Privacy Policy

1. Who this Privacy Policy applies to

This Privacy Policy applies to individuals and organisations that interact with HireXA, including:

• Employers and recruiters who create or manage HireXA accounts and workspaces.
• Hiring managers and team members who use HireXA for recruitment activities.
• Candidates and applicants who apply for jobs, complete assessments, participate in interviews, or otherwise interact with HireXA.
• Individuals whose professional profiles are identified through HireXA candidate sourcing, including people who have not applied to a role themselves.
• Individuals who receive communications from HireXA on behalf of an employer or recruiter.
• Visitors to the HireXA website and related services.

2. Who operates HireXA

HireXA is a product and service operated by Gsure Technologies Private Limited ("Gsure Technologies"), a company incorporated in India under the Companies Act, 2013.

• Registered office. Sector - 20, Panchkula, Haryana, India.
• Contact email. hello@hirexa.ai

Where this Privacy Policy refers to "HireXA", "we", "us", or "our", it refers to HireXA and, where applicable, Gsure Technologies Private Limited as the entity operating the HireXA platform.

Our role depends on the context

For personal information that an employer or recruiter uploads, collects or generates inside their own HireXA workspace, Gsure Technologies acts as a data processor acting on that organisation's instructions; the employer or recruiter is the data fiduciary / controller and determines what is collected, why, how long it is kept and who may see it.

For the HireXA Resume Bank, for candidate profiles that HireXA identifies from public and third-party sources, and for our own account, security, billing and platform-operation records, Gsure Technologies acts as a data fiduciary / controller in its own right.

3. Information we collect

Depending on how you interact with HireXA, we may collect the following categories of information.

3.1 Recruiter and account information

• Name, business email address, phone number, job title.
• Organisation and company information, workspace configuration, team roles and permissions.
• Login credentials, preferences and configuration settings.
• Company profile information, including information drawn from your company website when you ask HireXA to generate a company description.

Passwords, where applicable, are stored using industry-standard hashing and are never stored in plain text.

3.2 Candidate information

• Name, email address, phone number and location.
• Resume or CV, professional experience, education, skills and qualifications.
• Job application information and candidate-provided documents.
• Identity photographs captured at the application, assessment and interview stages.
• Assessment responses, coding submissions and scores.
• Interview responses, transcripts, recordings, evaluations, scorecards and feedback.
• Referral information, and information provided about a candidate by a recruiter, employer or referrer.
• Hiring-decision records, including a record of a rejection and any waiting period the employer has configured before reapplication to that organisation.

The specific information collected depends on the recruitment workflow configured by the employer or recruiter.

3.3 Assessment and interview information

• Answers to assessment questions, coding submissions and computed scores.
• Interview responses, transcripts and audio.
• Interview and assessment duration, session and attempt information.
• Evaluation, rubric and scorecard information.
• Proctoring and integrity information, described in section 5.

Where an employer enables a coding assessment, candidate-submitted source code is executed in an isolated code-execution environment in order to grade it. Depending on the employer's configuration this environment may be operated by HireXA or by a third-party code-execution provider.

3.4 Device, technical and integrity data

When you take an assessment or attend an AI interview, HireXA records technical information about the session so that a result can be attributed to a session and so that integrity reporting is meaningful. This may include:

• IP address, browser user-agent string and browser/device characteristics used as a session fingerprint.
• Device time zone and the number of displays connected to the device.
• Session timestamps, attempt identifiers, connection quality and diagnostic logs.
• Security and audit records of actions taken in the platform, which may include the associated IP address.

Real-time audio and video features use WebRTC. As an inherent property of that technology, network address information may be exchanged between the participants of a live session and with the relay servers used to connect them.

3.5 Information we collect from other sources

To help employers find candidates, HireXA may collect professional information from publicly accessible sources and third-party search providers, including professional networking sites and job portals such as LinkedIn, Naukri and Indeed. This may include name, professional headline, current and previous employers, job titles, skills, education, location and publicly listed contact details.

HireXA may also receive candidate information from recruiters, referrers, employers and partners who submit resumes to the platform.

If you were added to HireXA in one of these ways and did not apply to a role yourself, you may contact us at hello@hirexa.ai to ask what information we hold about you, to correct it, or to ask us to remove you from HireXA sourcing.

