Privacy policy
Draft, pending legal review
This has been written against what the product genuinely collects and does, and has not yet been reviewed by a lawyer qualified in Indian data protection law. Placeholders in square brackets are facts only Kaziyo can fill in. Do not rely on this as advice.
Last updated 26 August 2026
Kaziyo is HR software sold to companies. Most of the personal data in it is not ours: it belongs to the company using Kaziyo, about their employees and the people who apply to them. Under the Digital Personal Data Protection Act 2023 that company is the Data Fiduciary and Kaziyo is its Data Processor. We act on their instructions.
For the small amount of data we collect for ourselves, such as an access request from this website, we are the Data Fiduciary. This policy covers both and says which is which.
Who we are
[REGISTERED COMPANY NAME], [REGISTERED ADDRESS], [CIN / COMPANY NUMBER]. Contact privacy@kaziyo.com.
Our named contact for data protection questions is [NAME AND TITLE OF DATA PROTECTION CONTACT]. We have not appointed a Data Protection Officer, which the DPDP Act requires only of Significant Data Fiduciaries. If we are notified as one, this page will name the DPO.
What we collect, and why
If you are an employee of a company using Kaziyo
| What | Why |
|---|---|
| Name, work email, employee code | To identify you in your employer's directory |
| Role title, department, manager, start date, leaving date | To show your employer their own org structure |
| Policy acknowledgements: which version you signed, when, the SHA-256 of the exact file, and the name you typed | So your employer can show a regulator that you were given a specific document |
| Onboarding checklist items and when they were completed | To run your onboarding |
| The IP address and browser you acknowledged a policy from | Evidence that an acknowledgement was made by a person. Collected from the date this page was published; older acknowledgements do not have it |
If you have applied for a job
See also the note shown to you on the application form itself. We collect your name, email, phone, location, notice period, current and expected salary, your CV, and the record of your application as it moves through the employer's hiring process, including interview feedback about you and any offer made to you.
Your CV is sent to OpenAI to produce a score and a short summary against the specific job. That score comes with the reasoning for each criterion, and the employer sees the reasoning, not just the number. It is a decision aid for a human, and Kaziyo does not automatically reject anybody.
If you asked for access on this website
Your name, work email, company and team size, plus the IP address and browser the request came from. We use it to reply to you and to decide whether to invite you. We do not add you to a mailing list and there is no mailing list to add you to.
Where it is stored
In Supabase's ap-south-1 region, which is Mumbai. Personal data stays in India at rest. Uploaded files, meaning CVs, policy documents and offer letters, are held in private storage in the same region and are only ever served through short-lived signed links.
Who else sees it
| Processor | What they get | Why |
|---|---|---|
| Supabase | Everything, as our database and file storage | Hosting, in ap-south-1 |
| Clerk | Name and email of admin users only. Never employees or candidates | Sign-in for the people who administer the software |
| Resend | Recipient email address and message content | Sending policy acknowledgement links, offer links and interview invitations |
| OpenAI | CV text and the job description it is scored against | Candidate scoring and summaries. Sent through the API, which is not used to train their models |
| Vercel | Request metadata such as IP address, in server logs | Serving the application |
Clerk, Resend, OpenAI and Vercel process data outside India. [CONFIRM THE TRANSFER BASIS AND ANY RESTRICTED-COUNTRY POSITION UNDER SECTION 16 OF THE DPDP ACT WITH COUNSEL.]
We do not sell personal data, and there is no advertising or tracking anywhere in Kaziyo.
How long we keep it
- Employee and candidate records: for as long as the company using Kaziyo keeps their account, because the data is theirs. When an account closes we delete or return it within [RETENTION PERIOD ON ACCOUNT CLOSURE, e.g. 30 days].
- Policy acknowledgements: kept as long as the employment record, because their whole purpose is to prove something happened.
- Access requests from this website: [RETENTION PERIOD FOR ACCESS REQUESTS].
- Server logs: as retained by Vercel under their own policy. [CONFIRM VERCEL LOG RETENTION.]
If you are a candidate and want your data deleted
You applied to an employer, not to Kaziyo, so that employer decides. In practice:
- Ask the company you applied to. They can delete your candidate record from within Kaziyo themselves, and that removes your CV from storage as well.
- If you cannot reach them, or they do not respond, email privacy@kaziyo.com with the company name and the email address you applied with. We will pass the request on, and tell you we have done so, within [RESPONSE TIME, e.g. 7 working days].
- We will not delete an employer's data without their instruction, because we are the processor and not the fiduciary. What we can and will do is make sure the request reaches somebody who can act on it.
One limit worth stating plainly: if you were hired, some of your record becomes an employment record, and your employer may be required to keep parts of it whatever you or we would prefer.
Security
- Every tenant's data is separated at the database level by row level security, not only by application code. A query that forgets to filter by organisation returns nothing rather than somebody else's data.
- Uploaded files are private and reachable only through short-lived signed links.
- Acknowledgement links are single-purpose tokens; only a hash of each is stored, never the token itself.
- Access to production data is limited to [WHO HAS PRODUCTION ACCESS].
Changes
If we change this materially we will tell the companies using Kaziyo before it takes effect. The date at the top is when it last changed.