Privacy Policy

Credait Platform Private Limited (“Credait”, “we”, “us”) runs credait.com and the Credait platform, a skills-based hiring platform that connects candidates and employers across India. This policy explains what personal data we collect, why we collect it, who can see it, how long we keep it, and the choices and rights you have under Indian law, including the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000 and the rules under it. For the personal data covered here, Credait is the “Data Fiduciary”.

The short version

We collect only what we need to run your account and match you with employers: your name, email, mobile number, date of birth, city and state, plus the skills and credentials you add.
We do not ask for resumes, ID documents, photos or videos, and we never see your card or bank details.
You control whether employers see your name, email and mobile number, and whether employers may approach you at all.
We do not sell your personal data.
You can correct, download a summary of, or erase your data, and withdraw your consent, at any time.
Credait is for adults aged 18 and above.

1. Who this policy applies to

This policy applies to candidates who register on Credait, employers and recruiters who use Credait to find candidates, and visitors to our website. It also covers personal data collected for us by net centers, DTP offices and similar partners, and profiles added by other Credait users (see Section 11).

If you registered before the effective date above, this policy is the notice describing how we process your data. You may withdraw your consent at any time (see Section 14).

2. Personal data we collect

From candidates

Identity and contact details: name, email address, mobile number, date of birth, city and state.
If you sign in with Google, LinkedIn or Meta (Facebook), we receive your name and email address from that provider. You still give us your mobile number, date of birth, city and state directly. We do not receive any other data from these providers.
Profile information: skills, subject expertise, qualifications, experience, availability and other credentials you choose to add.
Account activity: login dates (used to keep your availability status accurate), your privacy settings and messages sent through the platform.
Technical data: IP address, device and browser type, operating system, pages visited and time stamps.

We collect only the city and state you tell us. We do not collect your precise (GPS) location.

We do not ask for resumes, government ID documents, photos or videos. If we ever introduce identity verification, we will update this policy and ask for your consent before collecting any such data.

If someone else adds you. We collect the same details as for any candidate, including your date of birth and mobile number, from the person adding you. We also record who added you and that you confirmed by OTP (see Section 11).

From employers and recruiters

Name, designation, company, email address, phone number and city.
GST and billing details needed to issue invoices.
Platform activity: searches, tokens purchased and used, and messages sent to candidates.
Payment confirmations from our payment partner. We do not receive or store card, UPI or bank account details.

From website visitors

Technical data and cookie data (see Section 8).
Details you submit through forms, such as a request for free search tokens (name, contact number, email, company, designation and city).

3. Why we use your personal data

We use your personal data for the following purposes, and only for these purposes:

To create and manage your account, including making sure one mobile number is used for only one account, and sending a one-time password by SMS if you reset your password.
To show your profile to employers according to your privacy settings and let employers find and contact you.
To match candidates with employers using our matching algorithm.
To keep your availability status current.
To process employer purchases, issue GST invoices and meet our accounting and tax obligations.
To send service messages, such as account and security alerts, messages from employers and changes to our policies.
To send marketing messages, only if you have opted in.
To provide support, handle grievances, prevent fraud and misuse, and enforce our terms.
To understand and improve Credait through analytics, using aggregated or de-identified data wherever possible.
To comply with the law.

If we want to use your personal data for a new purpose, we will update this policy and, where the law requires, ask for your consent first.

We process your data on the basis of your consent, given when you register, and for the legitimate uses the law allows, such as complying with legal obligations. Marketing messages have a separate opt-in that is not a condition of using Credait.

4. What employers can see, and your controls

Employers receive a ranked list of up to 20 candidates for each search. Employers can see your name, email address, mobile number, age (not your date of birth), city, availability status and credentials such as skills and subject expertise.

