Privacy Policy

1.Who we are

HYRIXAI (the “Platform,” “we,” “us,” or “our”) is an AI-assisted recruiting and applicant tracking system operated by Loop Methods. This Privacy Policy explains how we process personal data when candidates apply to jobs, when recruiters evaluate applicants, and when you otherwise interact with the Platform.

For the purposes of the EU General Data Protection Regulation (“GDPR”) and India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”), Loop Methods acts as a controller / data fiduciary for candidate account data, and as a processor / data processor on behalf of employer customers for candidates who apply to those employers’ jobs.

2.Data we collect

Depending on how you use the Platform, we may collect:

• Identity & contact data — name, email address, phone number, and account credentials.
• Application data — your resume/CV, work history, education, skills, portfolio links, and any information you submit in application forms.
• Assessment & screening data — answers to prescreen questions, assessment responses, and AI-generated scores and evaluations derived from them.
• Voice & recording data — audio from AI voice prescreens and interviews, and, where you provide consent, webcam and screen recordings captured during prescreens, interviews, and proctored assessments.
• Technical data — IP address, device and browser information, and usage logs collected automatically when you use the Platform.

You are not required to provide special-category / sensitive personal data, and we ask that you do not include it in free-text fields or uploaded documents unless necessary.

3.How we use your data

We use personal data to:

• Create and manage candidate and recruiter accounts.
• Match candidates to jobs and enable employers to review applications.
• Run AI resume scoring and structured evaluations that rank and summarize candidate fit against a role’s requirements.
• Conduct AI voice prescreens and interviews and, with consent, record webcam and screen activity for integrity and quality purposes.
• Communicate with you about applications, stages, and outcomes.
• Secure the Platform, prevent fraud and cheating, and comply with legal obligations.

4.AI-assisted decision-making

The Platform uses artificial intelligence to score resumes, summarize screening responses, and rank candidates. These outputs are decision-support tools intended to assist human recruiters. AI scores and recommendations may be inaccurate or incomplete and should not be treated as the sole basis for a hiring decision.

Where automated processing produces a legal or similarly significant effect on you, you have the right not to be subject to a decision based solely on automated processing, to request meaningful human review, to express your point of view, and to contest the outcome. To exercise these rights, contact us at privacy@hyrixai.com.

5.Legal basis for processing

Under the GDPR, we rely on one or more of the following legal bases:

• Consent — for optional processing such as webcam/screen recording during screening.
• Performance of a contract — to operate your account and process your applications.
• Legitimate interests — to secure the Platform and improve our services, balanced against your rights.
• Legal obligation — where processing is required by applicable law.

Under India’s DPDP Act, we process personal data on the basis of your consent or for legitimate uses permitted by the Act. You may withdraw consent at any time; withdrawal does not affect processing carried out before withdrawal.

6.Third-party processors & sub-processors

We use trusted third-party service providers to deliver the Platform. These may include cloud hosting and storage providers, voice-AI providers (which process call audio to conduct AI prescreens and interviews) and large language model (LLM) providers (which process resume and screening text to generate scores and summaries). These providers process personal data on our instructions under contractual confidentiality and security obligations. A current list of sub-processors is available on request from privacy@hyrixai.com.

7.International data transfers

Your personal data may be processed in countries outside your own, including outside the EEA or India. Where we transfer data internationally, we rely on appropriate safeguards such as Standard Contractual Clauses or an equivalent lawful transfer mechanism.

8.Data retention

We retain personal data only for as long as necessary for the purposes described in this Policy, including the duration of an active application and recruiting process, and for a reasonable period thereafter to meet legal, audit, and dispute-resolution requirements (target retention period: 24 months after an application or recruiting process closes). Voice, webcam, and screen recordings are retained for 12 months and then deleted or anonymized. You may request earlier deletion as described below.

9.Your rights

Subject to applicable law, you have the right to access your personal data, to correct inaccurate data, to request deletion, to restrict or object to certain processing, to data portability, and to withdraw consent. Under the DPDP Act you also have the right to nominate another individual to exercise your rights and the right to grievance redressal.

To exercise any of these rights, contact privacy@hyrixai.com. We will respond within the timeframe required by applicable law. If you are in the EEA/UK, you also have the right to lodge a complaint with your local supervisory authority. If you are in India, you may contact our Grievance Officer (below) and escalate to the Data Protection Board of India.

10.Cookies & tracking

We use cookies and similar technologies that are strictly necessary to run the Platform (for example, to keep you signed in) and, where required by law and with your consent, for analytics. You can control non-essential cookies through your browser settings or any cookie banner presented on the Platform.

