Privacy Policy

A Plain-English Summary

• What we collect: Your account details (name, email, phone), your business details (company name, GSTIN, billing address), and the data you put into ClustrOps about your clients and candidates.
• What we do with it: Run the ClustrOps service. Send you the emails and notifications you signed up for. Improve the product. Comply with Indian tax and regulatory law.
• What we never do: We do not sell your data. We do not rent it. We do not share it with advertisers. We do not use your candidate or client data to train AI models that benefit anyone other than you. We do not allow Aadhaar uploads on the platform.
• Your control: You can download all your data anytime. You can ask us to delete it. You can close your account whenever you want.
• Where it lives: Primarily on Amazon Web Services (AWS) servers, with a preference for India-based regions.
• Who to contact: support@clustrops.com for any privacy question, complaint, or request.

1. Who We Are

ClustrOps is a recruitment software product owned and operated by FlyHii Solutions Private Limited, a private limited company incorporated in India.

This Privacy Policy is published in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, the SPDI Rules, 2011, and other applicable Indian laws. Where users are located outside India, additional rights under the GDPR may apply, as described in Section 13.

2. The Data We Collect

2.1 Data You Provide Directly

Account information (mandatory):

• Full name, email address, phone number
• Password (stored in encrypted, hashed form — we cannot read your password)

Billing and invoicing information (optional, required only if you raise invoices through ClustrOps):

• Company name, GSTIN, PAN, billing address
• Bank account details (for receiving client payments through invoicing)
• Profile photo or company logo (only if you add one to your invoices)

Client data (data you input about the companies you recruit for):

• Company name, GSTIN, billing address, contact persons
• Signed contracts, MSAs, rate cards, and other uploaded documents

Candidate data (data you input about job candidates):

• Name, email, phone number, resume or CV
• Current CTC, expected CTC, notice period
• LinkedIn URL and other social profile URLs
• Interview feedback and internal notes you record

2.2 Data We Collect Automatically

• IP address and device information (device type, OS, browser type and version)
• Usage data (pages visited, features used, timestamps, actions taken)
• Login activity (successful logins, failed attempts, login location by IP region)
• Cookies and similar technologies (see our Cookie Policy)

We do not collect precise geolocation data.

2.3 Data We Do Not Collect or Allow

• Aadhaar numbers — not permitted on the platform. If detected, they will be removed.
• Other government-issued IDs (passport numbers, voter IDs, driving licences) — not collected as structured data fields.
• Sensitive personal data as defined under SPDI Rules — including biometric data, health information, sexual orientation, religious beliefs, caste, or political affiliation.

If you accidentally upload data of this kind, contact support@clustrops.com and we will delete it.

3. How We Use Your Data

4. Artificial Intelligence and Machine Learning

4.1 Current State

As of the effective date of this policy, ClustrOps does not use artificial intelligence, machine learning, or large language models to process your client data, candidate data, or invoice contents. We do not use your data to train any AI or machine learning model.

4.2 If We Introduce AI Features in the Future

If we introduce AI-powered features such as resume parsing or candidate matching, we commit to: giving you at least 30 days advance notice; clearly disclosing which AI providers we use; allowing you to opt out where technically feasible; and sharing only the minimum data necessary.

4.3 Hard Commitments That Will Not Change

• We will never sell your data to AI companies, data brokers, or any third party for their independent use.
• We will never use your candidate or client data to train AI models that benefit other customers without your explicit, opt-in consent.
• We will not allow our AI sub-processors to retain or train on your data beyond what is needed to deliver the feature you are using.

5. Sub-Processors and Third-Party Services

If we add, remove, or change a sub-processor in a way that materially affects your data, we will update this policy and notify you by email at least 30 days before the change takes effect. For the current list at any time, email support@clustrops.com.

6. Your Role as a Data Fiduciary

When you upload information about your candidates and clients into ClustrOps, you are the Data Fiduciary under the DPDP Act. We act as a Data Processor on your behalf.

• You are responsible for obtaining consent from candidates and clients before uploading their personal data.
• You are responsible for honouring data principal rights requests raised by your candidates and clients.
• We provide you with the tools (data export, deletion, search) to fulfil those obligations.

7. How We Share Your Data

• With sub-processors as described in Section 5, strictly for delivering ClustrOps to you.
• With your authorised users — team members you invite to your account.
• With third parties at your direction — for example, when you send a profile-share link to a client.
• For legal compliance — when required by a valid court order, lawful summons, or regulatory investigation. We will notify you where legally permitted.
• In a business transfer — if FlyHii Solutions Private Limited is acquired or sold, you will be notified at least 30 days in advance.

We do not share your data with advertisers, data brokers, or any party for marketing or profiling unrelated to ClustrOps.

8. Data Retention

9. Your Rights

• Right to access — Request a copy of the personal data we hold about you.
• Right to correction — Correct any inaccurate or incomplete data, including directly within ClustrOps.
• Right to erasure — Request deletion of your personal data, subject to legal retention requirements.
• Right to data portability — Download all your client, candidate, and invoice data in a standard format anytime.
• Right to withdraw consent — Where we rely on your consent, you can withdraw it at any time.
• Right to grievance redressal — Raise a complaint about how we handle your data (see Section 14).
• Right to nominate — Under the DPDP Act, you may nominate another person to exercise your rights in the event of your death or incapacity.

To exercise any right, email support@clustrops.com. We will respond within 30 days.

10. Security

• Encryption in transit — All data is encrypted using TLS 1.2 or higher.
• Encryption at rest — Passwords and uploaded files are encrypted at rest.
• Access control — Production systems are restricted to authorised personnel with multi-factor authentication.
• Audit logs — All access to production systems is logged and reviewed.
• Regular backups — Data is backed up regularly, with backups also encrypted.
• Vulnerability management — We monitor for security vulnerabilities and patch our systems promptly.

11. Data Breach Notification

In the event of a personal data breach that is likely to result in risk to your rights and interests, we will notify affected users within 72 hours of becoming aware of the breach, notify the Data Protection Board of India as required by the DPDP Act, and provide full details of what happened and what we are doing about it.

12. Cookies

We use cookies and similar technologies to operate ClustrOps. For full details on which cookies we use, why, and how to control them, see our Cookie Policy.

13. International Users and Cross-Border Data Transfers

ClustrOps is primarily intended for Indian recruiters. Our preferred hosting region is AWS Asia Pacific (Mumbai). If you access ClustrOps from outside India, your data will be transferred to, processed in, and stored in India.

If you are located in the EU, UK, or another GDPR-equivalent jurisdiction, you have additional rights including the right to lodge a complaint with your local data protection authority. Contact support@clustrops.com with the subject line "GDPR Request."

14. Grievance Officer and Complaints

We will acknowledge your grievance within 48 hours and resolve it within 30 days. If unsatisfied, you may escalate to the Data Protection Board of India.

15. Children

ClustrOps is a B2B product. You must be at least 18 years old to create an account. We do not knowingly collect personal data from individuals under 18. If we become aware of this, we will delete it promptly.

16. Changes to This Policy

For minor changes, we update the "Last Updated" date. For material changes (new data categories, new purposes, new sub-processor categories, AI features), we notify you by email and in-app at least 30 days before the change takes effect.

17. Governing Law and Jurisdiction

This Privacy Policy is governed by the laws of India. Any disputes shall be subject to the exclusive jurisdiction of the courts at Hyderabad, Telangana, India.