You are in control of this:

Contact privacy switch. You can set your name, email and mobile number to private. If you do, employers cannot see them. An employer who is interested can send you a message through the platform, and you decide whether to reveal your contact details.
Availability flags. Green means you are available to join immediately. You keep a green flag by logging in at least once every 32 days; if you do not, it changes to yellow, meaning you are available in two weeks or more. Red means you do not want to be approached, whether for full-time, part-time or freelance work.
Automatic red flag. If you manage your profile yourself and do not log in for six months, we set your status to red so that employers do not approach you. Worker profiles added by someone else, which contain only basic work details, follow the yearly confirmation in Section 11 instead.
Deactivation. You can deactivate your account from Settings. This removes your profile from employer search and starts the erasure process in Section 10.

When an employer receives your contact details, they use them for recruitment under our terms, which forbid resale, bulk marketing and any unrelated use. Once an employer has your details, they are responsible for how they handle them. If you believe an employer has misused your details, write to us (Section 16).

We keep a record of which employers were shown your profile, and of which employers you allowed to see your private contact details. You can ask for this record under Section 14.

5. How matching works

Our platform matches candidates and employers using Credait’s own matching algorithm, which compares the credentials candidates add with what employers search for. The matching on the platform does not use generative AI or large language models. Results are suggestions to help employers; hiring decisions are made by employers, not by Credait.

If we introduce AI-assisted features that process identifiable personal data, we will update this policy before doing so and ask for your consent where the law requires.

6. Who we share personal data with

Employers, as described in Section 4.
Service providers who process data on our behalf under contract, such as our cloud hosting provider (DigitalOcean), our payment partner (Paytm), our SMS and email providers, and Google Analytics. They may use your data only to provide their service to us.
Sign-in providers (Google, LinkedIn, Meta), if you choose to use them. Their own privacy policies apply to their handling of your data.
Net centres and DTP offices that collect registrations on our behalf (Section 11).
Authorities, courts and regulators, where the law requires or to protect the security of our platform.
A successor, if Credait is involved in a merger, acquisition or restructuring. Any successor must honour this policy.

We do not sell your personal data.

7. Where your data is stored

Our primary servers are in Bangalore, India, and we keep backup copies in Singapore. We transfer personal data outside India only to the extent the law permits, and we require our providers to protect it. If we change our hosting arrangements, we will update this policy.

8. Cookies and analytics

We use cookies and similar technologies for three purposes:

Essential cookies, which keep you logged in and keep the platform secure.
Analytics cookies (Google Analytics), which tell us how visitors use our website.
Marketing tags (Meta pixel), which help us measure our advertising campaigns.

We do not intentionally send your profile data to Google or Meta through these tools. You can accept or refuse non-essential cookies in our cookie banner and manage cookies in your browser settings. If you refuse cookies, some parts of the website may not work properly.

9. Payments and communications

Employer payments are handled by Paytm. We do not see or store card, UPI or bank account details; we receive only confirmation that a payment was made, and we issue GST invoices for it.

We send service messages by email, SMS or in the platform when needed to run your account. We send marketing messages only if you have opted in, and every marketing message tells you how to unsubscribe. You can also change your choice in Settings.

10. How long we keep your data

While your account is active, we keep your profile and account data.
If you stop using Credait, we set your status to red after six months without login (worker profiles added by someone else follow Section 11 instead). If we have no sign from you for 24 months, meaning no login and no yearly confirmation, we hide your profile from employers but keep it, so that you can restore it. If we have no sign from you for 5 years, we notify you at your registered email address or mobile number and, unless you respond, we erase your personal data or irreversibly anonymize it.
If you deactivate your account, withdraw your consent or ask us to erase your data, we erase your personal data within 30 days, except for records we must keep by law. Please checkout our User Data Deletion Policy
Records we must keep, such as employer invoices and payment records under tax and company law, security logs, and records of which employers were shown your profile, are kept for as long as the law requires or as needed to resolve a dispute, and then deleted.
Anonymized data that can no longer identify you may be kept for analytics and research.