11.Data security

We implement appropriate technical and organizational measures — including encryption in transit, access controls, and audit logging — to protect personal data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12.Children

The Platform is not intended for individuals under the age required to enter employment or to consent to data processing in their jurisdiction. We do not knowingly collect data from children below the applicable age of consent without verifiable parental consent as required by the DPDP Act.

13.Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified through the Platform or by email. The “Last updated” date above indicates when this Policy was last revised.

14.Google Workspace / Gmail data (email résumé intake)

Some employers using the Platform connect a Gmail or Google Workspace mailbox so that résumés emailed to that mailbox are imported into their recruiting Resume Inbox. This feature uses Google’s OAuth authorization and requests the gmail.readonly scope, which is read-only: it cannot send, change or delete email. We also request the basic openid and email scopes so that we can store the connected account’s email address to identify the connection. A résumé can arrive in any message, so the feature looks at every new message that arrives in the connected inbox; we therefore recommend connecting a mailbox used for recruiting rather than a personal one.

• What we access: read-only access to new messages that arrive in the connected mailbox’s inbox and to their attachments (sender, subject, body and attached files), used only to identify candidate résumés.
• Why: to detect incoming résumés, route them to the correct job posting, and add them to the employer’s Resume Inbox. Depending on the import mode the employer chooses, a recruiter reviews and approves each résumé before it becomes a candidate record (the default), or matching résumés are added automatically. This saves the recruiting team from forwarding or uploading each résumé by hand.
• Who connects it: only an authenticated employer user with the appropriate role can initiate the Google OAuth connection for their organization or their own account; a candidate’s or any other third party’s Gmail account is never accessed.
• Storage & security: the OAuth token issued by Google is encrypted at rest and used solely by the Platform’s automated intake pipeline to periodically check the connected mailbox for new mail. It is never used to send email, never shared with unrelated third parties, and never used for advertising.
• What we keep for messages with no attachment: nothing readable. We keep no sender address, subject or message text and no copy of the message; only a one-way hash of the sender’s address, the sender’s domain and the processing outcome, so that we do not process the same message twice and can apply per-sender limits.
• What we keep for messages with attachments: (1) a raw copy of the message (headers, body, recipients and attachment details), kept in storage for about 30 days and then deleted automatically, or removed within about a day if the employer disconnects the mailbox (in our cloud storage, deleted copies may remain in version history for up to about 90 more days before they are permanently purged); (2) the sender’s address, the subject line and the first 2,000 characters of the message text, stored with the message record (recruiters see only a shortened subject in the Resume Inbox); and (3) the attachments that pass our malware scan, usually the résumé but also any other file the sender attached.
• When it is deleted: if an email never becomes a candidate record, because its attachments are skipped as not being résumés or are dismissed by a recruiter, the attachment files are deleted about 30 days later, and the sender address, subject and text are cleared once nothing from that email remains in use. Items still waiting for a recruiter’s decision are kept until they are decided. When a résumé becomes a candidate record, it and the related email details are part of the employer’s candidate records and are kept as described in Section 8 (Data retention). Any of this can also be deleted on request to privacy@hyrixai.com.
• AI processing: the email intake feature does not send your emails’ subject lines or message bodies to AI services. Once a résumé becomes a candidate record (after a recruiter approves it, or automatically under the employer’s chosen import mode), the résumé file is processed like any résumé uploaded to the Platform: our large language model (LLM) providers, acting as our sub-processors (see Section 6), parse it to extract candidate details and compute match scores, only on our instructions.
• Disconnecting & revoking: when an employer disconnects the mailbox in the Platform’s settings, we stop reading it, ask Google to revoke the access token, and delete our stored copy of the token. If you revoke access from your Google Account’s third-party access settings instead, Google invalidates the token immediately and the Platform can no longer read the mailbox; the invalidated token is deleted when the mailbox is disconnected in the Platform.

Our use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google user data only to provide the résumé-intake feature described above; we do not sell it or use it for advertising; we do not use it to develop, improve or train generalized AI or machine-learning models; and we transfer it to others only as needed to provide that feature (for example, to our hosting and AI sub-processors), to comply with applicable law, or as part of a merger or sale of assets. Access to this data by our personnel is restricted to authorized staff and limited to what is needed to respond to a specific support request from the employer (which we treat as the employer’s consent for those records), for security purposes such as investigating abuse, or where the law requires it. We do not otherwise read it.

15.Contact us

For privacy questions or to exercise your rights, contact us at:

• Privacy contact: privacy@hyrixai.com
• Grievance Officer (India, DPDP Act): grievance@hyrixai.com