Privacy Policy

1. Introduction

withRemote Solutions Pvt Ltd (CIN: U78100GJ2025PTC160520), a private limited company incorporated under the Companies Act, 2013 ("withRemote", "we", "us", "our") provides remote engineering talent placement, managed Employer-of-Record (EOR) services, and product-development services.

We respect your privacy and are committed to protecting personal information you share with us. This Privacy Policy explains what information we collect, how we use it, who we share it with, how we secure it, and the rights you have over it. It applies to visitors of withremote.ai, candidates, clients, and personnel engaged by us.

If you are a candidate for a role, Sections 4 to 6 explain how our hiring process uses your information, Section 10 covers the messages we send you, and Section 13 explains how to stop them or have your information deleted.

This Policy is published in compliance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 ("DPDP Act").

2. Information we collect

2.1 Information you provide

• Contact details: name, work email, phone, company.
• Service inquiry data: role briefs, project requirements, budget ranges, timezone preferences.
• Billing and payroll data: bank or payment instrument details, tax identifiers (PAN, GSTIN, equivalent international IDs), statutory documents (for engaged personnel).

If you are a candidate, we hold the following, where it applies to you:

• Your name, email address and phone number.
• Your CV, and the details read out of it.
• What you tell us when you apply or update your profile: your current role and employer, years of experience, notice period, expected salary, location, skills and languages, a short summary about yourself, your LinkedIn profile and any portfolio link, a cover letter if you write one, and your answers to any extra questions a role asks.
• The messages between us: the emails and WhatsApp messages we send and your replies, whether a message was delivered or read, whether an email bounced, and whether you have asked us to stop.
• Which roles you have been considered or put forward for, where you stand on each, and a dated record of each step: whether you, a recruiter, a client or our systems took it, and any reason or note given with it.
• Interviews: your booking (time, time zone and meeting link), the written transcript, the assessment made from it, and the questions prepared for you. We do not keep video or audio of interviews.
• Interview notes: if the notetaker did not produce a transcript, a recruiter may type up what was said. We keep those notes and assess them in the same way as a transcript.
• Scores and rankings our systems produce about your fit for a role.

2.2 Information collected automatically

• Log data: IP address, browser type, pages viewed, referrer.
• Cookies and similar technologies: see our Cookie Policy.
• Usage analytics: anonymised counts of feature interactions on Talent OS or our site.

2.3 Information from third parties

Where lawful, we may receive information from public professional networks (LinkedIn, GitHub), referral partners, background-check providers, and reference-checkers, limited to what is necessary for vetting and placement.

We also receive the details of people who apply to our job posts on Naukri, LinkedIn and other job platforms.

If you applied to a withRemote role before, we kept your details so we could come back to you when something else suited you.

2.4 Sensitive personal data or information (SPDI)

Under SPDI Rules, 2011 and the DPDP Act, certain categories of information (financial information, biometric data, health records) receive heightened protection. We process SPDI only with explicit consent, only when necessary for an engagement, and store it with additional encryption and access controls.

3. How we use information

We use the information we collect for the following purposes:

• Match candidates to roles and present shortlists to clients.
• Operate Talent OS, payroll, EOR, and compliance services.
• Communicate about engagements, invoices, and product updates.
• Comply with legal obligations (income tax, GST, PF, ESI, statutory filings under Indian law, plus equivalent obligations under foreign jurisdictions where we operate).
• Detect, prevent, and address fraud and security incidents.
• Improve our services through aggregated analytics.

4. How we use AI in hiring, and what it decides

We use AI at these points in our hiring process:

• AI reads your CV and turns it into a profile.
• AI can also rank and score your profile against the requirements of our other open roles, not only the one you applied for. Only the highest-ranked profiles for a role go on to an AI screen against that role.
• AI writes the questions a recruiter asks in your interview.
• AI analyses the interview transcript against the role's criteria.

Two automatic steps can end your application for a role without a person deciding at that moment:

• Your application answers are checked automatically against the screening criteria set for the role, such as notice period, expected salary and years of experience. These criteria are not always shown on the job page. If your answers do not match, we tell you straight away that the role is not a fit, without saying which criterion it was. If a role lets you leave one of these questions blank, we use what we already hold about you instead, such as the years of experience worked out from your CV. If we hold nothing we can use for a criterion, it is left unchecked, so it cannot count against you. A recruiter can reverse this decision.
• The interview assessment can mark an interview below the role's bar. We wait at least a day before telling you, and a recruiter can reverse it in that time.

Other steps also happen automatically:

• Invitations: a recruiter chooses who is invited to interview, unless automatic invitations are switched on. While they are on, anyone whose profile scores at or above our bar for a role is invited without a person choosing them, except a profile our checks flag for a closer look.
• Shortlisting: a very high combined score from your profile and your interview can add you to our internal shortlist for that role. Clients do not see this shortlist.
• Missed interviews: if you booked an interview but the notetaker hears only one person on the call, or no one, or no transcript arrives within 6 hours of the slot, we treat the interview as missed and your booking link works again, so you can choose a new time. If instead the notetaker tells us it could not join or record the call, we do not treat the interview as missed, and a recruiter is asked to add their notes of it.

