Your data

Privacy Policy

What we collect, why we collect it, who it goes to, and what you can make us do about it.

Effective 25 October 2026 · Last updated 25 October 2026

1. Who this policy covers

This policy applies to everyone who uses https://shortlistone.com — candidates, recruiters, and visitors who never create an account.

The data controller (the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023) is ShortlistOne, Udyog Vihar, Gurgaon, Haryana, India.

2. What we collect

From candidates:

  • Account data: full name, email address, password (stored only as a hash, never in readable form).
  • Profile data: phone number, location, professional summary, work experience, education, skills, projects, target roles, and links you choose to add (LinkedIn, portfolio, GitHub).
  • Documents: your resume, including the text we extract from it, if you upload or paste it.
  • Practice interview data: the role description you entered, a transcript of your answers, the score, per-skill scores, written feedback, strengths and areas to improve, measures such as answer length and filler words, and the time and length of each session.
  • Progress analytics: charts and summaries we calculate from your own practice sessions.
  • Recruiter interview data: if a recruiter invites you to an AI interview, a recording of the interview (audio and video), your answers as a transcript and the AI scorecard for that interview (see section 4A).
  • Messages and notifications about interview invitations.
  • Mentor sessions: the mentor you book, the date and length of each session, whether you attended, the amount you paid for it, any refund, reviews you write and reports you make.

From recruiters:

  • Account data: full name, work email address, password hash, company name.
  • Company profile data: company details, size, industry, website and location.
  • Interview setup data: the candidate's name, email address, resume text, job description and topics you enter when you send an AI interview, and the emails you send to candidates through the platform.

From mentors:

  • Mentor profile: name, photo, headline, bio, years of experience, topics, languages, prices, and the LinkedIn link you add.
  • Verification and payout details you provide to be approved (for example identity and bank details), held for that purpose only.
  • Session data: your availability, bookings, who joined and when, the notes you write after a session, and the reviews and replies you post.

Mentor sessions: candidates pay for a session through PayU, our payment gateway, and we keep the record of each booking, payment reference, attendance and refund. We do not see or store your card, UPI or bank login details; PayU handles those. Live sessions are not recorded unless everyone in the session agrees. Session notes and reviews are kept with the booking and deleted on the retention schedule in this policy.

From everyone, automatically:

  • Technical data: IP address, browser type and version, device type, operating system, and the pages you viewed, collected in server logs.
  • Session data: a session record stored in your browser's local storage so you stay signed in between visits.

3. What we do with it, and on what legal basis

Creating and running your account
Necessary to perform our contract with you.
Running practice interviews, producing your feedback and showing your progress
Necessary to perform our contract with you, at your request each time you start a session. The interviewer uses your profile or the resume you give it so its questions fit your background.
Running an AI interview a recruiter sent you, and showing the result to that recruiter
Your consent, given on the consent screen before the interview starts.
Sending interview invitations, reminders and notifications
Necessary to perform our contract with you and, for recruiters, with the person who invited you.
Service emails: verification, password reset, interview updates
Necessary to perform our contract with you.
Security, fraud prevention and abuse investigation
Our legitimate interest in keeping the platform safe.
Product analytics and improving the interviewer
Our legitimate interest, using aggregated or de-identified data wherever it is possible to do so.
Marketing emails
Your consent. You can withdraw it at any time and we will stop.

4. Automated processing and AI, in detail

This section matters more than the rest, so it is specific.

We use automated systems, including large language models and speech technology, to do the following:

  1. Parse your resume. When you upload a resume, its text is extracted and read by an AI model in order to pre-fill your profile fields. You can edit everything it produces.
  2. Conduct practice interviews. An AI model speaks with you, asks questions, listens to your answers (converted to text), and, in a mock interview, scores your performance across several dimensions and writes a summary with strengths and areas to improve. In guided coaching it models answers and corrects yours, and does not give a score.
  3. Conduct interviews a recruiter sends you (section 4A) and produce a scorecard for the recruiter.
  4. Calculate your progress analytics from your own practice sessions.

No decision about a candidate on ShortlistOne is made solely by an automated system. Scores and interview reports are decision support for a human recruiter, not a decision. A recruiter, not our software, decides whom to shortlist, interview, reject or hire.

Your rights in relation to this processing:

  • You may ask us for a plain-language explanation of how a score for your interview was arrived at.
  • You may ask us to review and correct any profile data an AI model extracted from your resume incorrectly, or simply edit it yourself in your profile.
  • You may delete any practice session, including its transcript and score, from your dashboard. Practice results are never shown to recruiters.
  • You may ask a human at ShortlistOne to review any automated output you believe is wrong, by writing to support@shortlistone.com.

Practice interviews are not recorded: your camera and a shared window are shown live during the call, and the conversation is converted to a transcript. An interview a recruiter sends you is recorded (audio and video) so that it can be reviewed and evaluated further; see section 4A. We do not use your resume, profile, messages, transcripts or recordings to train our own general-purpose AI models. Where a third-party AI provider processes your data on our behalf, we use terms under which your content is not used to train their models.

4A. AI interviews sent by a recruiter

A recruiter can invite you, by email, to take an AI interview for a specific role. This section explains what happens to your data when they do.

