Your data, handled with care.

Gradii is an AI hiring platform operated by Manjari Technologies Private Limited ("Gradii", "we", "us"), 316, Neelkanth Corporate Park, Vidyavihar West, Mumbai, Maharashtra, India. This policy covers gradii.ai, the Gradii app, our APIs, Iris voice calls, WhatsApp messages and background verification (Gradiify).

Our role depends on whose data it is:

From our customers and their users

• Account details: name, work email, phone number, company, role, and sign-in data such as password hashes, two-factor secrets and single sign-on identifiers
• Billing details: company name, GSTIN, billing address and payment status. Card details are handled by our payment provider; we never see or store them
• Support and sales correspondence, and anything you send us through forms such as the demo booking form

About candidates, on behalf of employers

• Applications and profiles: name, contact details, resume, work and education history, answers to application questions, and applications received through careers pages, LinkedIn or a connected HRMS
• Assessments and interviews: answers as audio, video, text and code, transcripts, scores, the AI's reasoning and summaries
• Iris voice calls: phone number, call audio, transcript, call score and the language used
• Interview integrity: a reference photo, face-match scores from live camera frames, a face embedding (a list of 128 numbers, not an image, computed in the candidate's own browser) and browser events such as leaving the interview tab or pasting text
• Background verification, only with the candidate's consent: documents shared through DigiLocker, PAN, bank account number and IFSC, provident fund (UAN) details, past employment details, a selfie and face match where identity verification is enabled, sanctions, PEP and adverse-media screening results, and the IP address used. See our background verification terms
• Messages: emails, WhatsApp messages and calendar invitations sent to candidates

Collected automatically

• Server and security logs: IP address, browser and device details, pages and API endpoints requested, and timestamps
• Session cookies and a few local-storage preferences (see section 11)

From other sources

• DigiLocker and the issuing authorities behind it, when a candidate chooses to share documents
• Cashfree, which confirms PAN and bank-account details
• Public professional profiles, when a recruiter searches the Global Pool
• HRMS and other systems a customer connects to Gradii, such as uKnowva

• To provide the service: sourcing, screening, interviews, voice calls, messaging, background checks, reports and the API
• To keep accounts and the platform secure, and to detect fraud and misuse
• To bill customers and meet tax and accounting obligations
• To support customers and answer enquiries
• To improve Gradii, using usage patterns and feedback. We do not use candidate data or customer content to train foundation models
• To send service messages, and, to customers only, product updates they can opt out of
• To meet legal obligations, such as CERT-In reporting and responding to lawful requests

We do not sell personal data, and we do not use candidate data for advertising.

• Gradii uses AI to read resumes, ask interview questions, hold screening calls, score answers and summarise interviews.
• Scores are recommendations for the hiring team. An employer can also set thresholds that move candidates between stages automatically, including out of the process. Every automatic change is recorded with its score and reason, and the hiring team can reverse it.
• Gradii does not ask for protected characteristics such as gender, religion, caste, age, disability or ethnicity, and does not score them. It does not infer emotions, personality or honesty from a face or voice.
• Integrity checks such as face matching only raise flags for a person to review. They never reject anyone on their own.
• We do not train or fine-tune AI models on customer or candidate data.

If you are a candidate and think an automated outcome was wrong, ask the employer for a human review. If you can't reach the employer, write to team@gradii.ai and we'll pass your request on. Our AI in Hiring Transparency Notice in the Trust Vault explains each step in detail.

For candidate data, the employer chooses the legal basis. Under India's Digital Personal Data Protection Act, 2023 that is usually consent or a legitimate use. Under the GDPR it is usually steps taken at the candidate's request before a contract, the employer's legitimate interest, or consent. Background checks and biometric checks always rely on the candidate's consent.

For the data where we decide, we rely on:

• Contract: to provide the service to our customers and their users
• Legal obligation: billing records, tax law and CERT-In log retention
• Legitimate interest or legitimate use: security, fraud prevention and improving the service
• Consent: for example, marketing emails and the demo booking form. You can withdraw consent at any time

We share personal data only with:

• The employer, for candidate data it collected through Gradii
• Sub-processors that help us run the service, listed below, each under a written contract that limits how they use the data
• Authorities, when the law requires it
• A buyer or successor, if Gradii is involved in a merger or acquisition, under the same protections

Customers on our Data Processing Addendum get 30 days' notice before a new sub-processor receives their data. The current list is always in the Trust Vault.

Our database and servers are in Bengaluru, files in Azure Central India (Pune), and our cache in AWS Mumbai. Some AI, speech, messaging and verification providers process data outside India while handling a request, as shown in the table above.

For candidates in the EU, EEA or UK, transfers rely on the European Commission's Standard Contractual Clauses (2021) and the UK Addendum in our Data Processing Addendum. We will follow any restriction the Government of India notifies under section 16 of the DPDP Act.

We keep data only as long as its purpose needs it. Employers can shorten the defaults for candidate data, and can delete candidates at any time.

Automatic deletion of interview data and background-check reports at the end of the default period is still being built. Until it ships, we delete that data on request and in a quarterly review. When a customer leaves, it can export its data for 30 days, and we delete its workspace data within a further 30 days.

• Encryption in transit (TLS 1.2 or higher) and at rest (AES-256)
• Primary data stores hosted in India, with backups and point-in-time recovery
• Role-based access, two-factor authentication and single sign-on for customers; key-only access to our servers
• Resumes, recordings and documents in private storage, reached only through short-lived signed links
• Interview recordings hashed when they are captured, so later edits are detectable
• Security logging, rate limiting and a written incident response plan

Gradii is not yet SOC 2 or ISO 27001 certified. Our controls, and what is still in progress, are listed in the Trust Vault. To report a vulnerability, email team@gradii.ai with "Security" in the subject.

If a personal-data breach affects you, we will tell you and the authorities as the law requires. Under the DPDP Act that means informing the Data Protection Board without delay and filing a detailed report within 72 hours. Where we act for an employer, we tell the employer without undue delay, and within 48 hours.

Depending on where you live, you can:

• Ask for a summary of, or a copy of, the personal data we hold about you
• Ask us to correct, complete or update it
• Ask us to erase it, unless the law requires us to keep it
• Withdraw consent you have given. This stops further processing for that purpose but does not undo processing already done
• Ask for a human to review an automated decision, and contest it
• Nominate someone to exercise your rights if you die or become unable to
• Complain to the Data Protection Board of India, or to your local data protection authority

Write to team@gradii.ai. We may ask you to confirm your identity, for example with a code sent to your email. We respond within 30 days. Candidate requests go to the employer that holds the data; if one reaches us, we pass it on within 5 business days and help the employer respond.

gradii.ai uses only what it needs to work. We do not use advertising or cross-site tracking cookies.

Gradii is a hiring platform for adults. We do not knowingly process data about anyone under 18. If we learn that we have, we delete it.

We update this policy when our practices or the law change. The date at the top shows the latest version. If a change is significant, we tell customers by email or in the app before it takes effect.

Grievance Officer

Himanshu P Bohra

Email

team@gradii.ai

Post

Manjari Technologies Private Limited, 316, Neelkanth Corporate Park, Vidyavihar West, Mumbai, Maharashtra, India

Response time

Acknowledged within 3 business days; resolved within 30 days

If you are not satisfied with our response, you can complain to the Data Protection Board of India once its complaints process is open, or to your local data protection authority.