Hirelyft Job Search App Privacy Policy

Platform: Hirelyft — Job Portal for Job Seekers and Employers

Website: https://hirelyft.in

App Package: com.hirelyft.mobile (Android)

Contact: support@hirelyft.in

Jurisdiction: India. This platform is governed by applicable Indian data protection laws.

The data we collect depends on whether you are a Job Seeker or an Employer.

A. All Users (Job Seekers & Employers)

• Phone number (required for registration and OTP verification)
• Email address (optional, used for notifications and password recovery)
• Password (stored as a bcrypt hash — never stored in plain text)
• Profile photo / avatar (uploaded by the user)
• Firebase Cloud Messaging (FCM) token (for push notifications)
• Device information: device model name, platform (Android/iOS/Web), app version
• Security data: last IP address, last user agent, login timestamps, failed login attempts
• Session tokens (JWT access token and refresh token, stored securely)
• Last active timestamp and app installation date (for engagement notifications)
• Referral code (if you referred someone or were referred)

B. Job Seekers (Additional Data)

• Full name, headline, professional summary
• Date of birth (required for age verification — must be 18+), gender (optional)
• Education level, college name, certifications
• Work experience (company names, job titles, dates, descriptions)
• Skills, languages spoken
• Current salary, expected salary, notice period
• Job preferences: preferred job type, location, industry, working hours, company size, employment mode (remote/hybrid/on-site), willingness to relocate
• Resume files (PDF, DOC, DOCX — up to 3 resumes stored; may be system-generated)
• Short videos (30–60 seconds) uploaded as professional introductions (video file, thumbnail, duration, resolution, file size, tags)
• Project portfolio (project titles, descriptions, URLs)
• Achievements and certifications
• Location data (used to find nearby jobs — collected only when you grant permission)
• Job application history (which jobs you applied to, dates, statuses)
• QR code profile card (generated for sharing; includes profile snapshot)
• Profile completion percentage and status
• Availability status (Available / Passive / Not Available)

C. Employers (Additional Data)

• Company name, tagline, description, logo
• Company type, size, industry, established year
• Company verification document number and type (GST Certificate, PAN Certificate, or Incorporation Certificate)
• Verification document file (uploaded for company verification)
• Social media links (LinkedIn, Twitter, Facebook, YouTube — optional)
• Job postings (title, description, salary range, requirements, location)
• Subscription plan and payment history (see Section 6)
• Candidate interaction data (profiles viewed, applications reviewed)

D. Communications Data

• Direct messages between job seekers and employers (stored on our servers)
• Support tickets and contact form submissions (including name, email, message)
• Company reviews written by job seekers
• Reports submitted about users or content

E. Automated / System Data

• Notification history (which notifications were sent, read status)
• Engagement trigger logs (system-generated events tracking onboarding steps: app installed, registration started, profile completion, resume upload)
• Profile view counts
• Short video engagement metrics (views, likes, shares)
• Block list (users you have blocked)

The Hirelyft Android app requests the following permissions. All permissions are requested only when the relevant feature is used — never on app launch.

Core Platform Operation

• Create and manage your account
• Authenticate your identity (OTP verification via phone/email)
• Match job seekers with relevant job listings
• Allow job seekers to apply for jobs and track application status
• Allow employers to post jobs, review applicants, and contact candidates
• Enable real-time messaging between employers and job seekers via WebSocket (Socket.IO)
• Generate and serve resumes (system-generated PDF with your profile data)

Notifications and Engagement

• Send push notifications (via Firebase FCM) for: job matches, application status updates, interview reminders, new messages, profile completion reminders
• Send automated re-engagement notifications based on user activity stages (e.g., if you installed the app but haven't completed registration)
• Send daily job opportunity notifications (at scheduled times)
• Send admin email reports (internal use)

Safety, Security, and Compliance

• Detect and prevent fraud, abuse, and unauthorized access
• Enforce rate limiting and account lockout after repeated failed logins
• Store IP address and user agent for security audit trails
• Verify employer company identity through document review
• Moderate short videos through a verification workflow
• Process block/report requests between users

Platform Improvement

• Analyze usage patterns to improve features
• Run internal admin reports on platform health
• Provide a chatbot assistant using stored conversation context

We never sell your personal data. We share data only in these specific circumstances:

