

If you are a candidate or a new hire, the company you applied to or are joining (our “customer”) decides which jobs to run, which candidates to consider and what to collect. For that data the customer is the controller (the “data fiduciary” under India’s DPDP Act), and SuprHiro processes it on the customer’s instructions under our Data processing agreement. Questions about how a company uses your application are best sent to that company; we will help you reach them.

If you use SuprHiro at work (a “user”), or you visit our website, SuprHiro is responsible for your account and website data.

People who use SuprHiro at work

• Name, work email, phone number (optional), role, company name, and the answers given at sign-up (such as company size and hiring goals).
• A password, stored only as a salted bcrypt hash — or, if you sign in with Google or LinkedIn, your name, email address and account identifier from that provider.
• Sign-in records (including IP address and browser), an audit trail of important actions, notification preferences, and — if you connect them — calendar and Telegram accounts (see sections 5–7).

Candidates

• What you submit when applying: name, email, phone, location and work preferences, current and expected pay, notice period, resume, cover letter, and links you provide (for example LinkedIn, GitHub or a portfolio), plus how you heard about the job.
• Information extracted from your resume, such as skills, experience and education, and a match score against the job’s requirements.
• Hiring records the company creates: stage, notes, interview schedules, feedback and scorecards, assessments and your answers to them, and offers.
• Messages between you and the company by email, WhatsApp, Telegram or chat, including replies you send to a SuprHiro reply address. For emails we receive delivery and “opened” status from our email provider.
• If the company uses AI phone screening: the call outcome, duration, your answers, a recording (held by our calling provider), a transcript and an AI summary. The assistant tells you at the start that the call is recorded.
• If the company switches on the AI notetaker for an interview: an audio transcript and an AI summary of the interview. You are told in the invitation and in the meeting.
• The consent you gave when applying, and when you gave it.

Companies can also add candidates themselves — for example by importing a spreadsheet or uploading resumes they received elsewhere. In that case the company is responsible for telling you and for having a lawful basis to do so.

New hires

If a company uses SuprHiro for onboarding, you may be asked for: legal name, date of birth, gender, addresses, emergency contact, PAN, Aadhaar and passport numbers, bank account number, bank and IFSC, previous employment, and copies of documents such as identity cards, degree certificates, payslips, a cancelled cheque and a resignation letter. Companies may also record the status and results of background checks carried out by their chosen background-check vendor, the details of your offer (including pay), and a company email account set up for you.

Everyone

Technical data needed to run and protect the Service — IP address, browser and device type, pages requested and request logs — and the analytics described in section 9.

• To provide the Service — running jobs and applications, organising candidates, scheduling interviews, sending emails, messages and reminders, making calls the company requests, preparing offers and onboarding, and producing the reports a company asks for.
• To run AI features and automations the company switches on — see section 4.
• To suggest past candidates for new jobs at the same company. Candidates who applied to that company in the previous 12 months may be suggested to its recruiters for other jobs.
• To keep the Service secure — preventing abuse and spam, detecting and investigating misuse, and fixing problems.
• To understand and improve the website and product, using the analytics described in section 9.
• To bill customers and meet legal, tax and accounting obligations.
• To send service messages to users — for example security notices, invitations, digests and changes to our terms.

We do not sell personal data, we do not use it for advertising, and we do not use customer or candidate data to train AI models.

Resume text, call and interview transcripts, interview notes and feedback, and candidate profile details are sent to our AI providers (Groq and Google Gemini) to parse resumes, write summaries and answer questions in the staff assistant. They are sent only to produce that result for the customer.

The match score is calculated from how many of the job’s required and nice-to-have skills appear in the resume; AI only writes the one-line explanation. Workflows that move or reject candidates are off until a company switches them on, start in test mode, and by default ask a person to approve score-based rejections. Some built-in steps run automatically — for example, a candidate who misses a second interview is marked rejected. The full list, and how to ask for a human review, is on our Responsible AI and automated decisions page.

A user can connect a Google account (for example a company Google Workspace account or their own Google Calendar) so that SuprHiro can schedule interviews on it. We request only these permissions:

• See the free/busy times on your calendars (calendar.freebusy) — to show candidates only the times the interviewer is actually free. We read free/busy blocks only, not event titles, attendees or descriptions. Free/busy times are fetched when slots are shown and are not stored.
• View and edit events on your calendars (calendar.events) — to create, update and cancel the interview events SuprHiro schedules, add a Google Meet link, and send invitations to the candidate and interviewer. We store the ID of each event we create so we can update or cancel it; we do not read or change other events.
• See your email address (userinfo.email) — to show which Google account is connected.

Sign in with Google. If you choose to sign in with Google, we receive your name, email address and Google account identifier (openid, email, profile) and use them only to create and sign in to your account.

