Privacy Policy

1) What we collect

• Account data: name, email, phone, role (employer/jobseeker), company (for employers).
• Jobseeker profile data: resume, skills, experience, education, location, and related fields that the jobseeker provides.
• Usage data: security logs, login attempts, and rate-limiting events.
• Employer audit events: who unlocked candidate contact details / downloaded profiles and when.

2) Why we collect it

• To provide job portal features: posting jobs, applying to jobs, searching candidates, and contacting applicants.
• To prevent abuse and secure the platform (rate limits, fraud detection signals).
• To meet operational, accounting, and compliance requirements.

3) Sensitive actions and audit logging

When an employer performs sensitive actions such as unlocking email/mobile or downloading a profile, the system records an audit event (employer id, action type, candidate id, timestamp, and basic technical metadata like IP/user-agent). This is used for security and compliance.

4) Advertising and campaign tracking

We may use advertising and analytics tools, including Meta Pixel and Meta Conversions API, to understand campaign performance, measure visits, capture enquiry attribution, and improve our recruitment-service communication. Campaign metadata such as UTM parameters, fbclid, landing page, referrer, browser cookie identifiers, IP address and user-agent may be stored with enquiry forms for attribution and fraud-prevention purposes.

5) Data retention

• Audit and token transaction logs are retained for a minimum operational period (recommended: 180 days) for security/accounting.
• Job applications are retained while the job remains relevant to the employer’s hiring workflow.
• Jobseekers may request deletion of their account; where legally/operationally required, certain records may be retained (e.g., accounting/security logs).

6) Sharing

We do not sell personal data. Candidate data is shared with employers only when the jobseeker applies or when the employer unlocks contact details using paid access controls.

7) Contact

For privacy requests, contact the platform administrator or BHRAI support.

Note: This is a baseline policy for launch. For DPDP compliance, tailor this to your legal counsel and add your organization’s official details (DPO/contact/address) and lawful basis wording.