Privacy notice

Information and purposes

• Accounts and support: names, email addresses, authentication records, approval status and messages, to manage accounts, control access and respond to requests.
• Screening details: candidate name, phone, stated city/state, optional work-authorization/citizenship details, declarations and acceptance timestamps, to record the candidate's statements and permission for screening.
• Location and device evidence: IP address, network/carrier and proxy signals, GPS coordinates and accuracy when permitted, browser/device characteristics and timezone, to compare location and connection evidence.
• Photo and report evidence: one live holding-ID selfie, visible ID information, AI-assisted readings, check results, summaries and review confirmations, to support identity-evidence review. We do not treat a photo or AI reading as proof of authenticity or legal status.
• Billing records: subscription identifiers, credit balances, coupon redemption and transaction/event references, to administer purchases, credits and prevent duplicate fulfillment. Payment card details are handled by Paddle, not collected in our screening forms.

Depending on the activity and applicable law, processing relies on contract performance for accounts and purchased services, consent for candidate participation and optional device permissions, legitimate interests in security and fraud prevention balanced against individuals' rights, and legal obligations for required business records. Recruitment organizations are responsible for establishing a lawful basis for their own screening and employment decisions.

Who receives information

Authorized recruitment teams can access assigned candidate reports and photos and may share a confirmed report with their client. A report can contain sensitive information; clients' subsequent handling is their responsibility. Service providers supporting hosting, authentication, storage, email and AI processing receive information needed for their work through Lovable Cloud and Lovable's AI Gateway.

Network checks send the IP address to ip-api.com and proxycheck.io; reverse geocoding sends GPS coordinates to OpenStreetMap Nominatim. Google sign-in, if chosen, shares authentication information with Google and our sign-in service. Google Fonts receives ordinary connection information when fonts load. These services process requests under their own privacy terms.

Paddle receives information needed as Merchant of Record for product sales, subscription management, payments, tax compliance and invoicing. See Paddle's Privacy Policy. We may also disclose information to professional advisers, such as legal and accounting advisers, and authorities where required by law. Providers may process information outside India; we use applicable contractual and legal safeguards where required.

Retention and deletion

Candidate information is intended to be kept only until verification is finished, then deleted. In the current service, deletion is initiated by the authorized team using “Delete candidate data”; submitting a verification does not automatically delete the report. That action removes the report and its stored ID photos. While corrections are needed, existing answers and photos remain available. Ask the requesting team or contact us to arrange deletion. Copies already downloaded or shared with a client must be handled by their recipient.

Account records are kept while the account is active and afterward only as needed for security, dispute resolution or legal obligations. Billing and accounting records are retained for applicable statutory periods; they do not need to retain candidate details. Other records are deleted or anonymised when no longer needed. Infrastructure backups and provider records may remain for their applicable retention cycles.

Website analytics

Lovable's visitor analytics uses no cookies, stores nothing on a visitor's device, does not keep IP addresses and does not identify visitors. It records pages visited, referral sources, country, browser, operating system, device type, time on page, page load speed and errors, including errors reported by the app. Click tracking is enabled and records the position of clicked buttons and links, not their text. With no analytics consent banner currently connected, these analytics, including clicks, are recorded for every visitor to the published site. Detailed data is retained for 90 days and daily summaries for one year.

Lovable collects this data for us. Lovable's privacy policy explains how it handles it. This cookie-free website analytics is separate from the IP and GPS data collected for a candidate's requested screening.

Cookies and browser storage

Sign-in uses essential browser storage for authentication sessions. Payment checkout may use storage or cookies under Paddle's policies to complete transactions and prevent fraud. We do not currently embed advertising pixels or configure marketing cookies. You can manage cookies and site storage in your browser; blocking essential storage can prevent sign-in or checkout. Camera and location permissions can be revoked in device/browser settings.

Security and your rights

We use appropriate technical and organizational measures, including access controls, private photo storage, short-lived photo access links and encrypted browser connections. No system can guarantee absolute security.

Depending on applicable law, you may request access, correction, erasure, restriction, portability or object to certain processing. You may withdraw consent without affecting the lawfulness of earlier processing; withdrawal may prevent completion of screening. Indian users may exercise applicable rights to information, correction and erasure, grievance redressal and nomination where available under Indian data-protection law. You may complain to the relevant authority where permitted. Contact the requesting organization for its use of your screening data, or email us for our processing. We may verify your identity proportionately and respond within the period required by applicable law.