Walkin24 Privacy Policy

HIRECAM.AI Pvt Ltd ("Walkin24", "we", "us"), decides how and why your personal data is used on the Walkin24 website, apps and services (the "Services"). This Policy explains how we collect, use, share, keep and protect your personal data and how you can exercise your rights. It should be read with our Terms & Conditions and our Cookie Policy, both available on our website.

This Policy is written to meet the Information Technology Act, 2000 and the rules made under it, and is designed to meet the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 as their provisions come into force.

When we ask for your consent for a particular feature, we also show a short notice on screen at that moment listing the data involved and why. You can read these notices in English.

The Services are only for people aged 18 or older, including college and university students, graduates, freshers and working professionals. We do not offer accounts to anyone under 18 and do not knowingly collect their personal data. We ask for your date of birth at sign-up and do not allow an account to be created if it shows you are under 18. If we learn that an account holder is under 18, we suspend the account and, once confirmed, delete their personal data, apart from records the law requires us to keep.

We ask only for what the features you use need. Fields not marked as required are optional, and you can use the Services without completing them.

We will not use your data for a new purpose without telling you first. Where a new use needs fresh consent, we ask for it through a separate, active consent step and do not start the new use until you give it.

Accepting our Terms & Conditions is not the same as giving consent to use your data. Each consent is asked for separately and nothing is pre-ticked. Saying no to an optional item, such as LinkedIn auto-fill, does not stop you using features that do not need it. Using your camera is always your choice (see "Camera analysis").

You can withdraw any consent at any time in your account settings, as easily as you gave it. Before you confirm, we tell you what withdrawing will affect. After withdrawal we stop the processing and delete data held only for that purpose, unless the law requires us to keep it. Processing carried out before you withdrew remains lawful.

The microphone is used only when you start an interview practice session and allow it on your device. Interview answers are given by voice.

When you answer by voice, your audio is captured in your browser, sent over an encrypted connection to our servers and passed to our speech-to-text provider, OpenAI, for transcription. Once transcription is complete, the audio is discarded from memory. We never save your audio to our storage or database.

Under its standard terms for business (API) customers, OpenAI may keep inputs, including audio, for up to 30 days to monitor for abuse and misuse, and then deletes them, unless the law requires longer retention. OpenAI does not use this data to train its models.

We keep the text transcript and the AI-generated report in your account for 12 months from the date of each interview, unless you delete them sooner.

Using your camera is your choice: you can turn it on or off at any time using the camera control. When the camera is on, your live camera feed is analysed on your device to estimate observable presentation indicators, namely whether your face is in frame, gaze direction relative to the camera, head movement, expression changes, lighting and framing. Video never leaves your device and is not sent to Walkin24 or any service provider. Only the resulting indicators are saved to your account, as part of your interview report.

These indicators are personal data about you, and we treat them as sensitive. We do not use them to identify you, verify your identity or recognise your face, and we do not use them to make decisions about you or share them with employers or institutions. They are automated estimates and may not reflect your actual confidence, emotions or abilities. You can turn the camera off at any time and delete past results from your account.

We use third-party AI services to transcribe answers and to generate questions, feedback, reports and resume suggestions. OpenAI provides speech-to-text and AI feedback. These providers process your content on our instructions under contracts that require security and confidentiality.

We do not use your content to train AI models, and our AI providers are not permitted to use it to train theirs.

Our AI does not make decisions about you that have legal or similarly significant effects, such as hiring or admission decisions. Scores and feedback are practice aids only.

We do not sell personal data. We share it only:

• with service providers acting for us: Google Cloud, which hosts the Services in its Mumbai, India data centre; OpenAI for speech-to-text and AI feedback; our email service provider, to send sign-up verification codes (email OTP) and service emails; Zoho, to manage customer support enquiries; and analytics tools, only if you allow analytics cookies;
• with Razorpay, to process your payments. Razorpay also processes some payment data for its own regulatory obligations as a payment service provider, under its own privacy policy;
• with LinkedIn, only if you choose to connect it, under LinkedIn's own terms;
• with anyone you choose, such as when you download and send your own resume or report to an employer or institution;
• with government authorities, courts or regulators where the law requires it; and
• with a buyer or successor in a merger or reorganisation, under the same protections.

Our service providers must use your data only on our instructions, protect it, and delete it when we tell them to.

We host the Services and store your data in India, on Google Cloud in Mumbai. OpenAI, which provides speech-to-text and AI feedback, may process your audio and the content needed to generate feedback outside India, including in the United States. We transfer data outside India only as permitted by Indian law, including any country restrictions the Government notifies, and we require the same level of protection by contract.

If you do not use your account for 12 months, we will remind you by email and then delete it unless you log in.

We use reasonable security measures, including encryption in transit and at rest, access controls, logging and monitoring, and backups, and we require our service providers to do the same. No system is completely secure. If a personal data breach affects you, we will tell you promptly, explaining what happened, the likely consequences and the steps you can take, and we will notify the relevant authorities, including CERT-In and the Data Protection Board of India, as the law requires.

You can:

• get a summary of the personal data we hold about you, how we use it, and the categories of people we have shared it with;
• correct, complete or update your data;
• delete individual items or your whole account;
• download your resumes and reports;
• withdraw any consent;
• nominate someone to exercise your rights if you die or become unable to act; and
• raise a grievance with us, and then with the Data Protection Board of India.

We offer these rights now, even where the law does not yet require them. Most requests can be made in your account settings; you can also write to privacy@walkin24.com. We may need to confirm your identity before acting. Some data may have to be kept where the law requires it, and we will tell you if so.

We do not currently send marketing emails or messages. If we decide to do so, we will ask for your separate opt-in first, and every message will include a simple way to opt out. We do not show targeted advertising within the Services. Service messages, such as sign-up verification codes, security alerts, receipts and notices of changes to our Terms or this Policy, are sent as part of the Services.

We update this Policy when our practices change and show the new effective date. For changes that materially affect how we use your data, we email you at least 30 days before the change takes effect, with a summary and a link to the revised Policy, and we may also show an in-app notice. Where a change needs fresh consent, we ask for it through a separate, active consent step and do not apply the change until you give it.

We acknowledge grievances within 48 hours and resolve them within 5 working days, and always within the time the law requires. If you are not satisfied with the response, you can approach a Consumer Commission, the Data Protection Board of India, or any other competent authority.