Privacy, in plain language.

This policy explains how the ReferKaro beta web platform handles digital personal data. ReferKaro determines why and how the platform data described below is processed. A separate incorporated legal-entity name and postal grievance address were not found in the repository; until published, privacy requests may be sent to the email below.

We use data to create and secure accounts; verify work-email control and employment evidence; publish admin-approved listings; route applications and referrals; rank resume pools when an authorised employee requests it; process token payments; prevent fraud and abuse; troubleshoot the service; respond to rights requests; and meet legal obligations. Where consent is the applicable ground, it may be withdrawn as described below. Some records may still be retained where another lawful requirement applies.

Employment evidence may be analysed by an AI service to compare claimed name and company details. Resume ranking may assist an employee with a candidate pool. These outputs are recommendations, not employment decisions. Employment status and job publication remain subject to admin review, and candidates are reviewed by the referring employee or employer. Users may request manual employment review when automated verification is unsuccessful.

Data is shared only as needed with the user receiving a referral request and with service providers supporting hosting, authentication, database/storage, transactional email, monitoring, AI analysis, and payments. Current repository integrations include Vercel, Supabase, Resend, Google Gemini, Azure OpenAI, Razorpay, and Sentry. Provider use can vary by feature and environment. We may also disclose information when legally required or to protect users and the service.

Private resumes and verification documents are stored in access-controlled storage and served using short-lived signed links. Server-only credentials, role checks, row-level security, rate limits, audit logs, and encrypted transport are used as safeguards. Some processors may handle data outside India subject to their contractual and security arrangements and any government restrictions. No internet service can promise absolute security.

We keep data only while needed for the stated purpose, an active account or transaction, dispute handling, fraud prevention, or a legal requirement. OTP challenges expire after 10 minutes, although limited security metadata may remain temporarily. Signed document links expire quickly. Exact retention schedules for every record category are not found in the repository; ReferKaro must approve and publish a production retention schedule before general availability.

You may request access to a summary of your personal data, correction or completion, erasure where applicable, consent withdrawal, grievance resolution, and nomination of another person as allowed by applicable law. You may also request human review of employment verification. Send requests from your registered email to [email protected]. We may verify identity before acting. Withdrawing necessary processing may require account closure or prevent a feature from operating.

ReferKaro is designed for job seekers and working professionals aged 18 or older. Do not use the service or submit another person's data if you are under 18. If we learn that a child's data was submitted, we will restrict processing and assess deletion and any legally required guardian steps.

We maintain an incident-response process and will notify affected users and competent authorities when applicable law requires it. Raise a privacy grievance first at [email protected]. The Digital Personal Data Protection Board of India has been established; statutory complaint routes apply according to the phased commencement of the Act and Rules.

Material changes will be dated and presented for acknowledgement when appropriate. The in-product consent record stores the policy version accepted by each signed-in user.