Privacy Policy

Last updated: 28th July 2025

We, Peoplebox Inc. (“we”, “us”, “our”, “Company”) are the owners of the website www.peoplebox.ai (“Website”) and the ‘Peoplebox’ software “Software”. The Website and the Software are collectively referred to as the “Platform”. The Website showcases our Software and features available on the Software, including OKRs, performance management, employee engagement, and AI powered talent intelligence features (“Services”). The Website and the Software together are referred to as the “Platform”.

Summary of Your Data Rights:

• Access, correct, delete, restrict, or object to processing of your Personal Information

• Request a copy of your data or withdraw your consent at any time

• Request human review of significant automated decisions

• Lodge a complaint with your country’s regulator

For more on your rights, see Section 10 of this Privacy Policy below or contact support@peoplebox.ai

Our Business Model and Collection Practices:

We provide a suite of talent management, performance management, employee engagement, and talent acquisition (including AI-powered candidate screening and interviews) solutions. Data is collected and processed either (a) on behalf of our customers (where we act as a data processor/service provider) when their employee or candidate data is uploaded to our Platform, or (b) directly by us (where we may act as a data controller), such as when Peoplebox finds and screens candidates for clients or for our own business purposes.

When our customers use the Platform for the Services, we process the data provided by the customers on their behalf and in accordance with their instructions, acting as their data processor, service provider, or equivalent role as recognized under applicable laws (“Processor Role”). However, in certain circumstances, such as when we gather candidature directly from public sources or through our own recruitment efforts, we determine the purposes and means of processing candidate data and act as a data controller, or business, or equivalent role as recognized under applicable data protection laws (“Controller Role”). Our processing and our obligations vary depending on this role, as further described below. We respect data privacy rights and are committed to protecting personal information collected on this Platform. This Privacy Policy (“Privacy Policy”) sets forth how we collect, use and protect the personal information collected on this Platform or while interacting with our Services.

PLEASE READ THIS PRIVACY POLICY CAREFULLY. BY CONTINUING TO USE THE PLATFORM, PROVIDING US PERSONAL INFORMATION, YOU ACKNOWLEDGE THAT YOU HAVE BEEN INFORMED OF HOW YOUR INFORMATION MAY BE COLLECTED, USED, PROCESSED, AND SHARED AS DESCRIBED IN THIS PRIVACY POLICY. YOU CONSENT TO OUR USE OF YOUR PERSONAL INFORMATION IN ACCORDANCE WITH THE TERMS OF THIS PRIVACY POLICY. IF YOU DO NOT AGREE TO THIS PRIVACY POLICY, YOU MAY WITHDRAW YOUR CONSENT(WHERE APPLICABLE) OR ALTERNATIVELY CHOOSE NOT TO PROVIDE YOUR PERSONAL INFORMATION ON THE PLATFORM. SUCH AN INTIMATION TO WITHDRAW YOUR CONSENT CAN BE PROVIDED BY EMAIL TO COMMUNICATION DETAILS MENTIONED BELOW.

PLEASE NOTE THAT WHERE WE PROCESS YOUR PERSONAL INFORMATION ON BEHALF OF OUR CUSTOMERS (SUCH AS YOUR EMPLOYER OR A POTENTIAL EMPLOYER), THEY ARE RESPONSIBLE FOR OBTAINING YOUR CONSENT WHERE REQUIRED BY LAW AND FOR PROVIDING YOU WITH APPROPRIATE PRIVACY INFORMATION. YOU MAY ALSO CONTACT THEM DIRECTLY TO EXERCISE YOUR RIGHTS UNDER APPLICABLE DATA PROTECTION LAWS.

PLEASE ALSO NOTE THAT WHERE WE GATHER CANDIDATURE DIRECTLY(FOR EXAMPLE, FROM PUBLICLY AVAILABLE PLATFORMS OR ADVERTISEMENTS WE RUN ON BEHALF OF OUR CLIENTS), WE PROVIDE APPROPRIATE PRIVACY INFORMATION AND HONOUR DATA SUBJECT RIGHTS UNDER APPLICABLE LAWS.