3.6 Post-offer and onboarding information

Where an employer uses HireXA to issue an offer and collect onboarding documents, we process, on that employer's behalf, information such as:

• Offer details, including designation, job grade and compensation.
• Government-issued photo identification, such as Aadhaar, Passport, Voter ID or Driving Licence.
• Tax identification, such as a PAN card.
• Bank account proof, for salary processing.
• Education certificates and qualification records.
• Previous employment documents, such as relieving letters and recent salary slips.

These documents are requested only after a candidate has been selected, are uploaded through a tokenised link issued to that candidate, and are stored in access-controlled cloud storage available only to authorised users of the employer's workspace. The employer determines which documents are required and how long they are retained. Where identification documents are subject to specific statutory handling requirements, they are handled in accordance with those requirements and the employer's instructions.

3.7 Information collected through Google, Microsoft and LinkedIn

You may have the option to sign in to HireXA, or to connect third-party services such as Google, Microsoft or LinkedIn. Depending on the integration and the permissions granted, HireXA may receive your name, email address, basic profile information, and the authentication information necessary to sign you in or to perform the action you have authorised. HireXA does not receive your third-party account password through these authentication integrations.

4. Identity verification and biometric-related processing

Where an employer enables identity verification, HireXA captures a candidate photograph at the application stage and at the start of an assessment or AI interview, and compares those images to confirm that the same person is present at each stage of the process. This comparison is performed using a third-party face-comparison service on a stateless, image-to-image basis.

HireXA does not create, store or maintain a biometric face template, faceprint, or searchable face database. Each comparison returns only a similarity score and a verdict. We do not use face data for surveillance, for advertising, for identification against any external database, or to train facial-recognition models.

During an assessment or AI interview, camera frames are also analysed within your browser to detect the presence of a face, head orientation, gaze direction, and the presence of additional people or objects in view. That analysis runs locally on your device; only the resulting numeric signals are transmitted to HireXA, together with a small, limited number of still frames where an identity confirmation is warranted.

Identity comparison is advisory. It flags a session for human review by the recruiter and never automatically rejects a candidate.

5. Interview recording, screen sharing and proctoring

Where an employer enables these features, an AI interview session records the candidate's shared screen together with an audio mixdown of both the candidate's microphone and the AI interviewers' voices, so that the full conversation can be reviewed. Screen sharing is a condition of joining an AI interview room. Recording begins when the interview starts, is uploaded continuously during the session so that an interrupted session is not lost, and is stored in access-controlled cloud storage. Access is granted through short-lived, expiring links issued to authorised users of the relevant workspace.

Where an employer enables proctoring on an assessment or interview, HireXA may record the following integrity signals:

• Switching browser tabs, loss of window focus, and exiting full-screen mode.
• Copy, cut, paste and right-click actions within the assessment window.
• Opening browser developer tools.
• The presence of multiple displays.
• Camera-derived signals: face present or absent, more than one face in view, gaze directed away from the screen, and detection of objects such as a phone or written notes.
• A computed integrity or risk score, a verdict, and a summary of the flags raised.

Candidates are informed before an assessment or interview begins which of these features are active. Integrity results are provided to the employer for human review; HireXA does not use them to make an automatic hiring decision.

6. The HireXA Resume Bank

In addition to the candidates an employer collects in their own workspace, HireXA maintains a curated talent database (the "HireXA Resume Bank"). Resumes in this database are converted into text summaries and mathematical representations (embeddings) that allow them to be matched against open roles by semantic similarity.

Where an employer has enabled it, candidates in the Resume Bank may be matched to that employer's open roles and added to the employer's candidate pipeline for consideration. This means a candidate may be surfaced to an employer they did not apply to directly. Resumes an employer uploads into their own resume pool are kept separate and scoped to that organisation; they are not shared with other organisations.

Gsure Technologies acts as the data fiduciary for the HireXA Resume Bank. If you do not want to be included, contact hello@hirexa.ai and we will remove your profile and its derived representations from the Resume Bank.

7. Google services and Google user data

HireXA may integrate with Google services to provide functionality such as authentication and the sending of recruitment-related emails. For example, employers may optionally connect a Google mailbox so that interview invitations, assessment links, notifications and other recruitment communications are sent from their own email address.

Gmail integration

Where a user connects Gmail for email sending, HireXA requests only the permissions necessary to perform that functionality. For Gmail sending, HireXA uses the gmail.send scope, and uses that permission solely to send emails initiated by the user through HireXA.

HireXA does not use this permission to:

• Read your Gmail inbox or any unrelated email message.
• Download your Gmail mailbox.
• Modify or delete your emails.
• Create advertising profiles, sell Google user data, or use Google user data for advertising.

