Privacy Policy.

This Privacy Policy explains how reforr collects, uses, shares, stores and protects personal data when you use reforr.com and its services. It is published in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

For the purposes of the DPDP Act, reforr acts as the Data Fiduciary for personal data processed through the Platform. By using the Platform you consent to processing as described here.

• Account data — name, email address, password (stored only in hashed form), account type and company name.
• Profile data — professional details, skills, sector, experience, and for HR Partners, payout details such as PAN and bank account.
• Requirement data — role, skills, location, compensation, notice period and commercial terms.
• Candidate data — name, email, mobile number, location, experience, current and expected CTC, notice period, resume file and consent record.
• Verification data — one-time password and email-link proofs, stored only as secure hashes.
• Communications — Support requests and messages exchanged on hiring requests.
• Technical data — IP address, device and browser information, logs and security events.

Directly from you when you register, complete a profile, post a requirement, submit a referral or application, or contact Support; from HR Partners who refer a Candidate with that Candidate's consent; and automatically through your use of the Platform for security and operations.

• Creating and managing accounts.
• Reviewing requirements and preparing recruitment agreements.
• Matching, screening and sharing Candidates for a specific Requirement.
• Verifying email and mobile, and detecting duplicate or suspicious referrals.
• Sending service notifications and hiring updates by email.
• Invoicing, payment verification, Reward payouts and tax compliance.
• Preventing fraud, abuse and security incidents, and maintaining audit trails.
• Complying with legal obligations and lawful requests from authorities.

We do not sell personal data and do not use Candidate data for unrelated advertising.

We process personal data on the basis of your consent and for legitimate uses permitted by Section 7 of the DPDP Act, such as fulfilling a service you requested and complying with law. Candidates give a specific, recorded consent before their application is submitted. You may withdraw consent at any time; withdrawal does not affect processing already carried out and may mean we can no longer provide the service.

We may use AI tools to score how well a Candidate's profile matches a Requirement and to summarise fit. Only job-relevant profile information is used; names, email addresses and mobile numbers are not sent to these tools. Outputs are advisory and a person makes every rejection decision.

• Companies receive approved Candidate profiles and resumes only for Requirements covered by an accepted Recruitment Agreement.
• HR Partners see the status of Candidates they referred, not other partners' Candidates.
• Service providers — cloud hosting, email delivery, SMS/OTP delivery and AI processing — under confidentiality obligations and only as needed.
• Authorities, courts or regulators where required by law.
• A successor entity in a merger or acquisition, subject to this Policy.

Resumes are validated before review, stored in private storage, and made available only through secure, expiring links. Files that fail validation stay blocked. Access to resumes is limited to authorised parties and is logged.

We implement reasonable security practices consistent with Rule 8 of the SPDI Rules, 2011, including encryption in transit, hashed passwords and verification codes, role-based access controls, row-level data restrictions, rate limits and audit logging. No system is completely secure; in the event of a personal data breach we will notify the Data Protection Board of India and affected users as required by the DPDP Act.

We keep personal data only as long as needed for the purposes above or as required by law — for example, invoice and tax records for the periods required under the Goods and Services Tax and Income-tax laws. Candidate data is retained for the life of the Requirement and a reasonable period afterwards for dispute and audit purposes, after which it is deleted or anonymised unless you consent to longer retention.

Under the DPDP Act you have the right to:

• Access a summary of your personal data and the processing carried out.
• Correct, complete or update inaccurate or incomplete data.
• Erase personal data no longer needed, subject to legal retention.
• Withdraw consent at any time.
• Nominate another person to exercise your rights in case of death or incapacity.
• Seek grievance redressal from us, and thereafter approach the Data Protection Board of India.

To exercise these rights, contact us through Support. We may need to verify your identity before acting.

We use essential cookies and browser storage to keep you signed in, remember preferences and protect the Platform. We do not use third-party advertising cookies. Disabling essential storage may stop the Platform from working.

The Platform is not intended for persons under 18. We do not knowingly process the personal data of children; if we learn we have done so without verifiable parental consent, we will delete it.

Data may be processed on secure cloud infrastructure located in or outside India. Any transfer outside India will comply with restrictions notified by the Government of India under Section 16 of the DPDP Act.

Complaints or concerns about the processing of your personal data may be raised through Support, addressed to our Grievance Officer. We will acknowledge within 24 hours and resolve within 15 days, or within the timelines prescribed under applicable law.

We may revise this Privacy Policy. The updated version will be posted on this page with a new date, and material changes will be notified by email or on the Platform.