The invitation
The invitation is addressed to your email address. To take the interview you need a ShortlistOne account that uses that address and a profile that is at least 80% complete. If you do not have an account yet, the invitation waits until you create one. The link stops working 7 days after it is sent.
What the recruiter provides about you
The recruiter enters your name and email address and may add your resume text, the job description and the topics to cover. We hold this on the recruiter's behalf and use it only to run that interview and show the result to them.
What we collect during the interview
Your answers, as a transcript; the score for each topic, the evidence quoted from your answers, strengths, gaps and delivery measures (for example answer length and filler words) produced by AI; and the time and length of the session. The interview is recorded, audio and video including your shared window, so that it can be reviewed and evaluated further.
Who sees the result
The recruiter who invited you, and recruiters at the same verified company email domain, who can see the result and the recording. We may also review the recording to evaluate the interview further. No one else. You see only that your interview is complete, unless the recruiter chooses to share your result with you.
Consent
Before the interview starts you are told that you are speaking to an AI, what is collected, who receives it and how long it is kept, and you must agree before it begins. You can leave at any time.
Human decision
The AI scorecard is decision support for a person. It does not accept or reject you. Recruiters who use the platform agree not to rely on it alone. You can ask for a human review of your interview by writing to support@shortlistone.com.
Fairness
The interviewer is instructed never to ask about age, gender, religion, caste, ethnicity, nationality, marital or family status, health, disability or other protected characteristics, and to judge only job-relevant answers.
How long it is kept
The recruiter chooses 7, 14 or 30 days (never more than 30) when they set the interview up. That many days after the interview ends, the resume text, job description, transcript, scorecard, recording and your name and email on that interview are deleted automatically. The recruiter can delete it sooner, and you can ask us to.
Who decides what
For your account we are the data fiduciary. For the interview, the recruiter decides why your data is used in their assessment of you, and we process it on their behalf. Our basis for running the interview is your consent, given on the consent screen.

5. Who we share it with

We share personal data only with the following categories of recipient, and only for the purposes described:

Recruiters who invite you to an AI interview
The recruiter who sent the invitation, and recruiters at the same verified company email domain, receive your interview transcript and scorecard. They do not receive your practice interview results.
Candidates
A recruiter's name and company name are shown to a candidate they invite. A recruiter's other contact details are not published.
Supabase
Our database and authentication provider. Your account and profile data are stored on their infrastructure.
Real-time call and AI providers
During an interview your voice is streamed live to our call server and, so that the conversation can happen, to speech-to-text, language-model and text-to-speech providers, under terms that prohibit training on that content. Practice interviews are not recorded. Recordings of recruiter-sent interviews are stored with us for the retention period in section 7.
Email delivery provider
Your email address and the content of service emails we send you, including interview invitations, reminders and emails a recruiter sends you through the platform.
Professional advisers and authorities
Where we are legally required to disclose data, or need to establish, exercise or defend a legal claim.

We do not sell your personal data. We do not share it with advertising networks or data brokers.

6. Where your data is stored

Our infrastructure providers may store and process data on servers located outside India, including in the European Union and the United States. Where data leaves India, we rely on our providers' contractual data protection commitments, including standard contractual clauses where applicable.

7. How long we keep it

Active account data
For as long as your account is open.
After you delete your account
Profile, resume, practice session and message data is deleted or irreversibly anonymised within 30 days, except where we must keep it longer for the reasons below.
Server and security logs
Up to 12 months.
Practice interview transcripts and results
Until you delete the session, or 12 months after it was created, whichever is sooner.
Recruiter-sent AI interviews (resume text, job description, transcript, scorecard, recording)
Deleted automatically 7, 14 or 30 days after the interview ends, as chosen by the recruiter (never more than 30). Afterwards only non-personal counts remain, such as the date and status.
Interview invitations that are never used
The link expires after 7 days. The candidate's name, email address and the details the recruiter entered are deleted on the same schedule as above.
Records needed for a live legal claim or investigation
Until the matter is concluded.

8. Your rights

Under the Digital Personal Data Protection Act, 2023 — and, if you are in the EU or UK, under the GDPR — you have the right to:

  • Ask what personal data of yours we hold and get a copy of it.
  • Have inaccurate or incomplete data corrected or completed.
  • Have your data erased, and to close your account.
  • Withdraw consent you previously gave, at any time, without affecting processing already carried out.
  • Nominate another person to exercise these rights on your behalf in the event of your death or incapacity.
  • Complain to us, and then to the Data Protection Board of India, if you are not satisfied with how we handled it.
  • (EU/UK only) Object to processing based on our legitimate interests, restrict processing, and receive your data in a portable, machine-readable format.

To exercise any of these, write to support@shortlistone.com. We will respond within 30 days. We may ask you to verify your identity first — we are not able to act on a request we cannot tie to the account it concerns.

9. Security

All traffic to and from the platform is encrypted in transit with TLS. Passwords are stored only as salted hashes and are never recoverable, by us or anyone else. Access to the data is restricted so that a recruiter can read only their own interviews and those of colleagues on the same verified company email domain, and a candidate only their own.

No system is perfectly secure. If a breach occurs that is likely to cause you harm, we will notify you and the Data Protection Board of India as the law requires.

10. Children

ShortlistOne is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, write to support@shortlistone.com and we will delete it.

11. Changes to this policy

We will post any change on this page and update the effective date. If a change materially affects your rights, we will email registered users before it takes effect.

12. Contact

Data Fiduciary: ShortlistOne, Udyog Vihar, Gurgaon, Haryana, India

Grievance Officer: The Grievance Officer, ShortlistOne — support@shortlistone.com

General enquiries: support@shortlistone.com · +91 95606 77568