If you interviewed with us in the last 6 months, we may assess that interview against a new role and, on its strength, add you to our internal shortlist for that role without asking you to repeat it. Older interviews may shape the questions we ask, so you are not asked the same thing twice.

A recruiter decides who is put in front of a client, and the client decides about hiring. If an automated step went against you, write to the Grievance Officer (details in Section 16) and a person will look at it.

When a client has asked us to keep their name confidential, we remove it from the job details we send to Google, xAI and Anthropic to screen and assess you and to prepare and assess your interview.

Our AI providers do not train their models on your data.

5. Interviews

The first-round technical interview is a live video call with a withRemote recruiter on Google Meet, unless a role uses an AI voice interview instead, as explained at the end of this section.

An automated notetaker (Recall.ai) joins the call as "withRemote Notetaker" and writes down what is said. If you book your own slot, you are told this before you choose a time, on our page or in the email that carries your booking link. If we have a working email address for you, the email confirming your booking also tells you.

We keep the written transcript, the assessment made from it, and the questions prepared for you. We keep no video or audio.

The notetaker service records the call, with video and audio, in order to produce the transcript, and keeps that recording under its default retention settings. We will tell you how long that is if you ask.

In an AI voice interview, an AI interviewer asks the questions, by phone or in your browser. We keep the transcript, the assessment and the length of the call, and no video or audio.

6. What clients see

When we put you forward for a role, the client sees your name and the professional profile we built from your CV: your current role and employer, location, years of experience, a short professional summary and any career objective, work history, education, projects, skills, certifications, languages, awards, publications, volunteering and interests.

They also see our assessment of you for the role (overall, profile and interview scores, a short summary, your strengths and any gaps), your score on each interview criterion with the reasoning behind it, which points on your CV the interview confirmed or did not confirm, strengths it found beyond your CV, and the date and length of your interview. We remove any email address, phone number, link or pay figure we find in that text.

The client does not see the interview transcript itself, and does not see your contact details until they decide to take you forward.

Clients never see your expected salary, your cover letter, links to your own pages, or our internal notes.

The client sees your profile through a private link for that role. Other clients see it only if we put you forward for one of their roles too. The client can still open the link after they make their decision and after the role closes, unless we switch it off.

7. Legal bases for processing

7.1 Under the DPDP Act, 2023 (India)

We process personal data under one or more of the following lawful bases:

• Consent (Section 6 of the Act): explicit, informed, and revocable.
• Legitimate uses (Section 7 of the Act), including provision of services, employment, public interest, and compliance with judgment/court order.
• Performance of a contract, where processing is necessary to deliver an engagement you have entered into with us.

7.2 Under foreign law (where applicable)

Where the EU GDPR, UK GDPR, California CCPA/CPRA, or other foreign data-protection regimes apply (because of the data subject's location or the engagement structure), we rely on the equivalent lawful basis under that law: contract, legitimate interest, legal obligation, or consent.

8. Sharing of information

We share information only with parties that need it, under appropriate contractual safeguards:

• Clients: limited candidate data necessary to evaluate a shortlist (see Section 6).
• Service providers: payroll processors, hosting providers, analytics vendors, background-check firms, all bound by confidentiality and data-protection obligations.
• Authorities: when legally required (court orders, statutory filings, law-enforcement requests under Indian or applicable foreign law).
• Successors: in connection with mergers, acquisitions, or asset transfers, subject to confidentiality.

The service providers we use to run our hiring platform, and what each is for:

• Render (United States): hosting the platform and its database.
• Cloudflare R2: storing CVs and database backups.
• Resend: sending our emails.
• WhatsTool / Meta: sending WhatsApp messages, where we use them.
• Cal.com: booking your interview slot.
• Recall.ai: the interview notetaker that produces the transcript.
• Google: interview calls on Google Meet, reading CVs, screening the highest-ranked profiles against a role, and the fonts on our application pages.
• OpenAI: turning profiles and roles into the numbers used for matching.
• xAI: the detailed assessment made when a recruiter prepares to present you.
• Anthropic: analysing interview transcripts, writing interview questions, and drafting text.
• Sentry: error reports from our systems, with email addresses and phone numbers removed before they are sent.
• Vapi / Bolna, and the speech and AI services they use for the call (such as Deepgram and OpenAI): AI voice interviews, only where a role uses one instead of a recruiter interview.

We do not sell personal information, and we do not use it for advertising.

9. Cross-border data transfers

withRemote operates in India (registered in Gujarat), the United States, Canada, and the United Arab Emirates. Information may be transferred between these jurisdictions and to our service providers in other countries.

Our systems run on servers in the United States. Most of the providers listed in Section 8 are outside India, and so are most of the clients we introduce candidates to, so candidate information is transferred out of India, and into and out of the EU or UK where a client is there.

