Meritto — Privacy Policy

This Privacy Policy describes how Meritto ("Meritto", "we") collects, uses, shares, and safeguards personal information when you use the Meritto Platform.

1. Data We Collect

1.1 Information You Provide

Identity: name, email, profile photo, phone number (optional).
Profile: work history, current organisation, target roles, résumé file, bio.
Role-specific: mock-interview availability (referrers), company name and hiring intent (recruiters), test answers and mock-interview transcripts (seekers).

1.2 Information Collected Automatically

Proctoring data: during proctored tests we capture webcam frames for face-presence detection, fullscreen and tab-focus events, and copy-paste / right-click attempts. Face detection runs locally in your browser; the frames themselves are not transmitted to us or to any third party.
Mock-interview recordings: audio and video of scheduled interviews, retained for scoring audit. You will be informed before each session begins.
Device & usage: IP address, browser type, device identifiers, pages viewed, clicks, time on page.

1.3 Information from Third Parties

Google OAuth: when you sign in with Google, we receive your name, email, and profile picture.
Employment verification: for senior referrers, we may verify work history with LinkedIn or third-party verification services.

1.4 Information We Derive for Matching

Search profile (seekers): to match you with recruiters' requirements, we compose a text summary from your target role, years of experience, work history, bio and the text of your résumé, and convert it into a numeric representation (an "embedding"). You can see exactly what this text contains on your Profile page, under "How recruiters find you".
Requirements and searches (recruiters): the text of your job requirements and search descriptions is converted in the same way. We log each search — its filters, which candidates were shown and in what order — to measure and improve match quality. Search text itself is not stored in the log.
Match feedback (recruiters): when you mark a shortlisted candidate as not relevant, we record that mark together with the rank and match percentage you were shown.

2. How We Use Your Data

Purpose	Legal basis
Operate the Platform, compute karma scores, surface candidates to recruiters	Performance of contract
Match seekers to recruiters' requirements by automated analysis of profile, résumé and requirement text, and tell recruiters when new candidates match	Performance of contract
Measure and improve match quality using search logs and recruiter feedback	Legitimate interest
Detect and prevent cheating, fraud, or platform abuse	Legitimate interest
Send transactional notifications (interview reminders, test results)	Performance of contract
Send product updates and beta announcements	Consent — opt-out anytime
Comply with legal obligations (tax, audit, statutory requests)	Legal obligation

2.1 Automated Matching

Meritto ranks candidates for a recruiter's requirement automatically, by comparing the meaning of the requirement with each seeker's search profile, and shows a match percentage and the requirement's words that appear in the profile. This ranking is an aid to the recruiter: Meritto does not make hiring decisions and does not reject anyone automatically. Recruiters decide whom to contact, and you decide whether to share your contact details. Turning off "Open to work" removes you from every search and shortlist.

3. How We Share Your Data

Recruiters: see your karma score and parameter-level breakdown, your match percentage for their requirement, and which of their requirement's words appear in your profile. Your contact details and résumé are released to a recruiter only after they request contact and you accept.
Senior referrers: see your name and work history when scoring a mock interview you booked with them.
Service providers: hosting, database, authentication and file storage (Supabase), application hosting and delivery (Cloudflare), payments (Razorpay), transactional email (Resend), and sign-in (Google OAuth, where you choose it). Each is bound by data-processing agreements.
AI text processing for matching (Voyage AI, Inc.): seekers' search-profile text (including résumé text) and recruiters' requirement and search text are sent to Voyage AI to compute the numeric representations used for matching. Voyage AI processes this text only to return those representations under its data-processing agreement; it does not retain the text after processing or use it to train its models.
Legal disclosures: when required by law, court order, or to protect the rights and safety of users.

We do not sell your personal data.

4. Data Retention

Profile data: retained while your account is active and for 12 months after deletion (for fraud-investigation purposes).
Test attempts and karma history: retained for 24 months from the last attempt.
Mock-interview recordings: retained for 90 days, then automatically deleted unless flagged for an open dispute.
Webcam proctoring frames: processed in your browser during the session and discarded; only structured violation events are persisted.
Search profile and its numeric representation: kept while your profile exists, refreshed when you change your profile, and deleted together with your profile record.
Recruiter search logs: 60 days, then automatically deleted.
Recruiter match feedback: kept with the requirement it was given on, and deleted when that requirement is deleted.

5. Your Rights

Subject to applicable law, you have the right to:

Access the personal data we hold about you.
Correct inaccurate or incomplete data via your profile settings.
See the text our search uses to represent you, on your Profile page under "How recruiters find you", and leave every search by turning off "Open to work".
Delete your account (which deletes profile data within 30 days; aggregated, anonymised analytics may be retained).
Object to or restrict certain processing.
Withdraw consent for marketing communications at any time.
Receive a copy of your data in a portable, machine-readable format.

To exercise any of these rights, email [email protected].

9. International Transfers

Our infrastructure is primarily hosted in the Asia-Pacific (ap-south-1) region. Where we transfer data outside India for processing by service providers, we rely on the EU Standard Contractual Clauses and equivalent safeguards under applicable law. Text sent to Voyage AI for matching (section 3) may be processed outside India, including in the United States, and is not retained by Voyage AI after processing.