This Privacy Policy explains how Zeduno Technologies Private Limited ("Zeduno", "we", "us", or "our") collects, uses, stores, shares, and protects personal data when you use our AI-powered hiring platform at zeduno.com. This is an informational document. Where specific processing requires your consent, we seek that consent separately and specifically.
Who This Policy Applies To
This policy applies to employers, HR managers, administrators, recruiters, interviewers, candidates, and visitors who interact with the Zeduno platform.
Data Controller and Data Processor Roles
Zeduno operates in different roles depending on the category of data being processed:
| Category of data | Zeduno's role |
|---|---|
| Employer account and billing data | Data Controller |
| Candidate data migrated by an employer | Data Processor — employer determines purpose; Zeduno processes on employer's instructions |
| Candidate data received through Zeduno Apply | Data Controller or Joint Controller |
| Interview transcripts and AI-generated reports | Data Processor — typically processes on employer's behalf |
| Billing and payment data | Data Controller / Payment Processor |
| Platform usage and analytics data | Data Controller |
What Personal Data We Collect
3.1 Account and registration data
- Name, email address, phone number, and job title
- Company name, industry, team size, and office location
- Login credentials and authentication tokens
- Billing address, payment method identifiers, and GST/tax information
3.2 Hiring and candidate data
- Job descriptions, role requirements, and hiring criteria
- Candidate profiles, resumes, CVs, and cover letters
- Candidate contact details, LinkedIn URLs, and professional history
- Application status, pipeline stage, and hiring outcomes
- Employer notes, feedback, and tags on candidates
- Job application data submitted through Zeduno Apply
3.3 AI screening call data
- Candidate voice audio during AI screening calls conducted by Zed
- Transcription of candidate responses to screening questions
- Structured data extracted from responses (compensation, notice period, location, experience)
- Call status, duration, and outcome flags
3.4 Zuno interview session data
- Live audio from the interview session, processed in real time
- Full transcript including interviewer questions and candidate responses
- AI-generated follow-up suggestions, red flag observations, and live prompts
- Candidate competency scores and AI-generated scorecard
- Hire/no-hire recommendation, evidence quotes, and session report
- Talk ratio, session duration metadata, and pacing data
Audio is not permanently retained unless the employer explicitly enables recording. Transcripts and reports are retained per Section 8.
3.5 Platform usage and technical data
- Pages visited, features used, session duration, and click patterns
- IP address, browser type, operating system, and device identifiers
- Access logs, error reports, and API call records
- Calendar and scheduling data where integrations are enabled
- Communications sent through the platform
Legal Basis for Processing
- Performance of contract — processing necessary to provide the platform services you have subscribed to
- Legal obligation — processing required by applicable Indian law including the DPDP Act 2023, IT Act 2000, and tax and accounting law
- Consent — where you have given specific, informed consent for a particular processing activity. You may withdraw consent at any time without affecting prior processing
- Legitimate interests — processing necessary for platform security, fraud prevention, and service improvement, where not overridden by your rights
Automated Decision-Making and AI Processing
5.1 How AI is used
- Candidate matching — ranking candidates from the employer's database against job requirements
- Resume and JD parsing — extracting structured data from uploaded documents
- Screening call transcription and structured response extraction
- Live interview assistance — suggesting follow-up questions and flagging vague answers
- Post-interview report generation — producing scorecards, observations, and recommendations
5.2 Human review requirement
Zeduno's AI-generated outputs are decision-support tools only. Zeduno does not make final employment decisions. All AI-generated scores, rankings, flags, and recommendations must be reviewed by a human decision-maker before any hiring action is taken. Employers are solely responsible for all final hiring decisions.
5.3 No automatic rejection
Candidates are not automatically rejected or excluded based solely on AI-generated output. Employers must independently review AI outputs and make their own determinations.
5.4 Candidate rights regarding AI
- Be informed that AI assistance is active before any Zuno session begins
- Request an explanation of AI-generated scores or flags
- Request correction of inaccurate AI-generated information via privacy@zeduno.com
- Withdraw consent to AI-assisted interview processing before a session begins
Third-Party AI Providers and International Data Transfers
6.1 AI providers
Zeduno uses the following AI service providers. Model names and versions may change over time. References to specific model names should be read as including successor, equivalent, or replacement models provided by the same vendor under the same data protection terms.
| Provider | Purpose, data sent, location, and training |
|---|---|
| Google — Gemini Live API (or successor models) | Live audio and session text for real-time transcription and interviewer suggestions. Processing on Google Cloud infrastructure which may include servers outside India. Google does not use this data to train its models under our enterprise agreement. |
| Anthropic — Claude Haiku (or successor models) | Text prompts for Zed hiring chat, resume content for parsing, and JD text for extraction. Processing on Anthropic's infrastructure in the United States. Anthropic does not use this data to train its models under our enterprise agreement. |
| Anthropic — Claude Sonnet (or successor models) | Interview transcripts and structured observations for scorecard and report generation. Processing on Anthropic's infrastructure in the United States. Data not used for model training. |
6.2 International data transfers
Zeduno stores data primarily in AWS infrastructure in India (ap-south-1 region). AI processing by Google and Anthropic may involve transfer of data outside India, including to the United States. By using AI-powered features, you acknowledge that your data may be processed outside India under appropriate contractual safeguards, including data processing agreements that prohibit use of data for model training.
6.3 Other subprocessors
- Cloud hosting — Amazon Web Services (AWS), primary data storage in India
- Payment processing — third-party payment gateway for subscription billing
- Email delivery — transactional email provider for system notifications
- Analytics — platform usage analytics provider
A current list of subprocessors is available on request at privacy@zeduno.com and maintained at zeduno.com/subprocessors.