IF YOU ARE ACCESSING THE PLATFORM ON BEHALF OF A THIRD PARTY, YOU REPRESENT THAT YOU HAVE THE AUTHORITY TO BIND SUCH THIRD-PARTY TO THE TERMS AND CONDITIONS OF THIS PRIVACY POLICY AND, IN SUCH AN EVENT YOUR USE OF THE PLATFORM SHALL REFER TO USE BY SUCH THIRD PARTY. YOU ALSO ACKNOWLEDGE THAT, AS A REPRESENTATIVE OF THE THIRD-PARTY DATA CONTROLLER (OR EQUIVALENT ROLE UNDER APPLICABLE LAW), IT IS YOUR RESPONSIBILITY TO OBTAIN ALL NECESSARY CONSENTS AND PROVIDE REQUIRED NOTICES TO DATA SUBJECTS WHOSE INFORMATION IS SUBMITTED TO THE PLATFORM. IF YOU DO NOT HAVE SUCH AUTHORITY OR IF YOU DO NOT AGREE TO THE TERMS OF THIS PRIVACY POLICY , YOU SHOULD REFRAIN FROM USING THE PLATFORM OR PROVIDING ANY PERSONAL INFORMATION OF THIRD PARTIES.

This Privacy Policy is an electronic record in the form of an electronic contract being compliant and construed in accordance with applicable privacy laws.

1. Definitions

“Applicable Data Protection Laws” means all data protection and privacy laws and regulations applicable to the processing of personal data, including but not limited to the EU GDPR, UK GDPR, CCPA, the Digital Data Protection Act 2023 and any other law in India that regulate data protection and privacy, and other similar laws as may apply in relevant jurisdictions.
“User(s)”, “you”, “your” shall mean individuals that view and use the Platform.“
Customer Data” means all personal information, data, or content uploaded or otherwise made available to the Platform by or on behalf of our customers (such as their employees, candidates, and contractors), in connection with the Services.
“Processor Role” refers to our capacity as a data processor or service provider when processing Customer Data strictly in accordance with client instructions.
“Controller Role” refers to our capacity as a data controller (or business) when we determine the purposes and means of processing, such as when a candidate approaches Peoplebox in relation to a vacancy.

2. Personal Information Collected When You Use the Platform:

For purposes of this Privacy Policy, “Personal Information” means information that can be used to personally identify the User, including but not limited to a User’s name, mobile number, email address, company name and designation.

Information collected on the Website: We may collect Personal Information including your name, email address, phone number, company name, country name from you when you (a) visit our Website, (b) when you book a demo, (c) when you sign up to create an account on our Website, (d) when you contact us through our ‘contact us’ page, and (e) when you use the free trial option on our Website.
Personal Information collected for recruitment purposes: When you apply for a job at our Company through the careers page on our Website, we may collect Personal Information, including but not limited to your name, email address, contact number, location, CV, resume. We may also collect financial information, including but not limited to your previous and expected salary.
Social Media Platform: If you subscribe to our blogs, newsletters, contact us through social media platforms such as LinkedIn, Facebook, Instagram, Twitter etc. (“Social Media”), we may get access to your Personal Information on such Social Media (such as your name, username, email id, and phone).
We may also collect your Personal Information in connection with integrated third-party applications and services, including Google and Microsoft platforms, as further described below.
Log Data: When you visit the Website or use the Software either directly or through third party websites, whether you have signed-in or are just browsing the Website, our servers automatically record information that your browser sends whenever you visit a website (“Log Data“). This Log Data may include information such as your computer’s Internet Protocol (“IP”) address, browser type or the webpage you were visiting before you came to our Website, pages of our Website that you visit/use, the time spent on those pages, information you search for on our Website, access times and dates, and other product performance and analytical data.
Payment Information: You may elect to pay for the Services through our Platform, we may collect certain information such as name and email address to process your request. You will be required to provide certain payment information directly to our payment processing partners, including but not limited to your name, credit/debit card information. We do not access, store or collect your credit/debit card information.