OAuth credentials and tokens associated with a connected mailbox are stored securely and are used only to provide the functionality the user has authorised. You may disconnect the integration or revoke HireXA's access at any time.

8. Microsoft integration

Users may sign in with Microsoft, and may optionally connect a Microsoft mailbox so that recruitment communications are sent from their own address. For sending, HireXA requests the Microsoft Graph Mail.Send permission, together with the sign-in and offline-access permissions needed to identify the account and to keep the connection active without asking you to sign in repeatedly.

HireXA uses these permissions solely to send emails you initiate through HireXA. HireXA does not read, download, modify or delete the contents of your Microsoft mailbox. Tokens are stored securely and the integration can be disconnected at any time from your HireXA settings, or revoked from your Microsoft account.

9. LinkedIn integration

Users may sign in with LinkedIn, and may connect LinkedIn so that job postings created in HireXA can be published to LinkedIn. Where you connect LinkedIn, HireXA requests permission to read your basic profile information and to post content on your behalf, either to your own LinkedIn feed or, where you administer a company page and grant the additional permission, to that company page.

HireXA uses this permission solely to publish job postings that you create and approve in HireXA. HireXA does not read your LinkedIn messages, connections or feed, and does not post anything you have not initiated. You may disconnect LinkedIn at any time, and may revoke access from your LinkedIn account settings.

10. WhatsApp and Meta integrations

HireXA may provide WhatsApp-based recruitment communications through the WhatsApp Business Platform and related services provided by Meta Platforms, Inc. and/or authorised communication providers. Depending on the functionality enabled by an employer or recruiter, HireXA may use WhatsApp to send interview and assessment invitations, reminders, rescheduling notifications, application-related updates and other transactional recruitment communications.

When WhatsApp is used, information such as candidate name, phone number, message content, message delivery status, communication timestamps, WhatsApp account identifiers and other information necessary to deliver the communication may be processed by Meta and/or the relevant WhatsApp Business service provider in accordance with their respective privacy policies and terms.

HireXA does not use WhatsApp communications to independently create advertising profiles for candidates. Employers and recruiters using HireXA are responsible for ensuring that they have an appropriate legal basis and, where required, candidate consent to send recruitment communications through WhatsApp.

11. Other third-party service providers

HireXA relies on third-party platforms and service providers to deliver specific functionality. Depending on the services enabled, these may include providers in the following categories:

• Cloud infrastructure and storage. Hosting, databases, file storage for resumes, photographs, recordings and documents.
• Authentication and email. Google, Microsoft and standard SMTP email delivery.
• Messaging. WhatsApp Business Platform providers, including Meta and authorised communication providers.
• Professional networks and search. LinkedIn, and web-search providers used to identify publicly available candidate profiles.
• AI and machine-learning providers. Large-language-model providers used for resume screening, question generation, interview conduct and evaluation; speech-to-text providers used to transcribe candidate speech; text-to-speech providers used to generate the AI interviewer's voice; and embedding providers used for semantic resume matching.
• Face comparison. A cloud face-comparison service used for the identity verification described in section 4.
• Code execution. A sandboxed code-execution service used to run and grade candidate coding submissions.
• Real-time media. Media relay and conferencing infrastructure used to carry live interview audio and video.
• Location services. A geocoding provider used to power location autocomplete.
• Analytics, monitoring and security. Application performance, error and security monitoring.

We share information with these providers only to the extent reasonably necessary to provide, maintain, secure or improve the relevant HireXA functionality, and under contractual or other appropriate safeguards. We do not provide candidate personal information to AI providers for the purpose of training their general-purpose models, and we do not sell personal information.

Some in-browser components, such as the on-device vision models used for proctoring, may be loaded from a public content delivery network. Where that happens, the CDN receives standard request information such as your IP address.

12. How we use information

To provide the HireXA platform

• Create and manage accounts, workspaces, teams and roles.
• Create job descriptions, job postings and requisitions.
• Source, match, de-duplicate and manage candidates and recruitment pipelines.
• Conduct assessments and AI-assisted interviews, and generate interview links.
• Schedule interviews, manage slots and handle rescheduling.
• Generate candidate evaluations, scorecards and integrity reports.
• Generate and issue offer letters and collect onboarding documents.
• Facilitate recruiter-candidate communications.