Storage and security. The calendar credentials Google gives us are encrypted at rest and used only by SuprHiro’s servers to perform the actions above. Google user data is not shared with other customers, and it is not transferred to third parties except as needed to provide these features, to comply with law, or with your permission.

No AI training, no advertising. We do not use Google user data to develop, improve or train generalised AI or machine-learning models, we do not use it for advertising, and we do not sell it. Our staff do not read it unless you ask us to for support, it is needed for security, or the law requires it.

Your control. You can disconnect a Google account at any time from Settings in SuprHiro, which deletes the stored credentials, or remove SuprHiro’s access from your Google Account permissions page at myaccount.google.com/permissions.

If a user connects a Microsoft account, we request permission to sign you in, read your basic profile and email address, and read and write your calendar, with offline access so scheduling works when you are not signed in. We use this in the same limited way as Google: to check when the interviewer is busy (we read only busy/free status and times, not event contents) and to create, update and cancel the interview events we schedule, including a Microsoft Teams link where available. Credentials are encrypted at rest and removed when you disconnect in Settings; you can also revoke access from your Microsoft account.

• Sign in with LinkedIn — we receive your name, email address and LinkedIn identifier, and use them only to create and sign in to your account.
• WhatsApp Business — if a company connects its WhatsApp Business account, we send messages and reminders to candidates from it and receive replies.
• Telegram — users can link Telegram for notifications and the staff assistant; candidates can choose to receive updates through our Telegram bot. Messages sent this way pass through Telegram.

We share personal data only with the company you are dealing with and with service providers that help us run SuprHiro, under terms that limit their use of it to providing their service to us. The main categories are:

The full list, with what each provider receives, where it operates and when it is used, is on our Sub-processors page. We may also disclose data where the law requires it, to protect people’s safety or our rights, or to a buyer as part of a merger or acquisition, in which case this policy will continue to apply.

We use cookies that are strictly necessary to sign you in and protect forms. We also use analytics on our website and application — Google Analytics 4, Contentsquare and, where enabled, PostHog — to understand how pages are used (pages viewed, clicks, scrolling, device, browser and approximate location) so we can fix problems and improve the product. These tools place their own cookies. We do not use advertising cookies, and analytics is not used to build advertising profiles. Details, and how to switch analytics cookies off, are in our Cookie policy.

We use encryption in transit (HTTPS) and encrypt the most sensitive fields at rest with AES-256-GCM — including PAN, Aadhaar, passport and bank account numbers, call and interview transcripts, email and chat messages, and calendar and WhatsApp account credentials. Each customer’s data is kept separate from every other customer’s, access inside a workspace is limited by role, and sign-in is protected by rate limits and lockouts. No system is perfectly secure; if a breach affects your personal data we will notify the affected customers and, where required, the relevant authorities. More on our Security page.

• User accounts — while the account is active. Deactivated users’ records are kept with the workspace so its history stays accurate.
• Candidate and new-hire data — for as long as the customer keeps it for hiring and employment purposes. Customers can archive candidates, and on request we can permanently erase a candidate’s application data, files, messages, transcripts, notes and feedback.
• Call recordings are held by our calling provider; interview-notetaker media is deleted from the notetaker provider once the transcript has been saved to SuprHiro.
• Closed workspaces — deleted or anonymised after the 30-day export window described in our Terms.
• Billing and tax records — for as long as tax and accounting law requires.

Depending on where you live — including under India’s Digital Personal Data Protection Act, 2023 and the EU/UK GDPR — you may have the right to access, correct, update or erase your personal data, withdraw consent, object to or restrict certain processing, ask for a human to review an automated decision, nominate someone to exercise your rights, and receive a copy of your data. Candidates can see the status of their applications and update their location and work preferences in the candidate portal. How to make a request, and what happens next, is set out on our Your data rights page. Where a customer controls the data, we will pass your request to them and help them respond.

Several of our providers — including our AI, analytics, notetaker and email providers — process data outside India, mainly in the United States and the European Union. When that happens we rely on their contractual commitments and appropriate safeguards to protect it, and on the protections the law requires for such transfers.

SuprHiro is a business and hiring tool and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided data, contact us and we will delete it.

We will update this page when our practices change and revise the date at the top. If a change is significant we will tell customers by email or in the product before it takes effect.

For privacy questions, requests or complaints — including grievances under the DPDP Act — contact our Grievance Officer at hello@suprhiro.co. We acknowledge complaints within 48 hours and aim to resolve them within 30 days. If you are not satisfied with our response you can complain to the Data Protection Board of India or your local data protection authority. Other contact details are on our Contact us page; general questions can go to hello@suprhiro.co.