Privacy Policy

1. Introduction & Overview

At QHR Digital AI Private Limited (“QHR Digital AI,” “We,” “Our,” or “Us”), we take the privacy and security of candidate resumes, recruiter information, and enterprise client data with the utmost seriousness.

This Privacy Policy explains how our cloud Applicant Tracking System (“ATS”), AI Resume Parser, interview scheduling tools, and candidate communication integrations collect, process, store, and protect information when you use our website at https://qhrdigital.ai or our SaaS web applications.

2. Roles Under Privacy Regulations (GDPR & DPDP Act)

Depending on the context of the data being processed, QHR Digital AI acts in two distinct capacities:

• Data Processor (Service Provider) for Candidate Data: When our customers (employers, corporate hiring teams, or staffing agencies) upload candidate resumes, import talent databases, or conduct interviews using QHR Digital, the customer acts as the Data Controller (or Data Fiduciary). QHR Digital processes this candidate data strictly upon the instructions of the customer and in accordance with these policies.
• Data Controller for Customer Account Data: When company administrators, hiring managers, or website visitors register an account, request a product demo, or contact our sales team, QHR Digital acts as the Data Controller for billing, contact, and account management purposes.

3. Information We Collect and Process

A. Customer Account & Billing Information

When an organization creates an account or purchases a subscription:

• Authorized user contact details: Name, work email address, company title, business phone number.
• Organization details: Company legal name, workspace subdomain, billing address, tax identification (GST / VAT).
• Payment details: Credit card or bank authorization details processed securely by PCI-DSS certified payment processors (e.g. Stripe, Razorpay). We do not store raw card numbers on our servers.

B. Candidate Data Processed via the ATS

Information extracted, parsed, or entered into candidate profiles by employers and recruiters:

• Contact Information: Full name, email address, phone numbers, postal location, LinkedIn or GitHub profile URLs.
• Employment History: Previous job titles, company names, durations of employment, role descriptions, and project achievements.
• Educational Credentials: Degrees obtained, university names, graduation years, and academic certifications.
• Skills & Competencies: Hard skills, programming languages, software proficiencies, language capabilities, and certifications extracted by our AI Resume Parser.
• Recruitment Lifecycle Records: Interview scorecards, rating rubrics, recruiter notes, salary expectations, offer letters, and email/WhatsApp conversation threads.

4. How Candidate Data is Handled by our AI Resume Parser

Our proprietary and transformer-based parsing engine reads unformatted candidate resumes (PDF, DOCX, DOC, TXT, images) to convert text into structured JSON candidate files:

• No Public Model Training on Private Resumes: Resumes processed in your workspace are never used to train public-facing foundational models or shared with competitor staffing firms.
• Blind Screening Modes: For organizations promoting diversity and unconscious bias elimination, QHR Digital provides an automated “Blind Screening” feature that strips candidate photos, names, gender, age, and graduation years prior to recruiter scorecard review.
• Parsing Accuracy Guarantee: We achieve a 99.4% extraction precision while ensuring strict adherence to data retention boundaries set by the customer.

5. Multi-Tenant Architecture & Enterprise Security Safeguards

We protect candidate data and client profiles with state-of-the-art administrative, technical, and physical safeguards:

• Multi-Tenant Data Isolation: Every company workspace is cryptographically separated. Client databases and candidate records are isolated by tenant identifiers, guaranteeing zero cross-company data leakage.
• Encryption Standards: All data is encrypted in transit using TLS 1.3 and at rest using military-grade AES-256 encryption.
• Audit Logging: Every resume download, profile view, candidate stage change, and export action is timestamped and recorded in immutable audit logs.
• Access Control: Granular Role-Based Access Control (RBAC) ensures only designated team members can view sensitive compensation numbers, candidate PII, or interview evaluations.

6. Third-Party Sub-Processors & Integrations

We engage carefully audited third-party service providers to facilitate our cloud operations under strict Data Processing Agreements (DPAs):

• Cloud Hosting Infrastructure: Amazon Web Services (AWS) and Google Cloud Platform (GCP) data centers with SOC-2 Type II and ISO 27001 certifications.
• Communication Gateways: Official WhatsApp Business API providers and SMS gateways (e.g. Twilio) for delivering interview reminders and candidate updates.
• Calendar & Video Sync: Google Workspace API and Microsoft Graph API (Outlook / 365) for 2-way calendar sync, and Zoom / Teams / Meet for video interview generation.

7. Candidate Data Rights (GDPR & DPDP Act Compliance)

Job applicants whose resumes reside in our platform have legal rights regarding their personal information:

• Right of Access & Portability: Candidates may request a copy of their parsed profile and application history.
• Right to Rectification: Candidates may update inaccurate contact details or resume versions.
• Right to Erasure (“Right to be Forgotten”): Candidates may request complete deletion of their profile, documents, and interview notes from employer talent pools.
• Exercising Rights: Candidates should contact the specific hiring organization (the Data Controller) who manages their application. When requested by a verified customer, QHR Digital executes candidate data purges within 48 hours.

8. Data Retention & Automatic Purging

We retain customer data for as long as the organization maintains an active subscription. Customers may configure automated data retention policies (e.g., automatically archiving or deleting uncontacted candidate profiles after 12 or 24 months) to comply with regional labor guidelines. Upon account termination, data is permanently scrubbed after a 30-day grace period.

9. Privacy Office & Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or your data protection rights, please contact our Data Protection Officer (DPO):