Privacy Policy

Effective date: 2026-05-22

This Privacy Policy explains how RollHire ("we", "us", "our") collects, uses, and protects your information when you use our website, mobile app, or any other service we provide (together, the "Service"). RollHire is a job marketplace operating in India. We comply with the Digital Personal Data Protection Act, 2023 (DPDPA) and the Information Technology Act, 2000.

1. Information we collect

1.1 Information you give us

When you create a RollHire account, we collect:

• Mobile number — required for OTP-based login. We do not store passwords.
• Name and city — required to create your profile.
• Role — whether you are a Job Seeker or an Employer.

If you are a Job Seeker and choose to complete your profile, you may also provide:

• Date of birth, gender, address, area within your city, and approximate location coordinates (for distance-based job matching).
• Skill, expected salary, languages spoken, work history, education history, and additional skills.
• A live selfie captured at profile setup (used as your profile photo and to deter fake accounts). We do not store images of your Aadhaar, PAN, bank passbook, or driving licence — we only record a yes/no flag indicating that you have each document.
• An optional resume file you upload yourself.

If you are an Employer, you may also provide:

• Business name, business type, recruiter name, recruiter role.
• A business email (used for the EMAIL verification method) or a registration certificate (used for the CERTIFICATE verification method).
• Optional GST number.

1.2 Information we collect automatically

• Usage data — actions you take in the app (jobs viewed, applications submitted, profile edits) so we can show relevant jobs and detect abuse.
• Device information — device model, operating system version, and a randomly generated session token. No advertising identifiers.
• Approximate location — only if you grant location permission. Used solely for "jobs near you" matching. We do not track movement over time.

1.3 What we do not collect

• We do not collect passwords (we use OTP login).
• We do not collect images of government ID documents from job seekers.
• We do not collect payment card information directly — any future paid transactions will be handled by a regulated payment gateway, not by us.
• We do not use third-party advertising cookies or trackers.

2. How we use your information

• Provide the Service — show you jobs that match your skills and location, accept and route your applications, allow employers to contact applicants.
• Verification — confirm that employers are legitimate businesses (EMAIL or CERTIFICATE verification) and display a "Verified" badge accordingly.
• Communications — send OTPs, application updates, job alerts you have opted into, and important account or policy changes.
• Safety and abuse prevention — detect and block fake accounts, duplicate accounts, harassment, and fraudulent job posts.
• Improvement — analyse aggregate, anonymised usage patterns to improve search relevance and product quality.
• Legal compliance — respond to lawful requests from Indian government or judicial authorities.

3. Who sees your information

3.1 What employers see

When you apply to a job, the employer can see your profile details (name, city, area, skill, work experience, education, languages, and your profile selfie) and your mobile number. Your number is not shown publicly elsewhere on the platform. Only employers whose jobs you have applied to receive your contact details.

3.2 What other job seekers see

Other job seekers do not see your profile or contact details at all.

3.3 What service providers see

We use trusted infrastructure providers (Appwrite for backend storage, Vercel for hosting, a major SMS gateway for OTP delivery, Google Maps for geocoding). They only see the data needed for their function and are bound by contract to protect it. We do not sell or rent your data to anyone.

4. How long we keep your data

• Active accounts — for as long as your account is active.
• Deleted accounts — we permanently erase your profile within 30 days of your deletion request. Job applications you submitted may remain on the receiving employer's account (we cannot delete data we have already transmitted) but are anonymised on our side.
• Job posts — automatically expire 30 days after posting. Expired listings are kept in our database for analytics and dispute resolution and may be permanently deleted after 12 months.
• Logs — operational logs (e.g. login events) are retained for up to 90 days for security purposes.

5. Your rights

Under DPDPA 2023, you have the right to:

• Access — get a copy of the personal data we hold about you.
• Correction — fix inaccurate information (you can edit most fields directly in Profile → Edit).
• Erasure — request deletion of your account and associated data (Profile → Settings → Delete Account, or email us).
• Grievance redressal — escalate any privacy concern to our Grievance Officer (see section 11).
• Nominate — designate another person to exercise your rights in case of your death or incapacity.
• Withdraw consent — for any optional processing. Note that withdrawing essential consents may prevent you from using the Service.

To exercise any of these rights, email privacy@rollhire.com from the mobile number registered on your account or include identifying information so we can verify you. We respond within 30 days.

6. Security

We protect your data using:

• TLS encryption in transit for all network traffic.
• At-rest encryption for sensitive fields (live selfie URLs, mobile numbers).
• Mobile-number OTP login rather than passwords, so there is no password database that can be breached.
• Server-side rate limiting and abuse detection.
• Restricted internal access — only authorised personnel can access raw user data, and only for support or safety investigation.

No system is perfectly secure. If we detect a personal-data breach affecting you, we will notify you and the Data Protection Board of India in line with DPDPA timelines.

7. Children

RollHire is intended for users aged 18 and above. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, please email privacy@rollhire.com and we will delete it.

8. Cookies and tracking

We use a small number of strictly necessary first-party cookies for session management. We do not use third-party advertising cookies. We use anonymised, aggregated analytics to understand product usage; no individual user is identified in those reports.

9. International transfers

RollHire's primary infrastructure is hosted in regions that include data centres outside India (in keeping with our cloud providers' global topology). Where data leaves India, it is subject to contractual protections at least as strong as DPDPA. By using the Service you consent to such transfers.

10. Changes to this policy

We may update this policy from time to time. Material changes will be announced via in-app notification at least 14 days before they take effect. The "Effective date" at the top of this page always reflects the current version.

11. Grievance Officer and contact

In compliance with the Information Technology Act, 2000 and the DPDPA 2023, you may contact our Grievance Officer:

Grievance Officer, RollHire
Email: privacy@rollhire.com
Response time: within 7 working days of receiving your message.

For general privacy questions or to exercise the rights described above, email privacy@rollhire.com.