Jobs are public. Applications are private.
Candidate details and private recruiter contacts do not appear on public job pages.
You choose additional sharing.
Optional TigerHire sharing and WhatsApp updates are separate from submitting an application.
You can make a privacy request.
Use Your data to request access, a correction, withdrawal or deletion. We verify your email first.
1. Who is responsible
Project Refer is operated by OutsideIn Private Limited, based at No. 9, Raheja Mindspace, Madhapur, Hyderabad, Telangana – 500081, India. We are responsible for operating this platform and handling the personal information described here. Contact hello@projectrefer.com for privacy questions, requests or complaints.
Employers and recruiters are responsible for their hiring decisions and their own use of applications. If you apply on an employer’s website or applicant tracking system (ATS), that service’s privacy notice applies to the application collected there.
2. Information we use
| When you use the service | Information involved |
|---|---|
| Recruiter accounts and job posting | Name, email, optional company name, hiring contact number, job description, role details, application destination and authority-review records. |
| Applications | Name, email, phone number and the job you apply for. Experience, skills, joining availability, current city, preferred locations, work arrangement, relocation preference, expected salary, resume or portfolio URLs and private CV uploads are optional. With your permission, we extract text from uploaded CVs so you can review suggested details. Recruiters can compare your stated skills, location, work arrangement, joining availability and salary expectations with the job details. These checks highlight information for discussion and do not establish proficiency or automatically decide an application. |
| Referrals | Referrer name, referral identifiers, the linked job and the chain of share links. A referral link records an introduction; it does not prove a personal endorsement. |
| Account and application access | Sign-in or verification requests, hashed access tokens, session records and expiry times. Transactional email queues contain the messages needed to deliver private access links. |
| Support, safety and privacy requests | Information you provide, request type, verification records, reports, consent records and operator action logs. |
| Technical operation | Request and error information, message delivery results and security checks. IP addresses are used for abuse controls; the application stores hashed IP-derived rate-limit keys. |
Most information comes from you. Job details may also come from a recruiter or someone forwarding a job. Do not submit someone else’s application or private resume on their behalf; send them the job link so they can choose to apply.
3. Purposes and legal grounds
We use information to publish reviewed jobs, deliver applications to the relevant hiring contact, record referrals, provide private access, communicate hiring updates and respond to your requests. We also use necessary records to prevent abuse, investigate problems and comply with applicable obligations.
Where a law requires a legal basis, the basis depends on the purpose: providing the service you request and taking steps associated with it; consent for optional sharing and messaging; legitimate interests in maintaining a safe and reliable service where permitted; and compliance with legal obligations where they apply. Consent to optional features is not a condition of applying through Project Refer.
We do not currently sell personal information, run advertising based on application data or make automated hiring decisions. TigerHire matching is planned and is not active yet. Current skill-evidence comparisons are for human review and do not rank or reject applicants. A new material use of your information requires an updated notice and any permission required by law.
4. Who can see your data
- Public visitors can see published job details and share links, but not candidate details, referrer names or private recruiter contacts.
- The recruiter authorised for the relevant job can review its applications. A verified account brings together jobs posted using that account’s email. Sharing a company name or email domain does not grant access to another recruiter’s account.
- Authorised OutsideIn operators may access information needed for review, support, moderation, security or privacy requests.
- Optional TigerHire sharing applies only when separately selected. External ATS applications are handled by the employer; we record the referral and outbound click, not proof of submission or hiring.
- We may disclose information when required by applicable law, to protect lawful rights or to address a serious security or safety incident, subject to applicable safeguards.
5. Service providers
We use Cloudflare for hosting, database storage, security and configured backup storage; Resend for transactional email; and Google/Gmail for the support inbox receiving messages sent to hello@projectrefer.com. They process the information needed to provide those services. Meta would process WhatsApp messages when that channel is activated; direct WhatsApp intake is not active yet.
An employer’s ATS and any resume or portfolio host you link to are separate services. Review their notices before sharing information with them. Do not put private access tokens or identity documents in public URLs.
When you book a call, your name, email and any help request you provide are shared with Google Calendar and the Project Refer host to create the invitation and Google Meet call. We keep a booking reference and time to prevent duplicate reservations. To change or cancel a call, contact hello@projectrefer.com.
6. Consent and messages
Recruiter sign-in, verification codes, application receipts and hiring-status messages are service communications. Privacy verification emails are sent when requested. Project Refer does not use these choices to enrol you in marketing.
