Privacy Policy

This Privacy Policy explains how Imagnify Innovations handles personal data in connection with ImyHR’s websites, accounts, recruitment screening service, support and billing (collectively, the Service).

For account, website, billing, security and support information, Imagnify Innovations decides why and how the information is used and acts as the data controller or data fiduciary. For CVs, candidate records, role criteria, recruiter notes and similar information submitted by a customer, the customer decides the purpose and means of processing. ImyHR processes that Customer Data on the customer’s instructions as its processor or service provider.

If you are a candidate or worker whose information was submitted by an ImyHR customer, contact that organisation first. It is best placed to explain the recruitment purpose and act on your request. We will support our customer in responding where required.

Depending on how you use ImyHR, we may process:

• Account and workspace data: name, work email, password credentials managed by our authentication provider, organisation name, role, permissions and invitations.
• Candidate and recruitment data: CV files and extracted text, contact and career details, qualifications, skills, experience, role criteria, screening scores, generated summaries, recruiter notes, feedback and decision status.
• Billing data: plan, seats, transaction and subscription identifiers, payment status, invoices, tax information and limited payment metadata. Payment card and bank details are collected by Razorpay; ImyHR does not receive full card details.
• Usage and device data: actions taken in the Service, credit usage, feature interactions, timestamps, IP address, device or browser information, diagnostic events and security logs.
• Communications: support requests, feedback, survey responses and messages you send us.
• Cookie data: authentication, session and workspace-selection identifiers described in our Cookie Policy.

Please do not submit government identifiers, financial details, health information, biometric data, information about children, or other highly sensitive data unless it is genuinely needed, lawful, and covered by appropriate safeguards and notices.

We receive information directly from account users; from their organisation and invited team members; from CVs and other files uploaded by customers; automatically from devices and use of the Service; from payment, authentication and infrastructure providers; and from a candidate or authorised recruitment source selected by the customer. We do not purchase candidate databases.

We use personal data to:

• create, authenticate and administer accounts and workspaces;
• extract CV information, run customer-configured screening and generate reports;
• provide collaboration, exports, support and service communications;
• process subscriptions, credits, invoices, cancellations and payment events;
• secure the Service, prevent fraud and abuse, investigate incidents and keep audit logs;
• maintain, troubleshoot, measure and improve performance and reliability;
• send product or marketing communications where permitted, with an opt-out where required;
• comply with law, enforce our agreements and establish or defend legal claims; and
• create aggregated or de-identified insights that do not reasonably identify a person.

Our legal grounds depend on the context and applicable law. They may include performing a contract, taking requested pre-contract steps, complying with legal obligations, consent, and legitimate uses or interests that are not overridden by a person’s rights. When a customer provides candidate information, we rely on that customer’s lawful instructions and do not independently decide whether the candidate should be screened.

ImyHR uses configured artificial-intelligence providers to help parse CVs, compare job-related information with customer-supplied criteria, and produce scores, explanations and summaries. Candidate information and role criteria may be sent to those providers only to perform the requested operation and under service-provider terms.

AI output is probabilistic and can be inaccurate or reflect bias in source information or role criteria. ImyHR is designed to support human review; it does not make the final employment decision. Customers must review outputs, use job-relevant criteria, provide any legally required notices, and offer human consideration or challenge mechanisms where applicable.

We may share personal data with:

• authorised users in the relevant customer workspace, according to their permissions;
• hosting, database, storage, authentication, communications, monitoring, AI and customer support providers that process data for us;
• Razorpay and associated financial institutions for payment and subscription processing;
• professional advisers, auditors, insurers and prospective transaction counterparties under appropriate confidentiality duties;
• authorities or other parties when reasonably necessary to comply with law, protect rights and safety, prevent fraud, or respond to valid legal process; and
• a successor in connection with a merger, financing, reorganisation or sale of relevant business assets.

We do not sell personal data, rent candidate lists, or share personal data for cross-context behavioural advertising. Service providers may use data only for the contracted service and their own legal compliance, subject to applicable terms and law.