2.1 Personal Information collected through Talent Management Services and Talent Acquisition

Depending on which features of the Platform are used, we collect and process Personal Information as follows:

Client-Provided Employee and Candidate Data (Processor Role): Our customers may upload or integrate employee and candidate data into the Platform (for example, for OKR management, performance reviews, employee engagement, or for candidate interviews and hiring workflows). This may include personal identifiers, professional background, employment or application history, feedback, performance evaluations, compensation information, and interview materials (including resumes, video or audio files and AI-generated transcripts, scores, or notes).
Where Candidate Approaches Peoplebox (Controller Role): Where Peoplebox directly collects candidate information – for example, by advertising a position, searching public job boards or professional platforms (such as LinkedIn), or soliciting applications on behalf of a client, we may collect personal data such as name, contact details, employment history, public professional profile data, skills, and submitted application materials, including any screening responses, interview materials, or assessments.
Automated Collection: In both cases above under this section 2.1, the Platform may generate or derive additional data (such as engagement analytics, behavioural metrics, compatibility scores, automated shortlisting results, bias reduction anonymized data, and other performance indicators), and may record interview or screening data via audio/video or written transcripts, for review and analysis by clients or by Peoplebox.
Information Processed on behalf of Customers (via the Software while using the Services) and Information Processed Directly By Peoplebox (for Candidate Screening or Sourcing): (a) Candidate data such as resumes, employment history, skills, qualifications, assessments, interview recordings, video or audio submissions, AI-generated transcripts, and scoring outputs, (b) employee data such as performance feedback, engagement responses, and related metadata, and (c) publicly available information about candidates or employees which may include data from professional networking sites (such as LinkedIn or GitHub), public profiles, or other publicly accessible sources, to enrich user or candidate profiles with additional professional or educational details to support the hiring or internal mobility decisions by the customers or by Peoplebox (for its direct recruitment efforts). Our customers are responsible for the legal basis and privacy notices when acting as controllers; Peoplebox is only responsible for lawful processing and data subject rights where we act as controller.

3. Third Party Integrations

Peoplebox integrates with various third-party platforms, including HRIS systems, communication tools, data analytics services, and Single Sign-On (SSO) providers. When you enable these integrations, we may securely access and process relevant data, such as profile details, calendar events, contact information, or analytical data, as required to deliver integrated features within Peoplebox. All data collected through these integrations is handled securely and in accordance with applicable privacy regulations, as well as the respective third-party providers’ terms and policies. For detailed information regarding how these third-party services handle your data, please review the respective privacy policies and terms available on their official websites.

4. Cookies:

We use cookies and/or similar in-house and third-party tracking tools to track user traffic patterns. Tracking tools also used are beacons, tags and scripts to collect and track information and to improve and analyze our Website and our Services. You may choose to disable cookies through your browser settings. For more information, please refer to our cookie policy (peoplebox.ai/cookies-policy).

5. Accuracy of Information:

User undertakes that he/she shall be solely responsible for the accuracy, correctness, truthfulness, or legality of the Personal Information shared with us whether of its own or any third party. Notwithstanding the foregoing, where Peoplebox directly collects candidate data from public sources, we take reasonable steps to ensure accuracy, minimization, and lawful use consistent with the purposes for which the data was collected.

6. Use of Personal Information:

We process Personal Information to operate and improve our Platform, deliver our Services, and respond to inquiries from various categories of Users, including:

Platform Users (customers and their representatives): We process Personal Information to deliver our Services to our customers and their authorized representatives, including OKRs, employee engagement tools, and AI-powered talent intelligence features (such as resume screening, profile enrichment, and internal mobility insights), strictly in our role as a data processor or service provider under applicable laws.
Website visitors and job applicants (non-customer Users): If you visit our Website to explore our offerings, subscribe to newsletters, or apply for a job at Peoplebox, we may process your Personal Information (such as contact details, resumes, or inquiries) for the purposes of:

i) Registering your account on the Website,

ii) Responding to your requests or inquiries,

iii) Evaluating job applications submitted to Peoplebox,

iv) Communicating about our products, services, or hiring processes,

v) Managing our own internal records and recruitment operations.

Candidate Data for Recruitment and Talent Acquisition: We use Personal Information collected through our hiring and talent acquisition functionality as follows:

1. Where clients route candidate data into the Platform for AI-powered interviews and screening, we process such data as a data processor strictly in line with their instructions (for example, resume screening, profile enrichment, interview scheduling, and reporting).

2. Where Peoplebox directly identifies and screens candidates (for example, by collecting data from LinkedIn, job boards, or our own talent outreach for a specific role), we process such data as a data controller/business, including to contact candidates, conduct and analyze interviews (including through AI), and provide profiles and screening outputs to our clients. In such cases, we may use automated tools to generate compatibility scores, shortlist candidates, and create reports, which are shared with the relevant client or employer for final decision-making.

