Privacy Policy

Who we are

CandidateRank (“we”, “us”, “our”) is a candidate-evaluation platform built for college placement cells in India. We operate the web application at this domain and all associated services described in this policy.

For the purposes of India’s Digital Personal Data Protection Act, 2023 (DPDP Act) we act as a Data Fiduciary. For the purposes of the EU/EEA General Data Protection Regulation (GDPR) we act as a Data Controller with respect to personal data processed through our platform.

Contact: privacy@candidaterank.in

Who this policy covers

This policy applies to two groups of people whose data we process:

• Institutional users: placement cell administrators, sub-admins, members, and recruiters who sign up to manage hiring drives.
• Candidates: students whose profiles are evaluated through the platform, either added by an institution or via the self-evaluation portal.

What data we collect

From institutional users (placement cell staff):

• Account information: name, institutional email address, role (admin / member / recruiter).
• Usage data: actions taken within the platform, recorded in an audit log for accountability.

From candidates added by an institution:

• Name and email address (stored encrypted at rest).
• GitHub username: used to fetch publicly available profile data via the GitHub API.
• LeetCode username: used to fetch publicly available problem-solving statistics.
• CGPA and academic scale (e.g. out of 10).
• Resume (PDF): uploaded by the institution on behalf of the candidate.

From candidates using the self-evaluation portal:

• The same fields above, submitted directly by the candidate.
• GitHub OAuth: optional identity verification that confirms a candidate owns the GitHub account they claim.

From third-party public APIs (fetched automatically upon evaluation):

How we use your data

AI and automated processing

CandidateRank uses artificial intelligence in two ways:

• Resume analysis: the text content of a candidate's resume is sent to a third-party LLM (Groq or Google Gemini) to extract structured information such as skills, internship history, projects, and achievements. The candidate's email address is never included in any AI prompt.
• AI Advisor: a recruiter can ask natural-language questions about a candidate pool. The advisor constructs answers from the candidates' already-structured profile data (not raw resume text). Email addresses are excluded from all advisor prompts.

No fully automated decisions. CandidateRank produces scores and ranked shortlists as recommendations. No hiring decision is made solely by automated means. A human recruiter or placement cell representative always makes the final shortlisting decision. Candidates have the right to request human review of any score that affects them.

Under GDPR Article 22, you have the right to object to automated processing that produces legal or similarly significant effects. Please contact us at privacy@candidaterank.in to exercise this right.

Third-party services and international transfers

We share personal data with the following third-party processors. Where data is transferred outside India or the EU/EEA we rely on Standard Contractual Clauses (SCCs) or the processor’s adequacy commitments.

We do not sell personal data to any third party. We do not use candidate data to train AI models.

Data retention

• Candidate profiles are retained for the duration of the hiring drive (evaluation session) they belong to. When an institution deletes a session or a candidate record, all associated data is permanently deleted.
• Institutional user accounts are retained while the account is active. Inactive accounts may be purged after 24 months of non-use following advance notice.
• Audit logs are retained for 12 months then permanently deleted.
• Resume files are deleted when the associated candidate record is deleted.

Your rights

Under the DPDP Act 2023 and GDPR, you have the following rights. Submit requests to privacy@candidaterank.in. We will respond within 30 days.

If you are in the EU/EEA and believe we have not handled your data lawfully, you have the right to lodge a complaint with your local supervisory authority.

Security

We implement appropriate technical and organisational safeguards, including:

• Candidate email addresses are encrypted at rest using AES-256 encryption.
• All data is transmitted over TLS (HTTPS).
• Access to the platform is protected by JWT-based authentication with email verification.
• Role-based access control ensures users can only access data within their institution.
• Audit logs record all significant actions for accountability.

No system is perfectly secure. In the event of a data breach that poses a risk to individuals, we will notify affected parties and the relevant regulatory authority within the timeframes required by applicable law.

Cookies and tracking

CandidateRank uses only functional cookies and browser local storage to maintain your login session. We do not use advertising cookies, cross-site tracking, or analytics that identify individuals.

Children

CandidateRank is not directed at children under 18. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected such data, contact us immediately and we will delete it.

Changes to this policy

We may update this policy periodically. Material changes will be communicated by email to institutional account holders and by a prominent notice within the platform at least 14 days before taking effect. Continued use of the platform after the effective date constitutes acceptance of the updated policy.

Contact and grievance officer

For any privacy-related questions, requests, or grievances:

• Email: privacy@candidaterank.in
• Response time: within 30 days of receipt.
• For unresolved grievances under the DPDP Act: Data Protection Board of India.
• For unresolved complaints under GDPR (EU/EEA users): your local supervisory authority.