Our providers and their support teams may process information in countries other than the one where it was collected. Where applicable law requires, we use recognised transfer safeguards, contractual protections and provider due diligence, and we follow any government restrictions on transfers. Because provider locations can change, contact us if your organisation needs current processing-location or contractual information before using the Service.

We keep personal data only as long as reasonably needed for the purposes above, the customer’s instructions, and legal, security and dispute-resolution requirements. ImyHR applies these retention periods across the Service:

• original uploaded CV files: 14 days from upload, after which the stored file is deleted;
• candidate records: 365 days from creation, after which the candidate record is permanently erased — including the extracted CV text, screening scores, recruiter decisions and reviewer feedback held against it.

These periods are set by ImyHR and apply to every workspace. They are not currently configurable by customers; a customer who needs a different period should contact us.

Erasure is automatic and permanent. When a candidate record reaches the end of its retention period it is deleted, and the screening results, recruiter decisions and reviewer feedback attached to it are deleted with it. What remains is a record that an erasure took place — the date, the workspace, and an identifying label — which we keep so that a customer can demonstrate the erasure happened. Account, subscription, transaction, security and support records may be kept longer where needed for tax, accounting, fraud prevention, enforcement or legal claims. Backups and logs may take additional time to cycle out.

Deleting data from ImyHR does not delete copies a customer exported, emailed or stored elsewhere. That customer controls those copies.

We use technical and organisational measures designed to protect personal data, including access controls, tenant separation, encrypted transport, protected provider credentials, logging and restricted administrative access. No system is completely secure. Customers should use unique passwords, keep accounts and devices protected, assign least-privilege roles, and notify us promptly of suspected misuse.

Depending on applicable law and our role, you may have the right to request access to a summary of your personal data and sharing, correction or completion of inaccurate data, deletion, withdrawal of consent, restriction or objection, portability, and grievance redressal. You may also have the right to nominate another person to exercise rights in the event of death or incapacity, and to complain to the relevant data-protection authority.

For candidates: your CV was uploaded to ImyHR by an employer, and that employer decides how it is used — so a request about your data is made to them, not to us. ImyHR gives every employer two controls for this, which they can use without contacting us: a complete copy of everything held about one candidate — contact details, extracted CV text, screening scores and the decisions recorded — and permanent erasure of that record. If you do not know which employer holds your CV, or an employer does not respond, contact us at the address below and we will help you identify and reach them.

Account users can update some information in the Service. For other requests, email support@imagnifyinnovations.com. Tell us the relevant account or workspace and the right you wish to exercise. We may verify identity and authority, and may retain or refuse information where law permits or requires. Withdrawing consent does not affect processing already lawfully completed, but it may prevent a requested feature from working.

Candidates should normally submit requests to the organisation that collected or uploaded their information. If you cannot identify or reach that organisation, contact us and provide enough context to locate the correct customer without sending additional sensitive data.

We send transactional messages needed to operate the Service, such as account confirmation, security, billing and material policy notices. You cannot opt out of necessary service messages while keeping an active account. Marketing messages, if sent, will include an unsubscribe method.

ImyHR currently uses cookies and similar storage necessary for sign-in, security and workspace selection. Our Cookie Policy gives more detail and will be updated before we introduce non-essential analytics or advertising cookies.

ImyHR is a business recruitment service and is not directed to children. Account users must be at least 18. Customers must not use ImyHR to process children’s personal data unless the activity is lawful, necessary, covered by appropriate consent or authority, and agreed with us in advance. If you believe a child has created an account or data was submitted improperly, contact us.

If we confirm a personal-data breach affecting data for which we are responsible, we will take reasonable containment and remediation steps and provide notifications required by applicable law. Where we process Customer Data for a customer, we will notify and assist that customer so it can meet its own obligations. Notices may be staged as facts become available.

We may update this Policy as the Service, providers or law changes. We will post the revised version with a new effective date and give reasonable notice of material changes.

Imagnify Innovations is the privacy and grievance contact for ImyHR. Email support@imagnifyinnovations.com with the subject “Privacy request” or “Privacy grievance.” We will acknowledge and address the matter within the period required by applicable law. Nothing in this process limits your right to approach a competent regulator or authority.