Privacy Policy

Version: 1.0
Effective Date: To be updated before public launch
Platform: Diplotix
Contact: support@diplotix.com

Diplotix is a pre-launch / beta hiring platform for candidates, recruiters, partners, and platform administrators. This Privacy Policy explains what information we collect, how we use it, when it may be shared, and how you can contact us about privacy requests.

This policy is written for our India launch. If Diplotix later expands to other countries, we may update this policy to reflect additional legal requirements.

Contact us at support@diplotix.com for privacy, support, or legal questions.

1. Introduction

Diplotix helps candidates create profiles, discover jobs, save jobs, apply to roles, and manage hiring-related information. Diplotix also helps recruiters create company profiles, post jobs, review applications, manage hiring workflows, use decision-support tools, and manage subscriptions. Diplotix includes a partner program for referral tracking, commissions, and payouts.

We collect and use information only to operate, secure, improve, and support these services. We do not sell candidate resumes.

2. Scope

This policy applies to Diplotix websites, workspaces, dashboards, portals, forms, and related services.

It covers:

• Candidate accounts and candidate workspace features.
• Recruiter accounts, recruiter workspaces, company profiles, jobs, applications, billing, and hiring workflows.
• Partner applications, partner profiles, referral tracking, commissions, and payouts.
• Admin operations, support, security, billing, audit, and fraud-prevention activities.
• AI-assisted recruiter features that are currently implemented.

This policy does not replace separate agreements or terms that may apply to recruiters, partners, or paid subscriptions.

3. Information We Collect

Account Data

We collect account and authentication information such as:

• Name.
• Email address.
• Phone number, where provided.
• Role or account type, such as candidate, recruiter, partner, or admin.
• Profile image or avatar, where provided.
• Authentication provider information.
• Email verification status.
• Session and sign-in information.
• Account status, onboarding status, admin status, and suspension status where applicable.

Diplotix uses Supabase for authentication. Users may sign in with email magic links or OTPs. Google OAuth is also implemented for sign-in. Admin password flows are used for admin-managed access where applicable.

Candidate Data

Candidates may provide or generate information such as:

• Candidate profile details, including headline, current title, summary, location, skills, tools, languages, work preferences, notice period, salary expectations, and visibility settings.
• Resume files and resume URLs.
• Education, employment history, certifications, projects, portfolio links, and social links.
• Saved jobs, saved searches, blocked companies, and job preferences.
• Applications, screening answers, application status, application timestamps, resume selected for an application, and related job information.
• Candidate settings, notification preferences, and privacy settings.

Candidate-facing resume parsing is currently disabled. Resume upload remains available.

Recruiter Data

Recruiters may provide or generate information such as:

• Recruiter name, work email, phone number, title, avatar, and profile details.
• Company profile information, including company name, logo, website, slug, size, industry, location, description, hiring status, hiring departments, workplace preferences, hiring volume, preferred skills, salary transparency, and verification details.
• Job posts, job descriptions, screening questions, salary ranges, job status, job activity information, and job visibility state.
• Applications and hiring workflow information, including statuses, stage history, interviews, feedback, offers, candidate notes, recruiter notes, messages, talent pool entries, tags, saved candidate searches, and candidate search alerts.
• Team and workspace information, such as members, invitations, roles, and workspace access requests.
• Billing, subscription, plan, and usage information.

Partner Data

Partners and partner applicants may provide or generate information such as:

• Full name, work email, phone number, company name, role, audience, monthly reach, promotion plan, and LinkedIn profile.
• Partner application status and review metadata.
• Partner profile information, partner code, referral codes, referral events, referral attributions, referral cookie identifiers, commission records, payout method details, payout batches, payout items, and partner audit events.
• Payout method information currently includes account holder name and UPI ID where provided.