11. Profiles added by others, net centers and DTP offices

Some candidates register through net centers, DTP offices and similar partners. Each partner signs a contract with us under which they collect your information only on Credait’s behalf, only for registering you on Credait, and with appropriate safeguards. They may not keep or use your data for any other purpose. You have the same rights over this data as over data you give us directly.

Add Associate. A registered Credait user can add other adults, such as family members and friends, using our Add Associate feature. Net centers and DTP offices use the same feature. The person being added must have their own mobile number and a date of birth, and must be at least 18.

Before the person adding you can enter any details for you, we send a one-time password (OTP) to your mobile number. Your profile is created only after that OTP is entered. The OTP message tells you who is adding you and where to read this policy. Entering the OTP confirms that you know about the profile and agree to it.

You can take over a profile that someone added for you at any time by logging in with your own mobile number (use Forgot Password). You can then edit it, change your privacy settings, deactivate it or delete it.

Profiles managed by someone else. Many workers are hired seasonally and may not log in often. If someone else added your profile and it contains only basic work details (contact details, skills, tools or software, and languages), we do not change your availability status because of inactivity. Instead, once a year we ask you, by SMS or a recorded call in the language you told us you speak, to confirm that you still want to be listed. If we have no sign from you for 24 months, we hide your profile from employers but keep it, and we erase it only after the period in Section 10.

12. Security

We use reasonable security safeguards to protect your personal data, including access controls, encrypted connections, backups and monitoring. No system is perfectly secure, so we cannot guarantee absolute security. If a personal data breach affects you, we will notify you and the Data Protection Board of India as the law requires.

13. Age eligibility

Credait is for people aged 18 and above. We ask for your date of birth at registration, and our system does not allow anyone under 18 to register. We do not knowingly process the personal data of children. Providing a false date of birth breaks our terms. If we learn that a person under 18 has registered, we will close the account and erase the data. A parent or guardian who believes a child has registered can contact our Grievance Officer (Section 16).

Every profile added by someone else must include a date of birth, and our system does not accept anyone under 18. The person adding a profile must confirm that the date of birth is correct.

14. Your rights

Under the DPDP Act you have the right to:

Access a summary of the personal data we process about you and of the parties we have shared it with.
Correct inaccurate data and complete or update it.
Erase your personal data.
Withdraw consent at any time. This is as easy as giving it. Withdrawal does not affect processing that happened before, and we may no longer be able to provide the service.
Grievance redressal, as set out in Section 16.
Nominate another person to exercise your rights if you die or become unable to act.

You can edit your profile, privacy switch and flags from Settings. For anything else, write to [email protected]. We may ask you to confirm your identity before acting on a request, and we respond within 30 days.

If someone else added your profile, you can exercise all of these rights yourself by logging in with your own mobile number.

If you signed in with Meta (Facebook), you can also ask us to delete your data by following the steps at User Data Deletion Policy.

15. Your responsibilities

Please give us accurate information, do not register using another person’s details or a false date of birth, and do not submit false or frivolous complaints. The DPDP Act places these duties on every user.

16. Grievance Officer

If you have a question or complaint about your personal data, contact our Grievance Officer:

Name: Siva Rama Krishnan
Designation: Grievance Director
Email: [email protected] (please use the subject line “Privacy Grievance”)
Address: Credait Platform Private Limited, 13/6 East 1^st Main Road, Shenoy Nagar, Chennai 600030

We acknowledge complaints within 7 days and resolve them within 30 days of receiving them. If you are not satisfied after using this process, you may approach the Data Protection Board of India as provided in the DPDP Act.

17. Language and changes to this policy

This policy is available in English. You may ask for a copy in any language listed in the Eighth Schedule to the Constitution of India by writing to [email protected].

We may update this policy. The “effective” date at the top shows the current version. For material changes, we will notify you by email or when you next log in before the change applies, and we will ask for your consent again where the law requires.

This policy is governed by the laws of India.