Privacy Policy

This Privacy Policy explains how Softfoora Services Private Limited ("TalentFora.in", "we", "us") collects, uses, shares and protects personal data when you use the TalentFora.in platform and related services (the "Services"). Softfoora Services Private Limited owns, operates, and provides the Platform and acts as Data Fiduciary for personal data processed through it, except where it processes data solely on a customer's behalf. See our Terms & Conditions for the full contracting-entity disclosure and §10 for the governing law (India) and jurisdiction (arbitration and courts in Delhi-NCR) that apply to disputes.

This Policy is written in plain English in line with the requirements of the EU/UK General Data Protection Regulation ("GDPR") and India's Digital Personal Data Protection Act, 2023 ("DPDPA"), as applicable to the contracting entity and the category of personal data concerned.

1. Personal data we collect

1.1 Account data (we are Data Fiduciary)

• Identifiers: name, email address, organisation, role
• Authentication metadata (e.g. Microsoft / Azure AD identifiers, hashed credentials, session tokens)
• Billing metadata (last four digits of card, billing address). Card numbers themselves are handled by Stripe and Razorpay, never stored by us
• Communications you send to support, sales or info inboxes
• Usage telemetry: pages visited, features used, error logs, IP address, device and browser information

1.2 Candidate data (we are Data Processor)

• Resumes and CVs uploaded by the customer (PDF, DOCX, plain text)
• Parsed candidate fields (name, contact details, work history, education, skills)
• AI-generated outputs: scores, summaries, rankings, justifications

2. Purposes and lawful basis

• Provide and operate the Services: performance of a contract (GDPR Art. 6(1)(b)); "specified purpose" under DPDPA s.4.
• Account security and fraud prevention: legitimate interest (GDPR Art. 6(1)(f)); DPDPA "legitimate use" where applicable.
• Billing, taxation, statutory records: legal obligation (GDPR Art. 6(1)(c)); compliance with Indian GST and accounting law.
• Service improvement, error monitoring, analytics: consent (DPDPA s.6 / cookie banner) and/or legitimate interest where permitted.
• Marketing communications: only with consent, with an unsubscribe option in every message.

3. AI processing of Resumes (profiling notice)

The Services use large language models and machine-learning algorithms to score, rank and summarise candidate Resumes against criteria provided by the customer. This constitutes profiling under GDPR Article 22 and is processed for the customer's recruiting purposes. The Services are designed as decision-support: TalentFora does not make autonomous employment decisions. Customers are contractually obliged to carry out meaningful human review before taking adverse action against a candidate. Where applicable law grants candidates additional rights (e.g. NYC Local Law 144, EU AI Act), the customer is responsible for honouring them.

4. Sub-processors

We share personal data with the following sub-processors:

We require sub-processors to apply security and confidentiality protections at least as strong as those in this Policy and we maintain data processing agreements with each, including, where required, EU Standard Contractual Clauses for cross-border transfers.

5. International data transfers

Personal data may be processed outside India and outside the European Economic Area (for example, by AI model providers or payment processors). We rely on appropriate safeguards including contractual clauses and (for transfers from India) the provisions of DPDPA s.16 on cross-border transfer.

6. Retention

• Account data: for the life of the account plus a reasonable grace period for billing and statutory records (typically up to 8 years for tax records, as required by Indian law).
• Candidate data: retained at the direction of the customer. On customer instruction or account closure, candidate data is deleted within a reasonable period unless we are required to retain it by law.
• Usage logs and security telemetry: typically up to 12 months.

7. Security

We apply technical and organisational measures including encryption in transit (TLS) and at rest, role-based access controls, audit logging, least-privilege provisioning, regular vulnerability management, and employee confidentiality obligations. No security control is perfect; we will notify affected users and the Data Protection Board of India of personal data breaches in accordance with DPDPA s.8(6) and equivalent obligations under GDPR Art. 33–34.

8. Your rights

Subject to applicable law, you have the right to:

• access and obtain a copy of your personal data (DPDPA s.11 / GDPR Art. 15);
• request correction or completion of inaccurate or incomplete data (DPDPA s.12 / GDPR Art. 16);
• request erasure of personal data, subject to legal retention obligations (DPDPA s.12 / GDPR Art. 17);
• withdraw consent at any time, where processing is based on consent (DPDPA s.6(4) / GDPR Art. 7(3));
• data portability where applicable (GDPR Art. 20);
• object to certain processing, including direct marketing (GDPR Art. 21);
• nominate another person to exercise rights in case of death or incapacity (DPDPA s.14);
• lodge a grievance with our Grievance Officer (below) and, if unresolved, complain to the Data Protection Board of India or your local supervisory authority.

Candidate rights. If you are a candidate whose Resume has been uploaded by an employer or recruiter, please direct your data rights request to that employer first (they are the Data Fiduciary / Controller for that data). We will cooperate with them to fulfil valid requests.

9. How to exercise your rights

Email our Grievance Officer (see Section 14). We will acknowledge your request and respond within statutory timelines (typically within thirty (30) days for DPDPA requests). We may need to verify your identity before acting on a request.

10. Children

The Services are not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact us and we will delete it. Customers should not upload Resumes of minors without appropriate parental/guardian consent under DPDPA s.9 and applicable law.

11. Cookies and similar technologies

We use cookies and similar technologies as described in our Cookie Policy. You can manage consent for non-essential cookies via the banner shown on first visit or the "Cookie Settings" link in the footer.

12. Automated decision-making

We do not make decisions that produce legal or similarly significant effects on you based solely on automated processing. AI Output is decision-support; customer recruiters carry out the final review.

13. Changes to this Policy

We may update this Policy from time to time. Material changes will be notified by email or by an in-product notice at least fifteen (15) days before they take effect. The "Last updated" date at the top reflects the latest revision.

14. Contact and Grievance Officer

Grievance Officer (DPDPA s.10(2)(c)), appointed under Softfoora Services Private Limited:
Ambuj Kumar, GRIEVANCE OFFICER
Email: ambuj.kumar@forasoftware.com
Phone: +917817891646

Contracting entity and registered office:

• Softfoora Services Private Limited (All customers)
  SOFTFOORA SERVICES PRIVATE LIMITED KHATA NO-506, PLOT NO-1075, BARABODIA, Patapur, Jagatpur, Cuttack- 754200, Odisha, India
  CIN: U62091OD2024PTC046683 · GSTIN: 21ABOCS1782K1Z0

General contact: Contact page