Privacy Policy

1. Who we are and what this covers

MyATS Online Suite ("MyATS", "we", "us") provides recruitment software: MyATS360, MyNetwork360, MyPeople360 and MyPanelist360, together with our websites (myatsonline.com, myats360.com, mynetwork360.com, mypeople360.com and mypanelist360.com) and our iPhone and Android apps (the "Services").

This policy explains what personal data we collect, why we use it, who we share it with, how long we keep it, and the choices you have. It applies to everyone whose data passes through the Services: people who sign in to use them, people who visit our websites or chat with our assistant, and job candidates whose details are entered into the Services by a recruiting company or who apply or take an interview through a link.

If you do not agree with this policy, please do not use the Services.

2. Our role: customer data and our own data

Most data in the Services belongs to the organisation that uses them (a "Customer"), such as a staffing firm, recruiting agency or company hiring team.

• Customer data. Candidate profiles, resumes, requirements, client details, interview recordings and similar content are added by or for a Customer. The Customer decides what is collected and why. For this data the Customer is the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and we act as its "Data Processor", handling the data only on the Customer's instructions to provide the Services.
• Our own data. Account details of the people who sign in, data from our websites and chat assistant, support tickets, and technical records that keep the Services secure. For this data we decide the purposes and means ourselves.

If you are a candidate and want to see, correct or delete your details, the quickest route is usually the organisation that recruited you. You can also write to us (section 11) and we will help or pass your request on.

3. What we collect

People who sign in (Customer staff, panelists and similar users)

• Name, work email address, role and the organisation you belong to.
• Your password, which is handled by our authentication provider and stored in a protected (hashed) form. We never see it in readable form.
• Profile details you choose to add, such as a photo or organisation logo.
• Activity inside the Services that the product needs to work, for example who created or changed a record, comments, assignments and notifications.

Candidate and recruiting data entered by Customers or supplied by candidates

• Name, email address, phone numbers, location, current job title and employer, total experience, skills, education, work history, certifications and LinkedIn link.
• Notice period, current and expected pay, job preferences and willingness to relocate.
• Optional personal details a Customer chooses to record: date of birth, gender, marital status, nationality, and government identity numbers such as PAN, Aadhaar and passport numbers.
• Resume files and other documents you or the Customer upload.
• Comments, feedback, interview schedules and outcomes, and submission status on job requirements.

Candidate interviews run through the Services

When a Customer sends a candidate an interview link, the candidate may be asked to record video and audio answers, and to capture a photograph of a government ID. The Services may also record integrity signals during the session (for example leaving the browser tab, no face visible, or more than one face visible) with snapshots. These signals are only shown to a human reviewer. They are never used to reject anyone automatically. Recordings and photos are kept in private storage that is not open to the public.

Careers pages and job applications

If you apply for a job through a Customer's careers page powered by the Services, we receive what you submit, including your resume, and pass it to that Customer.

Website visitors and our chat assistant

• Messages you type to the chat assistant on our websites and, if you raise a support ticket, your name, email, the category, subject and description, and the page you were on.
• Your IP address is used to limit abuse (for example too many chat messages in a short time).
• Standard server logs such as browser type and date/time of requests.

The mobile apps

The apps keep your sign-in session on your phone in secure storage (the iOS Keychain, or encrypted app storage on Android) so you do not have to sign in every time. The apps do not use advertising or analytics tools, do not track you across other apps or websites, and do not ask for your location, contacts, camera, microphone or photos.

4. How we use data

• To provide the Services: sign-in, role-based access, managing requirements and candidates, submissions, interviews, reports and notifications.
• To send service emails such as interview invitations and reminders, submission notices and account messages.
• To provide AI-assisted features (section 5).
• To answer support requests and chat questions.
• To keep the Services secure, prevent abuse and fix problems.
• To meet legal obligations and to establish or defend legal claims.
• To tell customers about important changes to the Services or to these documents.

We do not sell personal data. We do not use candidate data to advertise, and we do not build advertising profiles.