Lawful Requests for Data
Zeduno may be required by law to disclose personal data to government authorities, regulators, courts, or law enforcement. We handle such requests as follows:
- We disclose personal data only where we have verified that the request is lawful and legally binding under applicable Indian law
- Where permitted by law, we will notify affected users before disclosing their data in response to a government request
- We maintain records of all government data requests received and will publish aggregate statistics where permitted
- We do not proactively provide personal data to any government authority beyond what is legally required
Data Retention
| Category | Retention period |
|---|---|
| Employer account data | Duration of subscription plus 30 days for export, then permanently deleted or anonymised |
| Employer-migrated candidate data | Duration of employer subscription unless earlier deletion requested |
| Candidates via Zeduno Apply | 12 months from application date or until deletion requested |
| Interview transcripts and AI reports | 12 months from interview date |
| Screening call transcripts | 12 months from call date |
| Audio data from Zuno sessions | Not permanently stored. Discarded after real-time processing unless recording explicitly enabled |
| Billing and financial records | 7 years as required by Indian accounting and tax law |
| Platform access and security logs | 90 days |
| Backup data | Up to 30 days in encrypted storage before permanent deletion |
Following the applicable retention period, data is permanently deleted or anonymised. Retention may be extended where required by law, a court order, or a legitimate legal or security purpose.
Data Deletion Process
When you submit a deletion request or when the retention period expires, Zeduno follows this process:
- We verify your identity and authority to make the request within 48 hours
- We confirm the scope of data to be deleted and identify any legal retention obligations
- We permanently delete your data from active systems within 14 days of verification
- Backup copies are purged within 30 days of the deletion from active systems
- We confirm deletion in writing to the requestor
Data required to be retained by law (such as billing records) is not deleted but is isolated and used only for the legally required purpose.
Security
10.1 Technical measures
- Encryption in transit using TLS 1.2 or higher
- Encryption at rest using AES-256 on AWS
- Role-based access controls and principle of least privilege
- Multi-factor authentication for internal Zeduno systems
- Access logging and monitoring of all administrative data access
We continuously review and improve our security controls based on industry best practices and emerging threats. Our security programme is designed with reference to recognised frameworks including ISO 27001 and SOC 2.
10.2 Organisational measures
- Confidentiality obligations for all Zeduno employees and contractors
- Security review of third-party subprocessors before onboarding
- Incident response plan covering detection, containment, assessment, notification, and review
- Regular review of access permissions and internal data handling procedures
- Data minimisation — we collect and retain only the data necessary for the purposes described in this policy
- Business continuity and disaster recovery procedures to protect against data loss
10.3 Security contact
To report a security vulnerability or concern, contact security@zeduno.com. We operate a responsible disclosure programme and commit to acknowledging security reports within 24 hours.
10.4 Data breach notification
In the event of a personal data breach likely to result in harm, Zeduno will notify affected individuals and the relevant regulatory authority within the timeframes prescribed by applicable law.
Your Rights
11.1 Rights under the DPDP Act 2023 and IT Act 2000
- Right to access — request confirmation and a copy of personal data we hold about you
- Right to correction — request correction of inaccurate or incomplete data
- Right to erasure — request deletion of personal data, subject to legal retention requirements
- Right to withdraw consent — withdraw consent for consent-based processing at any time
- Right to grievance redressal — raise a complaint through our grievance mechanism
- Right to nomination — nominate another individual to exercise your rights in specified circumstances
Rights are subject to the phased commencement of the DPDP Act 2023 and its Rules and to applicable legal exceptions. We will respond to requests within 30 days or notify you if additional time is required.
11.2 Rights of candidates
- Contact Zeduno to verify what data is held about you and request access, correction, or deletion
- Withdraw consent to AI-assisted processing before a Zuno session begins
- Request an explanation of any AI-generated score or flag via privacy@zeduno.com
- Deletion requests relating to employer-migrated data will be coordinated with the relevant employer
Grievance Mechanism
| Contact point | Details |
|---|---|
| Grievance and Data Protection Officer | privacy@zeduno.com |
| How to submit | Email privacy@zeduno.com with your name, nature of request, and supporting detail |
| Acknowledgement | Within 48 hours of receipt |
| Resolution target | 30 days. Complex requests may take up to 45 days with advance notice |
| Security concerns | security@zeduno.com |
| Escalation | If unsatisfied, escalate to the relevant regulatory authority under applicable Indian law |
Cookies
Zeduno uses the following categories of cookies:
| Cookie type | Purpose and examples |
|---|---|
| Essential cookies | Required for the platform to function. Include session management, authentication tokens, and security cookies. Cannot be disabled without affecting platform functionality. |
| Functional cookies | Remember your preferences and settings, such as display preferences and notification choices. Improve your experience but are not strictly required. |
| Analytics cookies | Help us understand how users interact with the platform, which features are most used, and where performance can be improved. We use anonymised or aggregated analytics data only. |
You may manage cookie settings through your browser or our cookie preference centre at zeduno.com/cookies. A full Cookie Policy is maintained at zeduno.com/cookies.
Children
Zeduno is not directed at individuals under 18. We do not knowingly collect personal data from minors. Contact privacy@zeduno.com to request deletion of any minor's data.
Updates to This Policy
We will notify you of material changes via email and a prominent platform notice at least 14 days before the change takes effect. The date at the top of this policy indicates when it was last updated.
Contact
- Privacy and data rights — privacy@zeduno.com
- Security and vulnerability reports — security@zeduno.com
- Legal and compliance — legal@zeduno.com
- Address — Zeduno Technologies Private Limited, Bangalore, Karnataka, India