WhatsApp updates, when enabled, require a separate opt-in. Reply STOP to stop them. Optional sharing with TigerHire is recorded separately from your application submission. You can request withdrawal through Your data. Withdrawal does not undo lawful processing that already happened; we will explain any records that must be retained.
We record the policy versions associated with new consent actions. You can request information about your consent records.
7. Cookies and device storage
Private recruiter sessions use essential cookies to keep you signed in. Candidate status links use access tokens. Saved jobs are stored in your browser’s local storage on that device; clearing browser storage removes that saved list. Cloudflare may use security-related mechanisms to protect the service.
With your permission, we use PostHog to measure public page visits and steps such as starting or completing an application or referral. Analytics uses an anonymous browser identifier stored on your device and sends limited usage events to PostHog’s US service. We exclude form contents, CVs, contact details, private account pages, and access tokens. Session recordings and automatic click capture are disabled. You can decline or withdraw permission using Privacy choices on public pages. We also respect browser Do Not Track and Global Privacy Control signals. Analytics counts cover participating browsers and are not a complete record of every visitor.
8. Retention and deletion
Recruiter account sign-in links expire after 15 minutes, account sessions after seven days and private candidate status links after 30 days. Privacy verification codes expire after ten minutes. Expiry of a link does not delete the underlying account or application.
Unsubmitted CV files and chat draft links expire after 24 hours. Unsubmitted files are scheduled for deletion, and files attached to deleted applications are removed by maintenance. Submitted CVs are kept with the application under the same retention considerations. Job, account and application records are kept while needed for the service, the hiring process and associated support, safety or legal purposes. We consider whether a job has closed, whether the information is still needed, whether you have requested deletion and whether a legal obligation or dispute requires retention. The service does not yet have a fixed automatic deletion schedule for every record category.
Candidate deletion verifies the email or number associated with the request. Email verification covers applications submitted with that email; it does not automatically delete a recruiter account or records held independently by an employer. Verified requests are queued for operator handling. Our service target is seven days for candidate deletion, subject to necessary checks and any lawful exception.
Backups, where used, may retain older records until their configured expiry. Backup exports are configured for a 30-day retention window when enabled; routine export and recovery verification are still operational launch tasks. A restore must account for completed deletions. Ask us about the status or scope of your request.
9. Security
We use HTTPS for traffic to the website, private access controls, hashed session and verification tokens, request limits and restricted operator access. Private API responses are marked not to be cached. CV originals and extracted CV text use authenticated application-level encryption. Originals remain quarantined until a configured malware scanner clears them; recruiters can review extracted text. Other candidate fields are not individually encrypted by our application code. We do not claim end-to-end encryption or absolute protection against every threat.
Keep sign-in links, verification codes and candidate status links private. Contact us promptly if a link is exposed or you suspect unauthorised access. We will investigate and provide notifications where required by applicable law.
10. International processing
OutsideIn is based in India. Cloud infrastructure, email and other providers may process information in other countries. Supporting international users does not mean information stays in their home country.
Where applicable law restricts an international transfer, the relevant transfer arrangements and safeguards must be assessed. We do not claim that a single global notice establishes compliance in every jurisdiction. Contact us for information about arrangements applicable to your data and location.
11. Your privacy rights
Depending on applicable law and the circumstances, you may request access or a copy of your information, correction, deletion, restriction, portability, objection to certain processing or withdrawal of consent. You may also raise a privacy complaint. Verification protects your information; we may request proportionate additional details if email access alone is not enough.
Use Your data or email hello@projectrefer.com. We will explain the request’s scope, any exception and the response timing that applies. You may complain to a relevant supervisory authority without first contacting us. UK users can contact the Information Commissioner’s Office; EEA users can contact their local data protection authority. Indian users can contact us about rights and grievance routes available under applicable Indian law.
12. Age and sensitive information
This hiring service is intended for adults, not children. Do not provide identity documents, government identifiers, health information, financial account details or other sensitive information in job descriptions, profiles or privacy-request notes. If you believe a child’s information has been submitted, contact us so we can review it.
13. Changes and contact
The date and version above identify this notice. We will update it when the product or its data practices change and provide additional notice or obtain renewed permission where required. Questions, corrections and grievances can be sent to hello@projectrefer.com.