CVPRO is operated by Talpro India Pvt Ltd and processes personal data of data principals (candidates, recruiters, clients) under the Digital Personal Data Protection Act 2023 (India). This page documents our statutory posture: DPO, consent, data principal rights, DPIA register, and the grievance escalation path.
The DPO is the statutory point of contact for data principals and for the Data Protection Board of India.
Bhaskar Anand
CEO, Talpro Universe · serving as interim DPO (effective 2026-04-22, open-ended)
Every right below can be exercised by emailing the DPO or using the in-product request form (account settings → Privacy).
Request a machine-readable export of the personal data CVPRO holds about you. Fulfilled within 30 days.
Request correction of inaccurate data or erasure of data whose retention is no longer justified. Erasure executed within 45 days unless retention is statutorily required.
Raise a grievance with the CVPRO DPO. Unresolved grievances escalate to the Data Protection Board of India per DPDP §13(2).
Nominate a person to exercise your rights on death or incapacity (DPDP §14).
Consent is captured at the point of collection (CV upload, video recording, application submission) with a purpose-specific notice. Every consent event is written to an append-only ledger with timestamp, purpose, and revocation token. Revocation is one-click and triggers cascading data actions per the purpose.
Data Protection Impact Assessment entries for each processing purpose. Updated on material change and reviewed quarterly by the DPO.
| Purpose | Data classes | Legal basis | Retention |
|---|---|---|---|
| AI candidate evaluation (Claude + LiteLLM) | Resume text, structured skills, inferred domain-fit scores | Consent captured at upload | Active pipeline + 180 days grace; then hard delete unless placed |
| Resume storage + masking | Names, contact, addresses (masked per 3-level setting) | Legitimate interest (recruiter workflow) + consent | Pipeline duration · client-controlled retention window |
| Video interview recording | Browser-recorded video/audio, metadata | Explicit consent at record time (opt-in) | 90 days post-hiring decision |
| Third-party transactional services | Email (Resend) · payment identifier (Razorpay) · error telemetry (Sentry PII-stripped) | Processor contracts (DPAs in place) | Vendor retention + CVPRO override |
dpo@cvpro.in — first response within 72h; full resolution within 30 days.
If unresolved, file with the Data Protection Board of India per DPDP §28. We support the referral and provide the case record.
Appeals of Board orders lie with the Telecom Disputes Settlement Appellate Tribunal per DPDP §29.
CVPRO application data (Postgres, BullMQ queues, Redis, Resend transactional logs) is stored in India. Anthropic Claude API inference is routed through Anthropic's India-region endpoint where available and governed by a signed DPA. No personal data is transferred outside India without explicit consent and a Government-of-India-approved transfer mechanism.
Email the DPO, or start with the broader Security & Compliance and Privacy Policy overviews.