Communications

We may use contact information to send account notifications, interview and assessment invitations, reminders, rescheduling notifications, candidate updates, security notifications and other service-related communications. Where a recruiter connects their own email or messaging account, communications may be sent through that connected service.

Security and fraud prevention

We may use technical and account information to protect HireXA against unauthorised access, detect suspicious activity, prevent fraud and abuse, maintain platform security and investigate security incidents.

Service improvement

We may use appropriate information to troubleshoot technical issues, monitor system performance, improve reliability, develop and improve HireXA features, and analyse aggregated or de-identified usage patterns.

13. AI, automated processing and automated decisions

HireXA uses artificial intelligence and machine-learning technologies to support recruitment workflows. Depending on the features enabled by an employer, AI may be used for resume screening and matching, assessment and question generation, conducting AI interviews, transcription, analysis of candidate responses, evaluation, scorecard generation and recruitment insights.

Some steps operate automatically, based on settings the employer configures. These may include:

• Automatically shortlisting or advancing candidates whose resume-match score exceeds a threshold set by the employer, and de-prioritising those who fall below it.
• Automatically flagging an assessment or interview session for integrity review.
• Applying a waiting period, configured by an employer, during which a previously rejected candidate may not reapply to that organisation or be re-surfaced for its new roles.
• Sending scheduled invitations, reminders and deadline notifications.

AI-generated outputs are intended to assist employers and recruiters, not to replace them. HireXA does not guarantee that AI-generated results are always accurate, complete or free from errors. Employers and recruiters remain responsible for making their own hiring decisions and for complying with applicable employment and anti-discrimination laws.

Candidates may request human review of an automated outcome, and may contact us or the relevant employer to understand the basis of a decision. HireXA does not make final hiring decisions.

14. How we share information

We do not sell personal information. We may share information in the following circumstances:

• With employers and recruiters. Candidate information may be shared with the employer, recruiter or hiring organisation associated with the relevant job application or recruitment process, including where a candidate has been matched to a role from the HireXA Resume Bank.
• With service providers. With the categories of providers described in section 11, to the extent needed to operate HireXA.
• With third-party integrations. Where a user explicitly enables an integration, information may be transferred to that service as necessary to provide the functionality.
• For legal reasons. Where reasonably necessary to comply with applicable law, respond to lawful requests, protect our rights or property, investigate fraud or abuse, protect the security of HireXA or its users, or prevent serious harm.
• Business transactions. If Gsure Technologies or HireXA is involved in a merger, acquisition, restructuring, financing, sale of assets or similar transaction, information may be transferred as part of that transaction, subject to applicable law.

15. Data retention

We retain information for as long as reasonably necessary to:

• Provide HireXA services and maintain user accounts and workspaces.
• Support and evidence recruitment processes.
• Meet contractual, legal and regulatory obligations, and resolve disputes.
• Maintain security and prevent fraud.

Employers and recruiters retain candidate information according to their own recruitment and data-retention policies, and may delete candidate records, recordings, photographs and documents from their workspace.

Retention applies to derived information as well as to source files. Where a resume is deleted at your request, the text summaries and embeddings derived from it are deleted with it.

If you disconnect a third-party integration such as a connected mailbox, HireXA stops using that integration and removes the associated access credentials and tokens.

When information is no longer required, we delete, anonymise or securely dispose of it, subject to applicable legal and operational requirements.

16. Data security

HireXA takes reasonable technical and organisational measures to protect information against unauthorised access, alteration, disclosure, loss or destruction. These include:

• HTTPS/TLS encryption for data transmitted to and from HireXA.
• Encrypted cloud storage for resumes, photographs, recordings and onboarding documents.
• Short-lived, expiring links for access to stored media rather than public URLs.
• Password hashing and signed, HTTP-only session cookies.
• Per-organisation data isolation, so one organisation's data is not visible to another.
• Role-based access controls and restricted access to production systems.
• Server-side enforcement of access rules, including rules governing who may view a candidate's contact details.
• Optional encryption at rest of candidate assessment answers.
• Secure handling of authentication tokens, monitoring and logging.

No internet-based service can guarantee absolute security, but we work continuously to protect your data and to limit access to it.

17. Your choices and rights

Depending on your location and applicable law, you may have rights relating to your personal information, including the right to:

• Request access to your personal information, and information about how it is processed.
• Request correction of inaccurate or incomplete information.
• Request deletion of your information, including removal from the HireXA Resume Bank and from HireXA candidate sourcing.
• Request restriction of, or object to, certain processing.
• Withdraw consent where processing is based on consent.
• Nominate another individual to exercise these rights on your behalf in the event of death or incapacity, where applicable law provides for this.
• Request human review of an automated outcome, as described in section 13.

