1. Introduction and Who We Are
Welcome to TalentDraft ("we", "us", "our", "the Platform"). TalentDraft is India's consent-based hiring platform that connects freshers and early-career professionals ("Candidates") with verified recruiters and employers ("Recruiters") through AI-powered matching.
TalentDraft is independently operated by TalentDraft, based in Hyderabad, Telangana, India ("Operator"). TalentDraft is not currently a registered company. The Operator takes full personal responsibility for the data handling practices described in this Policy.
For purposes of India's Digital Personal Data Protection Act, 2023 (DPDP Act), the Operator functions as a Data Fiduciary. For purposes of the Information Technology Act, 2000, TalentDraft operates as an Intermediary.
2. Data We Collect
We collect only information necessary to provide our services.
2.1 Data You Provide Directly — Candidates
| Category | Data Points |
|---|---|
| Identity | Full name, email address |
| Academic | College/university name, graduation year |
| Personal | Date of birth (age verification and eligibility only) |
| Professional | Bio/about, target job roles, GitHub URL, LinkedIn URL |
| Resume | Uploaded PDF resume (stored securely on Amazon S3) |
| Interview Responses | Text answers provided during the AI interview session |
2.2 Data You Provide Directly — Recruiters
| Category | Data Points |
|---|---|
| Identity | Full name, email address |
| Organisation | Company name, designation, company size, revenue range, industry, website URL |
| Job Postings | Job title, description, required skills, salary range, location, work type |
| Hiring Actions | Requests sent to candidates, messages, shortlists, hire status updates |
2.3 Data We Generate Automatically
- AI Resume Score: A numerical score (0–100) calculated by our AI after analysing your uploaded resume, broken down into sub-dimensions (Technical Depth, Project Quality, Domain Alignment, Proof of Work, Presentation Quality).
- AI Interview Score: Additional score points (up to +8) earned by completing our AI interview.
- Profile Embedding: A mathematical vector representation of your profile used solely for semantic job matching. Never shared with recruiters directly.
- Activity Log: Records of significant account actions for security and dispute resolution.
- Notifications: In-app and email notification records.
2.4 Data Collected Automatically by Systems
- Log Data: Server access logs including IP address, request timestamps, HTTP method, and response codes. Retained for 180 days as required by CERT-In Directions (2022).
- Session Information: Authentication tokens and session identifiers stored in your browser's local storage and cookies.
- Device & Browser Info: Browser type, operating system, and device type for rendering and security purposes.
2.5 Data We Do Not Collect
3. How We Use Your Data
3.1 Candidate Data Usage
| Purpose | Legal Basis (DPDP Act 2023) |
|---|---|
| Creating and managing your account | Consent (Sec. 6) |
| Displaying your anonymised profile to recruiters | Consent (Sec. 6) |
| Calculating your AI resume and interview score | Consent (Sec. 6) |
| Semantic matching with job postings | Consent (Sec. 6) |
| Sharing name, email, and resume with a recruiter — ONLY after you explicitly approve their request | Specific Consent (Sec. 6) |
| Sending transactional email notifications | Contractual Necessity |
| Platform security and fraud prevention | Legitimate Interest |
| Complying with legal obligations | Legal Obligation |
3.2 AI and Automated Processing
TalentDraft uses artificial intelligence for:
- Resume Scoring — Powered by AWS Bedrock (Amazon Nova). Analyses your uploaded resume to generate a score.
- Interview Assessment — AI conducts a 10-question written interview and evaluates responses to compute a score boost.
- Semantic Job Matching — Vector embedding of your profile and job descriptions used to compute compatibility.
- Job Validation — AI reviews recruiter job descriptions for completeness and quality before publishing.
4. Consent and Your Choices
4.1 How We Obtain Consent
Consent is obtained through a clear affirmative action (clicking "Create Account" after reading this Policy and our Terms). Pre-ticked checkboxes are not used. Consent is not bundled with unrelated terms.
4.2 The Candidate Consent Model
4.3 Privacy Controls
| Setting | What it controls |
|---|---|
| Show College | Whether recruiters can see your institution name |
| Show Graduation Year | Whether recruiters can see your grad year |
| Show GitHub/LinkedIn | Whether recruiters can see your profile links |
| Hibernate Mode | Completely hides your profile from all recruiter searches |
| Profile Visibility | Master toggle to appear in matching results |
These settings are available in Settings → Privacy.
5. Data Sharing and Third Parties
We do not sell your personal data. We share data only in the following circumstances.
5.1 Sharing with Recruiters
Your personal information is shared with a specific recruiter only after you explicitly approve their connection request. Upon approval, the recruiter receives access to your name, email address, resume, and the profile details you have chosen to make visible.
5.2 Third-Party Service Providers
| Provider | Purpose | Data Shared | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure, database (RDS PostgreSQL), file storage (S3), authentication (Cognito), AI processing (Bedrock) | All platform data as necessary | India (ap-south-1 / Mumbai) |
| Resend | Transactional email delivery | Email address, notification content | USA (Standard Contractual Clauses in place) |
These providers process data strictly on the Operator's behalf and may not use your data for their own purposes.
5.3 Legal Disclosures
We may disclose personal data to law enforcement, regulatory bodies, or courts when required by applicable law, court order, or government direction. We will notify you of such disclosures to the extent permitted by law.
