Business privacy notice

Who is responsible

CraftMyResume Labs Pvt Ltd operates CraftMyResume Business. Contact us at hello@craftmyresume.org. This notice adds to our general privacy policy.

For workspace accounts and billing, we decide how the data is used. For candidate data, the organization that uploaded the resume decides, and we process it on their behalf.

If you are a candidate

An agency or employer using our service may have uploaded your resume. They chose to do so and are responsible for telling you about it. Please send requests to see, correct, or delete your data to that organization first. If you cannot identify them, or need help, write to us at hello@craftmyresume.org and we will pass your request on where we can.

Candidate data we process

• The resume file and the text extracted from it.
• A name or reference the recruiter enters.
• Results, including quotes from the resume.
• The recruiter's decision and private notes.

How candidate data is used

We use it only to produce and show results to the organization that uploaded it. Email addresses, phone numbers and links are removed from the resume text before it is sent to the AI provider, though other details in the resume, including a name, can still be sent. The evaluation is instructed not to use name, photo, age, gender, caste, religion, marital status, disability, employer or college prestige, or career gaps as evidence. We do not sell candidate data.

How long we keep it

• Uploaded files and extracted text: deleted after assessment, within 24 hours at most.
• Results, shortlist decisions and notes: deleted automatically after 90 days, or sooner if the organization deletes them.
• Jobs, job descriptions, rubrics and client names: kept until the organization deletes them. They should not contain candidate data.
• Client reports: not stored by us after download.
• Billing records: kept as long as tax and accounting law requires.

Deleted data can remain in encrypted database backups until those backups are replaced.

Workspace user data

For workspace members we process name, email address, role, sign-in and security records, and an activity log of operations, which does not include request contents. For purchases we keep the billing name, address, state, any GSTIN and the Razorpay payment ID. We do not receive your card or bank details.

Security

Temporary files are encrypted, and candidate names, results and notes are encrypted in our database. Access is limited by role, and protected actions need an authenticator code. No system is perfectly secure, so please report concerns to hello@craftmyresume.org.

Who receives it

We use the service providers on our subprocessor list. Some of them process data outside India. A client report goes to whomever the recruiter chooses to share it with.

Your rights

Under applicable law, including the Digital Personal Data Protection Act, 2023, you may have rights to access, correct and erase your personal data, to withdraw consent where consent is the basis, to nominate someone to act for you, and to raise a grievance. Write to hello@craftmyresume.org. If we cannot resolve your grievance you can approach the Data Protection Board of India once it is accepting complaints.

Children

The service is for hiring by organizations and is not meant to process data about anyone under 18.

Changes

We will update the date on this page and tell workspace owners by email about material changes.