Where transfers are made out of India to jurisdictions notified under the DPDP Act, we ensure such transfers are permitted under Section 16 of the Act. Where transfers are made into the EEA / UK, we use Standard Contractual Clauses or equivalent safeguards.

10. Messages we send you, and how to stop them

We contact you by email, and by WhatsApp where we use it. A recruiter may also phone you, or send you a WhatsApp or text message from their own phone with your personal link, for example when our email has not reached you. If a role uses an AI voice interview by phone, you may get an automated call for it. Cal.com, which we use to book interviews, sends its own booking emails.

If you answered our questions, booked an interview or interviewed, we tell you when your process with a role ends.

You can stop our messages in three ways:

• Stop one role: our emails about a role, such as invitations, reminders and the booking emails we send, carry a "not interested" link for that role, and you can reply "not interested" to our WhatsApp message about it. The email telling you that your process with a role has ended does not carry this link.
• Stop all email: your email app's Unsubscribe button, where it shows one, stops every email our hiring platform sends to that address, about any role. It does not stop WhatsApp messages.
• Stop everything: reply STOP to any WhatsApp message from us, or write to us and say you want no further contact. Nothing automated reaches you again, on any role, by email or WhatsApp.

Emails inviting you to join our talent network carry their own unsubscribe link, which also stops every email our hiring platform sends to that address. We remember your email address, so being removed from and re-added to a mailing list does not bring you back.

Asking us to stop does not delete anything. Deleting is a separate request (see Section 13).

11. Data retention

We retain personal data only as long as necessary for the purposes described, to comply with legal obligations under Indian or applicable foreign law (including statutory retention periods for tax, employment, and corporate records), to resolve disputes, and to enforce agreements.

Candidate profiles in our talent database are retained for up to 36 months after last activity unless you ask us to remove them earlier. Financial and employment records related to engaged personnel are retained for 8 years under Indian tax law.

Interview transcripts and assessments are kept with your profile, for up to 36 months after your last activity.

We keep no interview video or audio at all. The notetaker service's own recording is covered in Section 5.

Information we delete can remain in our backups until those backups are deleted.

12. Security

We implement reasonable security practices and procedures as required by the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (equivalent to ISO 27001 controls), including encryption in transit, access controls, vendor due diligence, audit logging, and least-privilege design.

No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

13. Your rights

Here is how to stop our messages, or have your information deleted:

• Stop one role: use the "not interested" link in an email about that role, or reply "not interested" to our WhatsApp message about it.
• Stop all email: press Unsubscribe in your email app, where it shows one, on any email from us. It stops every email our hiring platform sends to that address, but not WhatsApp messages.
• Stop everything: write to bhavya@withremote.ai and say you want no further contact, or reply STOP to any WhatsApp message from us.
• Delete me: write to bhavya@withremote.ai from the email address we hold for you (or tell us which one to look for) and ask for deletion. We delete your record from our hiring system and confirm when it is done. Copies can remain in our backups until those backups are deleted. If you unsubscribed from our emails, we keep your email address on a do-not-email list so we do not email you again.

Asking us to stop does not delete your information, and deleting it does not undo a decision a client has already made. If you want both, ask for both. A stop request made on WhatsApp or by writing to us is deleted along with your record; an email unsubscribe is not, because we keep the address on our do-not-email list.

13.1 Under the DPDP Act (India)

If you are a Data Principal under the DPDP Act, you have the following rights:

• Right to access information about personal data processed by us.
• Right to correction and erasure of personal data.
• Right to grievance redressal.
• Right to nominate another individual to exercise rights on your behalf in case of incapacity or death.

To exercise any right, contact our Grievance Officer (details in Section 16). We will respond within the timeframes required by the DPDP Act.

13.2 Under foreign law (where applicable)

If you are located in the EEA, UK, California (CCPA/CPRA), or other jurisdictions with specific data subject rights, you may have additional or different rights, including the right to data portability, the right to object to processing, and the right to object to profiling.

14. Children

Our services are not directed to individuals under 18. We do not knowingly collect personal data from children. Under Section 9 of the DPDP Act, we are required to obtain verifiable consent from the parent or lawful guardian before processing personal data of a child. If you believe a child has provided us personal data, contact us and we will delete it.

15. Changes to this policy

We may update this Privacy Policy. Material changes will be posted on this page and, where required by law, communicated by email. The "Last updated" date at the top reflects the most recent revision.

16. Grievance Officer & contact

As required under Section 5(9) of the Information Technology Rules, 2011 and Section 8(10) of the DPDP Act, 2023, we have appointed a Grievance Officer:

• Name: Bhavya Mehta, Co-Founder & CEO
• Email: bhavya@withremote.ai
• Phone: +1 (480) 418-6390

We aim to acknowledge grievances within 24 hours and resolve them within 30 days.

Questions about an application or an interview: hiring@withremote.ai.