Privacy Policy

Overview

By accessing or using AROMA, you agree to the terms of this Privacy Policy. If you do not agree, please discontinue use of our services. This policy is governed by the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023 (DPDPA), and applicable data protection laws.

Information We Collect

Account & Profile Data

When you register for AROMA or use our platform, we collect:

• Name, email address, phone number, and job title
• Organisation name and industry
• Login credentials (stored in encrypted form)
• Billing and subscription information

Recruitment Data

As part of the platform's core function, we process:

• Job descriptions and role requirements submitted by employers
• Candidate resumes, CVs, and application materials
• AI-generated shortlist scores and assessment notes
• Automated interview transcripts and video recordings (where enabled)
• Hiring pipeline status and recruiter comments

Usage & Technical Data

We automatically collect technical information including:

• IP address, browser type, and device information
• Pages visited, features used, and session duration
• Clicks, searches, and platform interactions
• Error logs and performance data

Communications Data

If you contact us directly, we retain records of emails, support tickets, and feedback submitted through the platform.

Third-Party Meeting Links (Google Meet)

To facilitate interview scheduling, AROMA programmatically generates Google Meet links. In this process,AROMA collects and stores the email addresses of recruiters and candidates solely to distribute meeting details. Outside of these email addresses, AROMA does not access, collect, or store any other data from users’ Google accounts.

AROMA does not require users to authenticate with Google or grant access to their Google accounts at any point.

How We Use Your Data

We use your information to:

• Deliver the Service: Process job postings, screen candidates, conduct AI interviews, and manage hiring pipelines.
• Improve the Platform: Analyse usage patterns to enhance features, fix bugs, and optimise performance. AI model training uses aggregated, anonymised data only.
• Account Management: Authenticate users, manage subscriptions, and send billing notifications.
• Support: Respond to inquiries, troubleshoot - issues, and communicate product updates.
• Meeting Links for Interviews: AROMA may generate Google Meet links and share them with candidates and recruiters via email for interview purposes. We do not create, modify, or manage calendar events in users’ Google Calendars. Users are free to create or manage calendar events independently.

We do not sell your personal data or candidate data to third parties, and we do not use candidate data for advertising purposes.

Data Sharing

We share data only in the following limited circumstances:

Service Providers

We work with trusted third-party providers who process data on our behalf under strict confidentiality agreements, including:

• Amazon Web Services (AWS): Cloud infrastructure, storage (S3), database (RDS), and AI services (Amazon Bedrock)
• No third-party meeting platforms receive or process user data from AROMA. Meeting links (such as Google Meet) are shared via email without integration or data exchange with user accounts.
• Payment Processors: For subscription billing (payment card data is never stored on our servers)

Legal Requirements

We may disclose data if required by law, court order, or governmental authority, or to protect the rights, property, or safety of BizAcuity, our users, or the public.

Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you via email and/or prominent notice on our platform before your data becomes subject to a different privacy policy.

Data Storage & Security

AROMA is built on Amazon Web Services infrastructure. Data is stored in AWS data centres in US East (us-east-1 N. Virginia region) by default, with enterprise customers able to request alternative regional configurations.

We implement industry-standard security measures including:

• AES-256 encryption for data at rest
• TLS 1.2+ for all data in transit
• AWS Cognito for authentication with multi-factor authentication (MFA) support
• Role-based access controls (RBAC) limiting data access by job function
• Regular security audits and vulnerability assessments
• Access logging and monitoring for suspicious activity

While we take every reasonable precaution, no system is 100% secure. If a data breach occurs that affects your rights, we will notify you as required by applicable law.

Data Retention

We retain data for the following periods:

• Active account data: For the duration of your subscription, plus 90 days after account closure
• Candidate resumes and interview records: For the duration of the active recruitment cycle, or up to 12 months from upload, whichever is sooner — unless longer retention is required by law
• Billing records: 7 years, as required by Indian tax law
• Support communications: 2 years from resolution
• Anonymised analytics data: Indefinitely, as it contains no personal information

You may request early deletion of your data subject to legal and contractual obligations. See Your Rights below.

Your Rights

Under the Digital Personal Data Protection Act, 2023 (DPDPA) and applicable regulations, you have the right to:

• Access: Request a copy of the personal data we hold about you
• Correction: Ask us to correct inaccurate or incomplete data
• Erasure: Request deletion of your personal data, subject to legal retention obligations
• Data Portability: Receive your data in a structured, machine-readable format
• Withdraw Consent: Withdraw consent for processing where consent was the legal basis
• Object to Processing: Object to processing for direct marketing purposes
• Nominate: Nominate another person to exercise your data rights on your behalf

To exercise any of these rights, email us at info@bizacuity.com. We will respond within 30 days. We may ask you to verify your identity before processing your request.

If you are a candidate whose data was processed via AROMA (i.e., you applied for a job through a company using our platform), please contact the relevant employer directly. BizAcuity acts as a data processor on their behalf.

Cookies

AROMA uses cookies and similar technologies to ensure functionality and improve your experience. We use the following types:

• Essential Cookies: Required for authentication, session management, and core platform functionality. These cannot be disabled.
• Analytics Cookies: Help us understand how users interact with the platform (e.g., page views, feature usage). Used in anonymised, aggregate form.
• Preference Cookies: Remember your settings and choices (e.g., language, dashboard layout).

You can manage non-essential cookies via your browser settings or our in-platform cookie banner. Disabling analytics cookies will not affect your ability to use the platform.

Children's Privacy

AROMA is a business-to-business (B2B) platform intended for use by professionals aged 18 and above. We do not knowingly collect personal data from individuals under 18. If you believe a minor has submitted data through our platform, please contact us at info@bizacuity.com and we will promptly delete it.

Policy Changes

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform features. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Send an email notification to registered users
• Display a prominent notice within the platform for at least 30 days

Continued use of the platform after changes take effect constitutes acceptance of the revised policy.

Contact Us

For any questions, requests, or concerns about this Privacy Policy or our data practices, please contact:

You also have the right to file a complaint with the Data Protection Board of India if you believe your data has been processed in violation of the DPDPA.