Privacy policy

Hyrefly is operated by DevSecEngOps (DevSecEngOps), and is reachable at support@hyreflyai.com. This policy covers hyreflyai.com, the portfolios published on it, and the emails we send you.

What you type in

Your name, email, phone, institute, education, skills, projects, experience, certifications, links, and any files you upload (avatar, cover image, intro video, resume, project media). This is the profile — it exists because you entered it.

Account and sign-in

A password hash (never the password itself), or — if you use Google sign-in — the name, email address and profile picture Google returns. We never receive your Google password.

Payment records

Which plan you bought, the amount, the Razorpay order and payment identifiers, and the status. We do not receive or store your card number, CVV, UPI PIN or bank credentials — those go straight to Razorpay.

Portfolio view analytics

When someone opens your published portfolio we record the view. On the Placement Pro tier we also try to resolve the visitor's network to an organisation, so you can see which company is looking — corporate networks usually resolve, home broadband and VPNs don't and are discarded. A signed-in recruiter is attributed directly. This is traffic to your page, and you are the one it's reported to.

Technical logs

IP address, browser and request metadata, kept for security, abuse prevention and debugging.

Nothing you enter is public until you press publish. This is the part most worth understanding, so it's spelled out:

• Draft profile — private. Visible only to you, and to DevSecEngOps staff when you ask us for support.
• Published portfolio — public. Anyone with the link can see it, and search engines are allowed to index it. That's the point of it. Unpublish at any time and we stop serving the page.
• Contact details. Your email and phone appear on a published portfolio only if you put them there.
• Recruiter discovery. On the Placement Pro tier your published profile can be surfaced to recruiters on Hyrefly. Free and Builder profiles are not placed in that pool.
• Your institute. If you signed up through an institute, its administrators can see that you have an account with them and your approval status.

• We don't sell your personal data. There is no such deal.
• We don't run third-party advertising networks or ad trackers on hyreflyai.com.
• We don't email you marketing you didn't ask for. Transactional mail (verification, password reset, payment receipt, profile-view digests) comes from noreply@hyreflyai.com.
• We don't guarantee you a job, and we don't share your profile with employers who aren't verified on Hyrefly.

Only the service providers it takes to run the product, and only the data each one needs:

• Amazon Web Services — hosting, file storage, and the email sender. Your data is stored on AWS infrastructure.
• Razorpay — payment processing. Regulated by the RBI and PCI-DSS certified.
• Google — only if you choose Google sign-in.
• OpenAI and Google (Gemini) — only when you run an ATS check. Your resume text and the job description you paste in are sent to the model to produce the score and suggestions. We don't send your profile to a model for any other reason.
• IPinfo — resolves a portfolio visitor's IP to the organisation behind it, which is what powers the “which company viewed you” feature. Results that resolve to a home ISP or a VPN are discarded rather than shown.

We'll also disclose data if the law actually requires it, and we'll tell you unless we're prohibited from doing so.

Your profile stays as long as your account does — that's the whole promise of Hyrefly: a career home that outlives your placement season. Delete your account and we remove your profile, portfolios and uploaded files. Payment records are retained for as long as tax and accounting law requires, because we're obliged to keep them.

You can, at any time:

• See and edit everything on your profile — it's the editor.
• Unpublish a portfolio so it stops being served publicly.
• Export your resume as a PDF, so your data leaves with you in a usable form.
• Ask us to delete your account and its contents by writing to support@hyreflyai.com. We action deletion requests within 30 days and confirm when it's done.
• Ask us for a copy of the data we hold on you, or to correct something that's wrong.

Traffic to hyreflyai.com is encrypted in transit. Passwords are stored only as salted hashes. Access to production data is restricted to the people who need it to operate the service. No system is perfect — if you find a security problem, mail support@hyreflyai.com and we will take it seriously and credit you if you'd like.

Hyrefly is built for college students and fresh graduates. If you're under 18, use it with a parent or guardian's consent. If we learn we're holding a younger child's data without consent, we delete it.

If we change this policy in a way that affects you, we'll update the date at the top and email account holders. The current version is always at hyreflyai.com/privacy.