Billing Data

Recruiter subscriptions and billing flows may involve:

• Plan, billing interval, subscription status, trial status, billing period, usage, and entitlement information.
• Payment provider identifiers such as customer IDs, subscription IDs, payment IDs, invoice IDs, refund IDs, and webhook event IDs.
• Amounts, currency, payment status, refund status, and dispute or chargeback-related information.

Diplotix supports Razorpay and Stripe billing flows. INR is the current launch currency for India.

AI Interaction Data

Diplotix currently implements recruiter-facing AI decision-support features through OpenRouter. These features can generate candidate insights, interview questions, candidate comparisons, and hiring recommendations.

AI-related information may include:

• Job and application context.
• Candidate profile and application information that the recruiter is authorized to view.
• Screening answers, interview feedback, match scores, and other hiring workflow information.
• AI prompts or prompt payloads prepared by the service.
• AI outputs, such as summaries, strengths, risks, suggested questions, comparisons, recommendations, and usage metadata.
• AI feature usage, model, token, credit, cost, and audit metadata.

The product attempts to remove or reduce direct identifiers in AI prompt payloads where feasible, but free-text fields and documents may still contain personal information.

Device, Browser, And Technical Data

We may process technical information such as:

• IP address.
• Browser and device information.
• Pages or routes requested.
• Session, request, and security metadata.
• Rate-limit and abuse-prevention metadata.
• Diagnostic and error information.
• Search, company profile, and referral event metadata.

Some of this information may be processed by our infrastructure and service providers.

Cookies And Browser Storage

We use cookies and browser storage for authentication, session continuity, security, referral attribution, and product flows.

Examples include:

• Supabase authentication/session cookies.
• Role and continue-path helper cookies used during sign-in and onboarding.
• Partner referral cookies named diplotix_partner_referral and diplotix_partner_visitor, currently used for referral attribution with a 90-day referral window.
• Local storage used for role or continuation helpers, attribution, saved filters, saved views, or other product preferences.
• Cookies or storage set by third-party providers during selected flows, such as Google OAuth, Razorpay checkout, Stripe checkout or portal, and diagnostics providers.

We do not currently operate a dedicated advertising cookie system in the audited product.

Support Requests

If you contact us, we may collect:

• Your name, email, and contact information.
• The content of your message.
• Account, billing, application, partner, or technical context needed to respond.
• Internal notes, support status, and related audit information.

4. How We Use Information

We use information to:

• Create, authenticate, and manage accounts.
• Provide candidate profiles, job discovery, saved jobs, applications, profile completion, settings, and notifications.
• Provide recruiter profiles, company profiles, job posting, application review, hiring workflow, team access, billing, reports, and support.
• Provide partner applications, referral tracking, attribution, commission ledger records, payout methods, payout batches, and partner reporting.
• Process subscriptions, trials, invoices, payments, refunds, chargebacks, and billing webhooks.
• Generate and store recruiter AI decision-support outputs where the feature is used.
• Match candidates and jobs using platform logic.
• Send service emails, notifications, support messages, partner messages, and operational communications.
• Maintain audit logs, security logs, billing logs, and partner audit events.
• Detect, investigate, prevent, and respond to fraud, abuse, unauthorized access, fake accounts, fake jobs, payment disputes, referral abuse, scraping, and security incidents.
• Improve the service, debug issues, monitor performance, and understand feature usage.
• Comply with legal, tax, accounting, dispute, security, and regulatory obligations.

5. AI Processing

Diplotix uses OpenRouter for implemented recruiter-facing AI features.

Recruiter AI features are intended to support human review. They are not designed to make final hiring decisions automatically. Recruiters remain responsible for reviewing AI outputs, checking accuracy, avoiding discriminatory use, and making lawful human hiring decisions.

AI outputs may be inaccurate, incomplete, biased, or based on incomplete context. We do not treat AI outputs as guarantees about a candidate, job, recruiter, or hiring outcome.

Candidate-facing resume parsing is currently disabled. Deterministic candidate-job matching is performed by platform logic and does not require a third-party AI provider.

