Privacy Policy

Who we are

HrThroo is a product of Brandstac Private Limited (CIN U73100DL2026PTC470130), 5/36, 2nd Floor, Lajpat Nagar 4, New Delhi 110024, India (“Brandstac”, “we”).

Who is responsible for which data

Candidates. When a recruitment agency or an employer uses HrThroo, that organisation decides why and how its candidates' data is processed. Under India's Digital Personal Data Protection Act, 2023 (DPDP Act) it is the Data Fiduciary, and Brandstac processes the data on its behalf, as its Data Processor. If you applied for a job through HrThroo, the organisation you applied to is responsible for your data, and your requests go to them first.

Our customers and visitors. For the accounts of people who use HrThroo, billing, and people who visit this website or write to us, Brandstac is the Data Fiduciary.

What we collect

About candidates, on behalf of our customers

• CVs and what they contain, uploaded by the recruiting team, imported by CSV, or submitted through a job's apply page.
• Contact details: name, email address and phone number.
• Recordings and transcripts of AI phone screens and AI video interviews, and the answers drawn from them. Video interviews are evaluated only on what was said.
• Screening results, the recruiting team's decisions and notes, and feedback from the team's clients on shortlists.
• Consent records: when a candidate agreed to be called or interviewed, and any opt-out.
• Emails exchanged with the candidate through the recruiter's connected mailbox.

About our customers

• Name, work email, workspace and role, sign-in records and settings. Passwords are stored only as secure hashes.
• Connected mailbox and telephony credentials, encrypted (see Security below).
• Plan, payments and invoices. Card and bank details are handled by Razorpay and never reach us.
• Records of actions in the workspace, such as decisions and shortlist links created and revoked.

About visitors

• What you send us by email or through the privacy request form.
• Necessary cookies only (see the Cookie Policy). We run no analytics or advertising trackers.

Why we use it

• To run the hiring process our customer set up: screening CVs against the criteria the customer approved, placing consented phone screens and video interviews, sending emails from the recruiter's mailbox, and sharing shortlists with the customer's clients.
• To provide and secure the service: accounts, sign-in, support, preventing abuse and keeping an audit trail.
• To bill: plans, usage of CV screenings and call and interview minutes, invoices and tax records.
• To meet legal obligations, and to answer rights requests and grievances.

AI, and the decisions people make

HrThroo uses AI to propose screening criteria, to compare CVs against the criteria a person approved, to hold phone screens and video interviews, and to summarise answers. The AI recommends; a person on the recruiting team makes every decision about a candidate. No candidate is rejected, shortlisted or hired by the AI.

Every AI recommendation quotes the CV or transcript it relied on, and a claim the CV doesn't support is marked as insufficient evidence. HrThroo does no facial analysis, emotion detection or appearance scoring of any kind.

AI phone screens are placed only to candidates who agreed, only between 10:00 and 19:00 IST, from the customer's own phone number. The AI says that it is an AI and that the call is recorded, and a candidate who says “stop” is not called again.

Candidate data is never used to train AI models, to build datasets, or for marketing.

Who else handles it

We don't sell personal data. Service providers process it only to run HrThroo, each receiving only what its job needs: hosting, the database, file storage, email, payments, AI models, speech, real-time calling and queues. They are listed, with what each receives and where, on the Subprocessors page. The customer's own email and telephony providers carry the emails and calls the customer sends, under the customer's own agreements with them.

Where it is processed

The HrThroo database is hosted in Mumbai, India. Some providers, including AI model providers reached through OpenRouter, process data outside India, for example in the United States. We transfer data only to providers listed on the Subprocessors page, and not to any country the Government of India restricts under the DPDP Act.

How long we keep it

• Candidate data, including CVs, recordings and transcripts, is deleted 12 months after the last application it relates to closes, unless the workspace sets a shorter period. A customer can delete a candidate sooner at any time.
• Workspace data is kept while the workspace is active, and deleted when the workspace is deleted.
• Billing records are kept as long as tax and accounting law requires, even after a workspace is deleted.
• Rights requests and consent records are kept as long as we need them to show what was asked and what we did.

Security

Data is encrypted in transit. Mailbox and telephony credentials are encrypted at rest with a key held outside the database, and are never sent to a browser. Each workspace is isolated from every other, access within a workspace follows each member's role, and shortlist links for clients expire, can be revoked and record every open. More on the Security page. If a personal data breach occurs, we will inform the affected customers, and the Data Protection Board of India and affected people as the DPDP Act requires.

Your rights

Under the DPDP Act you can:

• ask what personal data is processed about you, and with whom it has been shared;
• have it corrected, completed or updated;
• have it erased, where it is no longer needed and the law doesn't require us to keep it;
• withdraw consent you gave, as easily as you gave it;
• nominate someone to exercise these rights for you if you die or become unable to;
• raise a grievance and have it answered.

Make a privacy request, or email privacy@hrthroo.com. If you are a candidate, the organisation you applied to decides about your data in its workspace: we will pass your request to them and tell you we have, and help them answer it. Withdrawing consent to calls or interviews stops them from then on; it does not undo what happened before.

Children

HrThroo is not intended for anyone under 18. Customers must not use it to process children's data, and we do not knowingly do so.

Grievance Officer

Our Grievance Officer is Lakshay Handa, reachable at privacy@hrthroo.com or by post at Brandstac Private Limited, 5/36, 2nd Floor, Lajpat Nagar 4, New Delhi 110024, India. If your grievance isn't resolved, you may complain to the Data Protection Board of India.

Changes

Each version of this policy is numbered and dated, with a line below saying what changed. We announce material changes to customers in the app and by email before they take effect.

What changed

• 2026-11-01: First published.