Platform and Product Improvement: We analyze de-identified and aggregated usage data to improve Platform functionality, user experience, and the performance of AI models, ensuring fairness, transparency, and reliability in line with applicable regulations.

Communication and Support: We use Personal Information to respond to queries, provide customer support, and share updates regarding our Platform or Services.

Legal and Regulatory Compliance: We may process Personal Information to comply with legal obligations, respond to lawful requests, or enforce our agreements.

Note: Where we process data on behalf of our customers, they remain responsible for obtaining any required consents and providing privacy notices to their employees or candidates, in accordance with applicable data protection laws. When we act as data controller (for example, while directly collecting information from candidates), we are responsible for obtaining any consents required by law, or ensuring another lawful basis for our processing, and for providing relevant privacy notices and honoring data subject rights as described under “Your Rights” below.

7. Disclosures:

We do not sell, rent, share, distribute, lease or otherwise provide your Personal Information to third parties, without your prior consent. Keeping this in mind, we may disclose your Personal Information in the following cases:

Affiliates: We may provide your Personal Information to our affiliates to enable them to improve the offerings, provide feedback and respond to their queries.
Service Providers: We may share your Personal Information with the service providers who work with us in connection with operating the Platform and/ or providing the Services. All such service providers are subject to stringent confidentiality restrictions consistent with this Privacy Policy.
Merger or Acquisition: We may transfer your Personal Information if we are acquired by another entity, or if we merge with another company or transfer a part of our business, including the Platform, to a third party. Any such third party or resultant entity that receives your Personal Information shall have the right to continue to use your Personal Information in line with the purposes set out herein. In the event of such a sale or transfer, we may notify you.
Legal and Regulatory Authorities: We may disclose your Personal Information in order to comply with our legal obligations/ court orders/ requests by Govt. authorities.
Acquisition Clients: Where we identify and screen candidates directly (Controller Role), we may disclose shortlisted candidate profiles and associated interview or assessment results to the relevant client or employer as part of the recruitment process. These disclosures are made strictly for the purpose of enabling the client to evaluate and make hiring decisions and are governed by the relevant customer’s or client’s own legal responsibilities as data controller following receipt.
International Data Sharing: Where required for providing Services or upon lawful instruction by clients or data subjects, we may transfer or allow access to Personal Information across jurisdictions, in compliance with Applicable Data Protection Laws including EU Standard Contractual Clauses, UK International Data Transfer Agreements, or equivalent safeguards for India and the United States.

8. Data Retention:

For data we collect directly from website visitors, job applicants, or those who contact us for business inquiries, we retain the data only for as long as necessary to fulfill the purpose of collection or to comply with legal requirements.
When processing data on behalf of our customers for the Services, we retain that data in accordance with our customer’s instructions, our contractual agreements, and applicable data protection laws. Our customers determine the duration for which such data is retained.
Individuals may request deletion of their Personal Information by contacting either the customer (if their data was provided by a customer using our Services) or Peoplebox directly (if their data was submitted on our Website or during direct communication) by reaching us at support@peoplebox.ai.
Where we act as controller (for example, directly finding and interviewing candidates for or on behalf of a client), we retain candidate data until the recruitment process concludes or for as long as required by applicable laws, after which it will be securely deleted or de-identified unless further retention is required for compliance, dispute resolution, or to exercise or defend legal claims.

9. Security:

Your Personal Information is stored on third party cloud infrastructure. Although we provide appropriate firewalls and protections, we cannot warrant the security of Personal Information transmitted as these systems are not hack proof. Data pilferage due to unauthorized hacking, virus attacks, technical issues is possible, and we will take necessary measures to mitigate such events. Our security program is audited under SOC 2 Type 2 standards. Moreover, our AI-powered functionalities are subject to regular internal reviews to ensure fairness, reliability, and minimization of bias in line with relevant and emerging regulations such as those in the EU and US. If you suspect any security vulnerability or breach, please contact us immediately at support@peoplebox.ai. Where required by law, we will notify affected individuals and data controllers of any data breach without undue delay and in accordance with the timeframes stipulated by the applicable jurisdiction (such as Articles 33/34 GDPR, CCPA, or Indian DPDP Act reporting requirements).