Between Users on the Platform

• Job seekers applying for jobs: Your profile, skills, experience, resume, and short video are shared with the employer for the job you apply to
• Employer profiles: Company name, logo, description, and verified status are visible to job seekers browsing jobs
• Direct messaging: Messages are visible to both parties in the conversation
• Profile QR cards: If you share your profile QR card, anyone with the link can view your basic profile

Service Providers (Data Processors)

• Google Firebase: Push notifications (FCM), analytics
• Razorpay: Payment processing for employer subscriptions (see Section 6)
• SMS Gateway: OTP delivery for phone verification (phone number only)
• Cloud Hosting / Storage: Our servers that store your data, subject to confidentiality agreements

Legal Requirements

• When required by applicable Indian law, court order, or government authority
• To protect the rights, safety, and security of Hirelyft, its users, or the public

Business Transfers

• In the event of a merger, acquisition, or asset sale, data may be transferred. You will be notified via the app or email before this occurs.

Hirelyft uses Razorpay as its payment gateway for employer subscription plans. We want to be transparent about how payment data is handled:

• We do not store full credit/debit card numbers, CVV, or bank account credentials on our servers
• All card and banking data is handled directly by Razorpay's PCI-DSS compliant infrastructure
• We store only: Razorpay Order ID, Razorpay Payment ID, payment signature, payment status (pending/completed/failed/refunded), payment method type, and transaction timestamps
• This data is used for subscription management, billing disputes, and audit purposes
• Razorpay's Privacy Policy applies to payment processing: razorpay.com/privacy

We implement the following security measures:

• Password hashing: All passwords are hashed with bcrypt (salt rounds: 10) — never stored in plain text
• Password history: We store hashed versions of your last 5 passwords to prevent reuse
• JWT authentication: Secure access tokens and refresh tokens with expiry
• Two-Factor Authentication (2FA): Optional 2FA available for additional account security
• Account lockout: Accounts are temporarily locked after repeated failed login attempts
• TLS/SSL: All data in transit is encrypted using HTTPS
• Secure storage: Sensitive tokens on Android are stored using Flutter Secure Storage (Android Keystore)
• Network security: Cleartext HTTP traffic is disabled in the Android app (usesCleartextTraffic="false")
• Input sanitization: All user inputs are sanitized and validated server-side
• Rate limiting: API rate limiting is applied to prevent abuse
• CSRF protection: CSRF token validation for web requests

While we implement industry best practices, no system is 100% immune from breaches. If you suspect unauthorized access to your account, contact us immediately at support@hirelyft.in.

You have the following rights over your personal data:

• Access: Request a copy of all personal data we hold about you
• Correction: Update your profile data at any time from within the app
• Deletion: Request permanent deletion of your account and all associated data
• Portability: Request your data in a structured, portable format
• Opt-out of notifications: Disable push notifications from Settings in the app or from your Android device notification settings
• Withdraw consent: You may withdraw previously given consent at any time (this does not affect prior lawful processing)
• Block users: Block other users from messaging or viewing your profile
• Report users: Report abusive users or content through the in-app report feature

Hirelyft is a professional job portal intended exclusively for users aged 18 years and older. We collect date of birth during registration and use it to verify that users meet the minimum age requirement.

We do not knowingly collect personal information from anyone under the age of 18. If we discover that a minor has created an account, we will immediately delete their account and all associated data.

If you are a parent or guardian and believe your child has registered on Hirelyft, please contact us immediately at support@hirelyft.in.

Hirelyft integrates with the following third-party services. Each is governed by their own privacy policies:

Links to third-party privacy policies:

• Firebase: firebase.google.com/support/privacy
• Razorpay: razorpay.com/privacy
• Google: policies.google.com/privacy

Our website (hirelyft.in) and Android app use the following data storage mechanisms:

• HTTP Cookies: Used for session authentication (HttpOnly, Secure flags applied)
• Flutter Secure Storage: Authentication tokens on Android are stored in the Android Keystore via Flutter Secure Storage — not accessible to other apps
• Shared Preferences: Non-sensitive app settings (e.g., notification preferences, locale) stored locally on your device
• Firebase Analytics: Anonymized usage events collected to understand feature usage

You can clear cookies and app data from your Android device's Settings at any time. Note that clearing app data will log you out of the app.

We may update this Privacy Policy as our platform evolves. When we make material changes:

• The "Last Updated" date at the top of this page will be updated
• A push notification or in-app banner will inform active users
• Where required by law, we will obtain fresh consent before processing your data under the new terms

We encourage you to review this page periodically. Your continued use of Hirelyft after changes are posted constitutes acceptance of the updated policy.