5. Artificial intelligence

Some features use AI services to read or summarise content. These include extracting details from resumes, explaining job requirements, suggesting screening and interview questions, preparing screening reports, answering questions in the website chat assistant, and, for interviews, transcribing recorded answers and drafting an advisory score and summary.

• To produce the result, the relevant content (for example a resume, a job description, a chat message, or an interview recording) is sent to an AI provider listed in section 6.
• AI output is a suggestion to help a human reviewer. It is not a final decision. A person at the Customer decides whom to shortlist, interview or hire.
• We use these providers through their business or API services and do not use your content to train our own models.
• AI can be wrong. Customers should review results before relying on them.

6. Who we share data with

We share data only as needed to run the Services.

• Supabase provides our database, user sign-in and private file storage. Our project is hosted in Sydney, Australia.
• Anthropic and Google (Gemini) provide the AI features described above. If one is unavailable, the other may be used.
• Resend delivers our emails.
• Our website hosting and content delivery providers, which serve our web pages.
• The Customer whose workspace holds the data. Other users in the same Customer organisation can see data according to their role and the access rules the Customer's administrators set.
• Authorities and advisers where the law requires, or to protect rights, safety and security.
• A successor if we merge, are acquired or sell the business. The new owner will have to honour this policy.

Our providers act on our instructions and may only use the data for the service they give us. Because some providers operate outside India, your data may be processed in other countries. We take steps to keep it protected wherever it is processed, and we will follow any restriction the Indian Government places on transfers to particular countries.

7. How long we keep data

• Customer data is kept while the Customer's account is active. Customers can delete records they are allowed to delete.
• When an account ends, we delete or irreversibly anonymise the Customer's data within 90 days, unless the law requires us to keep it longer. Backup copies are replaced as backups expire.
• Chat messages and support tickets are kept for as long as needed to help you and to improve our support, and are then deleted or anonymised.
• Security and abuse-prevention records are kept for a limited period.
• If you ask us to delete your personal data and no legal reason requires us to keep it, we will delete it, or ask the Customer that controls it to do so.

8. Security

We use measures that fit the sensitivity of the data, including encrypted connections (HTTPS), access that depends on each person's role and organisation, private storage with time-limited access links for files and recordings, secure storage of sign-in sessions on phones, and encryption of stored data by our infrastructure providers. No system is perfectly secure. If a breach affects your personal data, we will tell the affected Customers and, where the law requires, the Data Protection Board of India and the individuals concerned.

9. Your rights

Under the DPDP Act you may:

• ask for a summary of the personal data we process and the parties we share it with;
• ask us to correct, complete or update your data;
• ask us to erase your data when it is no longer needed for the purpose it was collected;
• make a complaint about how your data is handled (see section 11);
• nominate another person to exercise these rights for you if you die or become unable to do so.

You may also withdraw consent you gave us, as easily as you gave it. Withdrawal does not affect what we did before. If your data is held for a Customer, we will help route your request to them.

10. Cookies and similar storage

Our websites and web app use only what is needed to work: browser storage to keep you signed in and to remember settings such as your language and screen layout. We do not use advertising cookies or third-party tracking cookies on the Services as of the effective date. You can clear browser storage at any time, but you may be signed out.

11. Children

The Services are for business use and are not meant for anyone under 18. We do not knowingly collect data from children. If you believe a child's data has reached us, write to us and we will delete it.

12. Contact and grievances

For privacy requests, questions or complaints, write to privacy@myatsonline.com. This address is also the contact for our Grievance Officer. We aim to acknowledge you within 3 working days and reply within 30 days, or sooner if the law requires. For general questions write to hello@myatsonline.com. If we do not resolve your complaint, you may approach the Data Protection Board of India once it is operational.

13. Changes to this policy

We may update this policy as the Services or the law change. We will post the new version with a new effective date and, for material changes, tell users by email or in the Services before the change takes effect. Using the Services after that date means you accept the updated policy.