You may also:

• Disconnect connected third-party accounts from your HireXA settings.
• Revoke Google, Microsoft or LinkedIn permissions from the relevant provider's account settings.
• Stop receiving certain communications, where applicable.
• Request deletion of your HireXA account.

To exercise any of these rights, contact hello@hirexa.ai. We will acknowledge your request and respond within the period required by applicable law, and in any event within 30 days. We may need to verify your identity before acting on a request. Some information may need to be retained where required by law or for legitimate business purposes.

If your request concerns information held inside a particular employer's workspace, we will forward your request to that employer and support them in responding, since they determine how that information is used.

18. Revoking third-party access

If you have connected your Google account to HireXA, you can revoke HireXA's access at any time through Google Account → Security → Your connections to third-party apps & services. Microsoft and LinkedIn access can be revoked from the equivalent settings in those accounts. Revoking access may prevent HireXA from providing functionality that depends on that integration.

19. WhatsApp communication preferences

If you receive recruitment communications through WhatsApp, your ability to stop those communications may depend on the employer, recruiter or communication workflow that initiated the conversation. Where applicable, you may request that the employer or recruiter stop further recruitment communications, and you may use any opt-out mechanism included in the relevant message.

20. Candidate privacy

HireXA is primarily a technology platform used by employers and recruiters to manage hiring. If you are a candidate, the organisation that invited you to apply, complete an assessment or participate in an interview generally determines what information is collected, why it is collected, how long it is retained, who within the organisation can access it, and how it is used in their recruitment process.

For questions regarding a particular job application, you may contact the employer or recruiter that invited you to HireXA. For questions about the HireXA platform itself, or about the HireXA Resume Bank and HireXA candidate sourcing, contact us directly.

21. Where your information is stored and processed

HireXA's primary infrastructure and file storage are hosted in India. Some of our third-party service providers, in particular AI, speech, messaging and search providers, process information in other countries, including the United States.

Where personal information is transferred internationally, we take reasonable measures designed to ensure that such transfers are handled in accordance with applicable privacy and data-protection requirements, including contractual safeguards with the relevant provider.

22. Children's privacy

HireXA is intended for use in professional recruitment and employment contexts by individuals who are 18 years of age or older. HireXA is not directed toward children, and we do not knowingly collect personal information from a child.

Where applicable law requires verifiable parental or guardian consent for the processing of a child's personal information, we do not knowingly process such information without it. If you believe that a child has provided personal information to HireXA, please contact us and we will take appropriate steps to delete it.

23. Cookies and similar technologies

HireXA uses cookies, local storage and similar technologies to keep users signed in, maintain sessions, remember preferences, provide security features, understand platform usage and improve performance. Signed-in sessions use a secure, HTTP-only session cookie with a limited lifetime, together with browser local storage for interface state.

HireXA does not use advertising cookies or third-party advertising trackers. You may be able to control cookies through your browser settings; disabling certain cookies will affect functionality such as staying signed in.

24. Grievance redressal and incident notification

If you have a complaint about how your personal information has been handled, you may contact us and we will route it to the person responsible for grievance redressal:

• Grievance redressal. Gsure Technologies Private Limited, Sector - 20, Panchkula, Haryana, India. Email: hello@hirexa.ai

We will acknowledge a grievance promptly and respond within the timeframe required by applicable law. If you are not satisfied with our response, you may have the right to escalate the matter to the relevant data-protection authority in your jurisdiction.

In the event of a personal data breach, we will notify the relevant supervisory authority and affected individuals where required by applicable law, without undue delay.

25. Changes to this Privacy Policy

We may update this Privacy Policy periodically to reflect changes to HireXA functionality, third-party integrations, applicable laws, security practices or data-processing practices. When we make material changes we will revise the "Last updated" date above and provide additional notice through the service where appropriate.

26. Contact HireXA

If you have questions about this Privacy Policy, want to exercise your privacy rights, or have questions about how your information is handled by HireXA, please contact us.

HireXA, operated by Gsure Technologies Private Limited
Website: https://hirexa.ai/
Email: hello@hirexa.ai

For matters specifically related to a job application, assessment or interview, candidates may also contact the employer or recruiter who initiated the recruitment process.