10. Your Rights:

Depending on your jurisdiction, you may have the following rights regarding your Personal Information:

Right to Access: Request confirmation of whether we process your Personal Information and obtain a copy.
Right to Rectification: Request correction of inaccurate or incomplete Personal Information.
Right to Erasure: Request deletion of your Personal Information, subject to our legal or contractual obligations.
Right to Restrict Processing: Request that we limit processing under certain circumstances.
Right to Object: Object to the processing of your Personal Information, including for direct marketing or automated decision-making.
Right to Withdraw Consent: Withdraw your consent at any time where consent is the basis for processing.
Right to Data Portability: Request to receive your Personal Information in a structured, machine-readable format, where applicable.
Right to Lodge a Complaint: Submit a complaint to your local data protection authority if you believe your rights have been violated.

Note: If Your Information Was Provided by Our Customer: If your Personal Information has been provided by one of our customers (such as your employer or a prospective employer), please direct your request to that customer (the data controller). We assist our customers in fulfilling such requests in accordance with applicable data protection laws and the contractual arrangement we share with them.

Note: If You Provided Your Information Directly to Peoplebox: If you submitted Personal Information directly to Peoplebox (such as via our Website, for demo requests, newsletter subscriptions, or job applications), you may exercise your rights by contacting us at support@peoplebox.ai.

We may require you to verify your identity or provide additional information to process your request. All valid requests will be handled within a reasonable timeframe in accordance with applicable laws.

Automated Decision-Making/Profiling: By agreeing to this Privacy Policy, you acknowledge that Peoplebox provides AI-powered tools, such as screening, shortlisting, or scoring of candidates or employees, and generates reports for informational and decision-support purposes only. Peoplebox does not make automated decisions that produce legal or similarly significant effects for individuals; final hiring or employment decisions are made exclusively by our clients with human review, not by Peoplebox. As such, the rights to request human intervention or contest a solely automated decision under applicable data protection laws generally apply to the client or employer making the final decision, not to Peoplebox. If you have concerns about a final hiring or employment decision, please contact the employer or responsible for that decision.

Jurisdiction-Specific Rights:

EU/EEA/UK Residents: In addition to the rights listed above, you may also have the right to object to direct marketing and to request limitations on certain processing activities.
California Residents: (CCPA/CPRA) You have the right to opt out of the sale or sharing of your Personal Information and to limit the use of your sensitive Personal Information.
India Residents: You have the right to grievance redressal as per the Digital Personal Data Protection Act, 2023.

11. Choice and Opt-Out:

We may send you communications including but not limited to (a) notices about your use of our Platform and Services, including those concerning violations of use, (b) updates, (c) promotional information regarding our Services, and (d) newsletters. You may opt out of receiving promotional emails and newsletters from us by following the unsubscribe instructions provided in those emails. Alternatively, you can opt out, at any time, by emailing support@peoplebox.ai with your specific request. If you wish to opt out of processing or have objection to AI-based processing, please contact the employer or organization (our customer) who invited you to interact with our Platform. We assist our customers in responding to such requests.

Where we act as controller (such as in collecting information from candidates directly), you may opt out of use of your data for future recruitment or marketing by contacting us at support@peoplebox.ai.

12. Cross Border Data Transfers:

Your Personal Information may be transferred to, stored at, or processed in locations outside of your jurisdiction, including where our group companies, service providers, clients, or cloud infrastructure are based (such as the United States, European Union, the United Kingdom, or India). We implement appropriate safeguards, including EU Standard Contractual Clauses (“SCCs”), the UK International Data Transfer Agreement, or other data transfer mechanisms approved under Applicable Data Protection Laws, to ensure an adequate level of protection for your Personal Information. If you require further details about international data transfers or the safeguarding measures we have in place, please contact us as support@peoplebox.ai.

13. Governing Laws and Dispute Resolution:

This Privacy Policy, and any disputes arising out of or in connection with it, shall be governed by and construed in accordance with the laws of the State of Delaware, United States of America, without regard to conflict of law principles.

However, your rights and our obligations regarding the processing of your Personal Information are subject to Applicable Data Protection Laws, including but not limited to the EU GDPR, UK GDPR, CCPA, and other relevant privacy laws in your jurisdiction.