We may store AI outputs and AI usage records in the platform so recruiters can view prior outputs, manage workflow history, enforce plan limits, audit usage, and operate the service.

6. Recruiter Access

When a candidate applies to a job or otherwise participates in an authorized recruiter workflow, authorized recruiters and their permitted team members may access relevant candidate information, such as:

• Candidate profile information.
• Resume or resume URL.
• Application information and screening answers.
• Application status and stage history.
• Interview, feedback, offer, note, message, match, and AI decision-support records where applicable.

Recruiters are expected to use candidate information only for lawful hiring purposes. Diplotix admins may access candidate and recruiter information for support, security, billing, audit, moderation, fraud-prevention, and platform operations.

7. Candidate Privacy

Candidates can manage many profile, settings, visibility, and notification choices in the product.

Candidate resumes are treated as sensitive hiring documents. They may be made available to recruiters in connection with applications or other authorized hiring workflows. Resume storage is implemented through Supabase Storage, and the product uses controlled access patterns where available. Because storage and access settings can depend on production configuration, we avoid claiming that every historical or provider setting has been independently verified.

Candidate profiles may include public or recruiter-visible elements depending on product settings and route behavior. If you have questions about your profile visibility, contact support@diplotix.com.

8. Partner Data

Diplotix processes partner data to:

• Review partner applications.
• Create and manage partner profiles.
• Generate and manage referral codes.
• Track referral visits, attribution, and eligible referred recruiters.
• Maintain commission ledger records.
• Manage payout methods, payout batches, payout items, and payout status.
• Audit referral, commission, payout, suspension, recovery, and partner lifecycle events.
• Detect and investigate referral abuse, self-referrals, fake recruiters, payment reversals, chargebacks, and commission disputes.

Partner referral cookies and visitor identifiers may connect a referred recruiter signup or recruiter profile to a partner referral code within the referral window.

9. Billing Information

Diplotix uses Razorpay and Stripe for payment and subscription flows. These providers may process payment, customer, subscription, invoice, refund, dispute, and checkout information according to their own terms and privacy notices.

Diplotix stores billing records needed to operate subscriptions, verify payments, reconcile webhooks, enforce plan access, handle trials, process refunds or chargebacks, and maintain financial and audit records.

We do not store full card numbers in the platform code we audited. Payment details are handled by the payment providers.

10. Cookies

Cookies and browser storage help Diplotix keep users signed in, complete sign-in or onboarding flows, remember selected preferences, support referral attribution, secure the service, and operate third-party checkout or OAuth flows.

Some cookies are essential for authentication, security, or core platform functionality. If you block essential cookies, parts of the service may not work.

Referral cookies may be used to attribute a recruiter to a partner referral. The current referral window is 90 days.

Third-party providers, such as Google, Razorpay, Stripe, Supabase, and Sentry, may set or use cookies or similar technologies during the flows they support. Exact cookie names and durations can change based on provider configuration and browser behavior.

You can manage cookies through your browser settings. Diplotix does not currently provide a full cookie preference center in the audited product.

11. Third-Party Services

We use the following third-party services in the audited product:

We may also use hosting, infrastructure, network, and browser technologies needed to serve the website and application, but the specific production hosting provider was not finalized in the source materials used for this policy.

12. Data Retention

We keep information for as long as needed to provide the service, operate accounts and workspaces, support users, maintain security, comply with legal and financial obligations, resolve disputes, and enforce platform rules.

