Privacy Policy

1.Who we are

HYRIXAI (the “Platform,” “we,” “us,” or “our”) is an AI-assisted recruiting and applicant tracking system operated by Loop Methods. This Privacy Policy explains how we process personal data when candidates apply to jobs, when recruiters evaluate applicants, and when you otherwise interact with the Platform.

For the purposes of the EU General Data Protection Regulation (“GDPR”) and India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”), Loop Methods acts as a controller / data fiduciary for candidate account data, and as a processor / data processor on behalf of employer customers for candidates who apply to those employers’ jobs.

2.Data we collect

Depending on how you use the Platform, we may collect:

• Identity & contact data — name, email address, phone number, and account credentials.
• Application data — your resume/CV, work history, education, skills, portfolio links, and any information you submit in application forms.
• Assessment & screening data — answers to prescreen questions, assessment responses, and AI-generated scores and evaluations derived from them.
• Voice & recording data — audio from AI voice prescreens and interviews, and, where you provide consent, webcam and screen recordings captured during prescreens, interviews, and proctored assessments.
• Technical data — IP address, device and browser information, and usage logs collected automatically when you use the Platform.

You are not required to provide special-category / sensitive personal data, and we ask that you do not include it in free-text fields or uploaded documents unless necessary.

3.How we use your data

We use personal data to:

• Create and manage candidate and recruiter accounts.
• Match candidates to jobs and enable employers to review applications.
• Run AI resume scoring and structured evaluations that rank and summarize candidate fit against a role’s requirements.
• Conduct AI voice prescreens and interviews and, with consent, record webcam and screen activity for integrity and quality purposes.
• Communicate with you about applications, stages, and outcomes.
• Secure the Platform, prevent fraud and cheating, and comply with legal obligations.

4.AI-assisted decision-making

The Platform uses artificial intelligence to score resumes, summarize screening responses, and rank candidates. These outputs are decision-support tools intended to assist human recruiters. AI scores and recommendations may be inaccurate or incomplete and should not be treated as the sole basis for a hiring decision.

Where automated processing produces a legal or similarly significant effect on you, you have the right not to be subject to a decision based solely on automated processing, to request meaningful human review, to express your point of view, and to contest the outcome. To exercise these rights, contact us at privacy@hyrixai.com.

5.Legal basis for processing

Under the GDPR, we rely on one or more of the following legal bases:

• Consent — for optional processing such as webcam/screen recording during screening.
• Performance of a contract — to operate your account and process your applications.
• Legitimate interests — to secure the Platform and improve our services, balanced against your rights.
• Legal obligation — where processing is required by applicable law.

Under India’s DPDP Act, we process personal data on the basis of your consent or for legitimate uses permitted by the Act. You may withdraw consent at any time; withdrawal does not affect processing carried out before withdrawal.

6.Third-party processors & sub-processors

We use trusted third-party service providers to deliver the Platform. These may include cloud hosting and storage providers, voice-AI providers (which process call audio to conduct AI prescreens and interviews) and large language model (LLM) providers (which process resume and screening text to generate scores and summaries). These providers process personal data on our instructions under contractual confidentiality and security obligations. A current list of sub-processors is available on request from privacy@hyrixai.com.

7.International data transfers

Your personal data may be processed in countries outside your own, including outside the EEA or India. Where we transfer data internationally, we rely on appropriate safeguards such as Standard Contractual Clauses or an equivalent lawful transfer mechanism.

8.Data retention

We retain personal data only for as long as necessary for the purposes described in this Policy, including the duration of an active application and recruiting process, and for a reasonable period thereafter to meet legal, audit, and dispute-resolution requirements (target retention period: 24 months after an application or recruiting process closes). Voice, webcam, and screen recordings are retained for 12 months and then deleted or anonymized. You may request earlier deletion as described below.

9.Your rights

Subject to applicable law, you have the right to access your personal data, to correct inaccurate data, to request deletion, to restrict or object to certain processing, to data portability, and to withdraw consent. Under the DPDP Act you also have the right to nominate another individual to exercise your rights and the right to grievance redressal.

To exercise any of these rights, contact privacy@hyrixai.com. We will respond within the timeframe required by applicable law. If you are in the EEA/UK, you also have the right to lodge a complaint with your local supervisory authority. If you are in India, you may contact our Grievance Officer (below) and escalate to the Data Protection Board of India.

10.Cookies & tracking

We use cookies and similar technologies that are strictly necessary to run the Platform (for example, to keep you signed in) and, where required by law and with your consent, for analytics. You can control non-essential cookies through your browser settings or any cookie banner presented on the Platform.

11.Data security

We implement appropriate technical and organizational measures — including encryption in transit, access controls, and audit logging — to protect personal data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12.Children

The Platform is not intended for individuals under the age required to enter employment or to consent to data processing in their jurisdiction. We do not knowingly collect data from children below the applicable age of consent without verifiable parental consent as required by the DPDP Act.

13.Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified through the Platform or by email. The “Last updated” date above indicates when this Policy was last revised.

14.Google Workspace / Gmail data (email résumé intake)

Some employers using the Platform connect a Gmail or Google Workspace mailbox so that résumés emailed to that mailbox can be automatically ingested into their recruiting pipeline. This feature uses Google’s OAuth authorization and, specifically, the gmail.readonly scope.

• What we access: read-only access to the connected mailbox’s messages and attachments, limited to what is needed to identify candidate résumés sent to that mailbox (sender, subject, body, and attached files).
• Why: to detect incoming résumés, route them to the correct job posting, and create or update the corresponding candidate and application records in the Platform, so an employer’s recruiting team does not have to manually forward or upload each one.
• Who connects it: only an authenticated employer user with the appropriate role can initiate the Google OAuth connection for their organization or their own account; a candidate’s or any other third party’s Gmail account is never accessed.
• Storage & security: the OAuth token issued by Google is encrypted at rest and used solely by the Platform’s automated intake pipeline to periodically check the connected mailbox for new mail. It is never used to send email, never shared with unrelated third parties, and never used for advertising.
• Retention & revocation: the token is retained only for as long as the mailbox connection stays active. Disconnecting the mailbox in the Platform’s settings, or revoking access directly from your Google Account’s third-party access settings, immediately stops further access and deletes the stored token.

Our use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

15.Contact us

For privacy questions or to exercise your rights, contact us at:

• Privacy contact: privacy@hyrixai.com
• Grievance Officer (India, DPDP Act): grievance@hyrixai.com