Any disputes arising under this Privacy Policy shall be subject to the exclusive jurisdiction of the competent courts located in the State of Delaware, United States of America, unless otherwise required by Applicable Data Protection Laws.

If required by Applicable Data Protection Laws (e.g., GDPR or DPDP Act), you may also have a right to refer disputes to your relevant supervisory authority or designated grievance officer in addition to judicial remedies.

14. Links to other Websites:

Our Platform may contain links to other websites/platforms/applications of your interest. Please note that we do not have any control over such other websites/ platforms/ applications, and you will be accessing these websites/ platforms/ applications at your own risk. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such websites/ platforms/ applications and those are not governed by this Privacy Policy. You should exercise caution and look at the privacy policy applicable to such websites/platforms/applications.

15. Limitation of liability:

To the extent permissible under the law, we shall not be liable for any direct, indirect, incidental, special, consequential, or exemplary damages, including but not limited to, damages for loss of profits, goodwill, data, information, or other intangible losses (even if we have been advised of the possibility of such damages), arising out of this Privacy Policy. Nothing in this section shall limit your statutory rights under applicable laws which cannot be lawfully limited or excluded.

16. Children’s Privacy:

This Website is not meant for children under the age of 18. We do not knowingly collect Personal Information from children under the age of 18 years without the prior, verifiable consent of his or her legal representative. If you are a child under the age of 18 years, please do not provide any Personal Information on this Website. If the legal representative of the child discovers that the child has provided us with Personal Information, we request the legal representative of the child to contact us support@peoplebox.ai to have the Personal Information deleted.

17. AI-Accountability and Transparency:

Peoplebox provides AI-powered talent intelligence features designed to assist our customers (employers) in improving their hiring and internal mobility processes. These features include resume screening, profile enrichment, compatibility scoring, interviews, and recommendations for internal mobility. While these tools are designed to help employers make more informed decisions, it is important to note that the insights generated by our AI models are provided solely for informationa. They do not replace human judgment or decision-making.

Our customers remain fully responsible for validating these insights and making the final hiring or employee management decisions. Customers are also responsible for ensuring that their use of our AI-powered features complies with Applicable Data Protection Laws and fairness principles, including those set out in emerging AI governance frameworks.

We are committed to transparency, fairness, and accountability in the design and operation of our AI systems. To uphold these commitments, we conduct periodic reviews and testing of our AI models to monitor their accuracy, reduce potential bias, and improve their reliability. We continuously work to ensure that the outputs generated by our AI functionalities are explainable and assist human decision-makers without automating decisions that may significantly affect individuals without human oversight.

If you have questions about how our AI functionalities work or how they impact your personal information, you may contact us at support@peoplebox.ai.

Where required by law, we provide an explanation of the logic, significance, and envisaged consequences of any automated processing which forms part of a decision that produces legal or similarly significant effects on you (see “Your Rights” above for information on how to exercise your rights in relation to such processing).

18. Changes To This Policy:

Please revisit this page periodically to stay aware of any changes to this Privacy Policy, which we may update from time to time. If we modify this Privacy Policy, we will make it available through the Website and indicate the date of the latest revision. If such modifications materially alter your rights or obligations hereunder, we will make reasonable efforts to notify you of the change via email or through our Website. If changes materially impact data subjects in the EU, UK, or India, we will provide advance notice to the extent required by applicable law.

19. Contact Us:

If you have any questions or concerns or grievances about this Privacy Policy, or wish to withdraw your consent in relation to the processing of your Personal Information you can reach out to our appointed grievance redressal officer Allagappan Muthuraman via email at support@peoplebox.ai. For EU data subjects, you may also contact your local supervisory authority with questions or complaints.

20. Data Protection Impact Assessments:

Peoplebox conducts regular Data Protection Impact Assessments (DPIAs) for new products and for processing activities that may present a high risk to individuals’ rights and freedoms, such as those involving AI-driven hiring and employee evaluation tools. Our DPIAs assess risks related to privacy, data protection, and potential bias, and guide us in implementing appropriate safeguards in alignment with legal requirements and industry best practice.

If you would like further information about our DPIA process or require a summary of relevant assessments for your compliance, please contact us at support@peoplebox.ai.