Retention depends on the type of information:

• Account and profile data is generally kept while the account is active or as needed for support, security, audit, or legal reasons.
• Candidate resumes and applications are kept while needed for candidate, recruiter, hiring workflow, support, dispute, or legal purposes.
• Recruiter company profiles, jobs, team records, applications, and hiring workflow records are kept while the recruiter workspace or related records remain active or as needed for business, legal, dispute, or audit reasons.
• Billing, subscription, invoice, payment, refund, dispute, webhook, commission, and payout records may be kept for tax, accounting, audit, fraud-prevention, reconciliation, and dispute purposes.
• Audit logs, security logs, admin logs, partner audit events, and fraud-prevention records may be kept after account closure where needed to protect the service or comply with obligations.
• AI outputs may be kept with the related recruiter, application, or workflow record. AI usage records may be kept for billing, audit, credit, abuse-prevention, and operational purposes.
• Notification preferences may be kept while your account is active or until replaced by updated preferences. Notification delivery records may be kept for operational and support purposes.
• Partner referral cookies are currently used with a 90-day referral window.

We do not yet provide a fully automated deletion or export workflow for all account types. If you want to request deletion or export, contact us.

13. Data Security

We use technical and organizational measures intended to protect information, including authentication, authorization checks, Supabase row-level access controls where configured, admin access gates, audit logging, webhook signature verification, service-role separation, and operational review processes.

No online service can guarantee perfect security. We do not claim ISO certification, SOC 2 certification, or any specific security certification in this policy.

You are responsible for keeping your account access secure, using trusted devices, and contacting us if you believe your account has been compromised.

14. User Rights

Depending on your role, location, and applicable law, you may be able to request that we:

• Provide access to personal information associated with your account.
• Correct inaccurate information.
• Delete information where deletion is available and no retention exception applies.
• Export certain information associated with your account.
• Restrict or object to certain processing, including some AI-related or marketing-related processing where applicable.

Some information can be edited directly in the product. For requests that are not available in the product, contact support@diplotix.com.

We may need to verify your identity before acting on a request. We may also need to retain certain records for security, fraud prevention, tax, accounting, audit, legal, dispute, or platform integrity reasons.

15. Account Deletion

Candidate settings include deactivation and deletion-related UI, but full self-serve account deletion is not fully automated in the audited product.

To request account deletion, contact support@diplotix.com.

When we process a deletion request, we may delete, restrict, or anonymize information where appropriate. We may retain information when needed for:

• Billing, tax, accounting, payout, refund, chargeback, or financial records.
• Audit logs, security logs, admin logs, and fraud-prevention records.
• Applications, recruiter hiring records, interviews, offers, notes, and related dispute records.
• Partner referral, commission, payout, recovery, and audit records.
• Legal obligations, enforcement, dispute resolution, or platform integrity.

Deactivation is different from deletion. Deactivation may limit account activity or visibility, but it does not automatically remove all records from the platform.

16. Data Export

Diplotix does not currently provide a fully automated self-serve export tool for all data categories.

You may request an export by contacting support@diplotix.com. We will review the request and provide information that we can reasonably provide, subject to identity verification, technical feasibility, confidentiality, legal limits, and the rights of other users or companies.

Exports may exclude internal security records, confidential recruiter or company information, admin notes, fraud-prevention records, privileged information, or information that we are not legally required or permitted to provide.

17. International Transfers

Diplotix is prepared for an India launch, but some service providers may process or store information in other countries. This may include providers used for authentication, database, storage, payments, email delivery, diagnostics, AI processing, infrastructure, or support.

By using Diplotix, your information may be processed in India and in other locations where our providers operate. We take provider location and transfer requirements into account when choosing providers and updating this policy.

18. Children's Privacy

Diplotix is an employment and hiring platform. It is not intended for children.

You should not use Diplotix if you are not old enough to lawfully use an employment platform or provide account information in your location. If we learn that we have collected information from a child in a way that is not allowed, we may restrict or delete the account and related information, subject to legal and safety obligations.

If you believe a child has provided information to Diplotix, contact support@diplotix.com.

19. Policy Updates

We may update this Privacy Policy as the product, providers, legal requirements, or business operations change.

If we make material changes, we will update the date at the top of this policy and may provide additional notice through the product, website, email, or another reasonable method.

20. Contact

For privacy, support, or legal questions, contact:

Diplotix
Email: support@diplotix.com