Veyrag

Privacy Notice

Version 2026-11-05

  • 1. Who is responsible; how to reach us. Veyrag is operated by Sumanth Reddy Anumula, an individual in Telangana, India. Privacy questions, requests and grievances: support@veyrag.com (a postal address for legal documents is provided on written request). Grievance officer under India's IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011: Sumanth Reddy Anumula, reachable at the same email; we acknowledge grievances promptly and aim to resolve them within one month. For your own account data (section 2) Veyrag decides how it is processed. For candidate data you bring into the Service (section 3), your organisation decides the purpose and Veyrag processes it on your instructions under the Data Processing Agreement; candidates should direct questions and requests about their data to the recruiter or organisation that interviewed them.
  • 2. Recruiter account data. At registration we collect your name, company or agency, job role, professional email address and password (held only as a hash by our sign-in provider), your marketing-consent choice and its time, your acceptance of our documents (version and time), and the result of a CAPTCHA check by Cloudflare Turnstile, which processes your IP address, browser signals and may set strictly necessary cookies or local storage under Cloudflare's own terms. We use this to create and secure your account, apply the eligibility rules and the free-screen allocation, contact you about the Service, and keep records the law requires. To detect duplicate free allocations we store a salted hash of your email address; it is kept after account deletion so that a second allocation cannot be claimed. Each verified registration is notified to the founder by email with the name, company, role, email address and status given at registration. No marketing email is sent at present; your choice is stored for when it is, and you can withdraw it at any time.
  • 3. Candidate and screening data. On your instructions the Service processes: résumé files you upload (PDF or Word — converted to text; the file itself is not kept by Veyrag, its name and type are), job descriptions, your notes, the live audio of a screening call (your microphone and the candidate's meeting audio), uploaded or pasted transcripts (.vtt, .srt, .txt), and the records produced from them: transcript, evidence, notes, briefs, submission drafts and the consent confirmation you record. This includes personal data about candidates such as name, work history, qualifications and what they say. Do not enter special-category or sensitive data unless the law allows it.
  • 4. Audio and AI processing (OpenAI). During a live screen, audio is streamed through Veyrag's server to OpenAI's real-time transcription service. Veyrag does not store audio; each record carries that fact. Transcript text, résumé text, job descriptions and notes are sent to OpenAI's API models to prepare the evidence record, follow-up suggestions, notes, briefs and submission drafts; these requests are sent with the provider's storage option disabled. PDF résumés are uploaded to OpenAI's file service for text extraction and deleted from it by the same request; the upload also carries a one-hour expiry in case a deletion fails. Under OpenAI's published API data policy, API data is not used to train its models, and OpenAI may retain API inputs and outputs — including real-time audio — for up to 30 days for abuse and misuse monitoring, longer where required by law or to protect its services, subject to its current policies and exceptions. AI output can be inaccurate; the Service presents it as something for a recruiter to check.
  • 5. Recipients and sub-processors. Supabase (database and sign-in; Amazon Web Services, United States, region us-east-1; daily backups kept 7 days); Vercel (application hosting and server functions; United States; runtime logs kept 1 day); OpenAI (transcription and language models; United States); Resend (transactional email — confirmation, password reset, founder notification; United States; email content and logs kept 30 days); Cloudflare (CAPTCHA). People you share a brief link with receive what the link shows. The founder accesses data only to operate, secure and support the Service, review eligibility, or as the law requires. No personal data is sold; the Service uses no advertising or analytics trackers.
  • 6. Where data is processed; who may use the Service. The Service is hosted and processed in the United States and operated from India. During early access, Veyrag is offered to recruiters and staffing agencies operating in the United States, for screening candidates based in the United States; recruiters confirm this when they register. Veyrag is not offered to organisations in the European Union, the European Economic Area or the United Kingdom, and no EU or UK transfer agreements (such as standard contractual clauses) and no EU or UK representative are in place: do not bring personal data of people in those regions into the Service. India's Digital Personal Data Protection Act, 2023 is being phased in; its main obligations take effect on 13 May 2027, and this notice will be updated before then.
  • 7. Retention and deletion. Screening records are kept under your account and given a retention date 30 days after the recorded consent, shown on the record's History page; a nightly job deletes records whose date has passed, with their transcript, evidence, notes, share links, session events, submission drafts and approved versions. You can delete any record earlier from History and your whole account from Account: records, profile, document acceptances and sign-in are deleted immediately (a workspace with other active members remains for them; the record that a deletion was requested, the hashed email identity and any eligibility request you made are kept). Credit-usage records are kept for the free allocation's accounting and contain no screening content. Share links expire after 7, 14 or 30 days or when revoked. Deleted data may persist in our database provider's backups for up to 7 days, in OpenAI's abuse-monitoring logs for up to 30 days, and in Resend's email logs for 30 days; Vercel runtime logs (technical events, no transcript content) are kept 1 day. A security event log -- each signed-in request to the Service's interface (its method and the name of the function called, without any parameters), refused requests, account deletion and export, share-link creation, use and revocation, submission approval and withdrawal, with the user id, IP address and browser user agent, never screening content -- is kept in our database for 190 days (India's CERT-In directions require at least 180) and then deleted; it is kept for those 190 days even if the account it concerns is deleted sooner.
  • 8. Your rights and requests. Depending on where you are, you may have rights to access, correct, export, delete or restrict your data and to object to processing. For your own account data use Account → Export (a JSON file of your records) or Account → Delete, or contact us at the address above. Candidates should contact the recruiter who interviewed them; we assist that recruiter. You may also complain to the data-protection authority that applies to you.
  • 9. Security. The Service is served over HTTPS; data is isolated per account at the database level with row-level security; keys that access the database and OpenAI are held only on the server; sign-in requires a confirmed email, a CAPTCHA and a password screened against known breaches; our hosting and database providers state that data is encrypted at rest and in transit on their platforms. No service is perfectly secure; keep your credentials safe and take care whom you share links with. We will inform you without undue delay if a breach affecting your data comes to our knowledge.
  • 10. Changes. Updates are posted here with a new version; material changes are put to you for acceptance in the Service.

Veyrag organizes interview evidence. Hiring decisions stay with you.