6. Data Retention
| Data Type | Retention Period |
|---|---|
| Active account profile data | Duration of account activity |
| Uploaded resume (S3) | Duration of account activity; deleted within 30 days of account deletion |
| AI scores and breakdowns | Duration of account activity |
| Interview transcripts | Duration of account activity |
| Profile embeddings | Deleted on account deletion |
| Request and hiring records | 12 months after the hiring event |
| Activity logs | 180 days (CERT-In mandatory requirement) |
| Email communications | 12 months |
| Anonymised/aggregated analytics | Indefinitely (no personal identifiers retained) |
7. Data Security
- Encryption in Transit: All data is encrypted using TLS 1.2 or higher.
- Encryption at Rest: All database and S3 data is encrypted using AES-256.
- Access Controls: Role-based access control restricts data access to authorised systems only.
- Authentication: User accounts are protected via AWS Cognito.
- Resume Access: Resume files are accessible only via time-limited pre-signed URLs (1-hour validity). They are not publicly accessible.
- Infrastructure: All data is hosted within AWS ap-south-1 (Mumbai, India) in private subnets.
- System Logs: Access logs maintained for 180 days within India as required by CERT-In Directions (2022).
7.1 Data Breach Response
In the event of a personal data breach, the Operator will: (1) Notify the Data Protection Board of India (DPBI) within the timeframe stipulated by the DPDP Act. (2) Notify affected users promptly. (3) Report cybersecurity incidents to CERT-In within 6 hours of detection.
8. Cookies and Tracking
| Cookie Type | Purpose | Can be Disabled? |
|---|---|---|
| Essential / Authentication | Maintaining your login session (role cookie, auth token) | No — platform requires these |
| Security | CSRF protection, fraud detection | No |
| Analytics (if deployed) | Aggregate usage patterns | Yes — via browser settings |
We do not use third-party advertising cookies or cross-site tracking pixels. Authentication tokens are stored in your browser's local storage and are never transmitted to third parties.
9. Your Rights Under DPDP Act 2023
9.1 Right to Access (Section 11)
Request a summary of personal data we hold. Email privacy@talentdraft.me with subject "Data Access Request".
9.2 Right to Correction and Completion (Section 12)
Update or correct inaccurate data anytime via Settings → Profile, or email privacy@talentdraft.me.
9.3 Right to Erasure (Section 12)
Delete your account and all associated data via Settings → Account → Delete Account or by emailing privacy@talentdraft.me. Processed within 30 days.
9.4 Right to Grievance Redressal (Section 13)
File a grievance with our Grievance Officer (see Section 13) before approaching the Data Protection Board of India.
9.5 Right to Nominate (Section 14)
You may nominate a person to exercise your data rights. Contact privacy@talentdraft.me.
9.6 Right to Withdraw Consent
Withdraw consent for any specific processing at any time via Privacy Settings or by deleting your account.
9.7 Right to Contest Automated Decisions
If you believe our AI-generated score or matching result is inaccurate or unfair, contact grievance@talentdraft.me to request human review.
10. Children's Data
11. International Users and Data Transfers
All data is primarily processed and stored within India (AWS ap-south-1, Mumbai). If you access TalentDraft from outside India, your data is transferred to and processed in India.
For users in the European Economic Area (EEA)
- Processing is based on contractual necessity (Article 6(1)(b) GDPR) for core services and explicit consent (Article 6(1)(a) GDPR) for AI profiling.
- Transfers from the EEA to India are governed by Standard Contractual Clauses (SCCs).
- You additionally have the right to data portability (Article 20), the right to object to processing (Article 21), and the right not to be subject to solely automated decisions with significant effects (Article 22).
12. Links to Third-Party Websites
The Platform may display links to third-party websites (e.g., GitHub, LinkedIn). These sites have independent privacy policies. We are not responsible for their content or practices.
13. Grievance Officer
Grievance Officer — TalentDraft
In accordance with the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the DPDP Act, 2023. Unresolved complaints may be escalated to the Grievance Appellate Committee (GAC) or the Data Protection Board of India (DPBI) once constituted.
14. AI Disclaimer
14.1 Scores Are Advisory, Not Definitive
All AI-generated scores (Resume Score, Interview Score, Match Score) are algorithmic estimates based on data you provide. They do not certify, guarantee, or predict employment outcomes.
14.2 Recruiter Responsibility
Recruiters are solely responsible for their hiring decisions. AI scores are inputs to — not substitutes for — independent recruiter judgment.
14.3 Algorithmic Fairness
Our AI systems do not use protected attributes (gender, caste, religion, disability, age) as scoring inputs. If you believe our AI has produced a biased result, contact grievance@talentdraft.me to request manual human review.
14.4 No Emotion AI
We do not use emotion detection, facial analysis, voice sentiment analysis, or any technology that infers emotional state.
15. Changes to This Privacy Policy
When material changes are made, we will: (1) Update the "Last Updated" date at the top. (2) Send a notification email to all registered users. (3) Display a prominent notice on the Platform for at least 30 days.
Continued use after the effective date constitutes acceptance of the revised Policy.
16. Contact Us
TalentDraft Privacy Team
This Privacy Policy is governed by the laws of India. Disputes are subject to the jurisdiction of the courts at Hyderabad, India.