Last updated: July 8, 2026
Talexa ("Talexa", "we", "our", or "us") is an AI-powered recruitment automation platform operated by Millionways. This Privacy Policy explains how we collect, use, disclose, and protect personal data when you use our service at talexa.millionways.in. It is designed to comply with India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025, together with the Information Technology Act, 2000 and its rules.
Under the DPDP Act, the entity that decides the purpose and means of processing personal data is the Data Fiduciary, and the entity that processes it on the Fiduciary's instructions is the Data Processor.
We collect the following categories of personal data:
| Category | Examples |
|---|---|
| Recruiter account data | Name, email, organisation name, hashed password |
| Candidate data (uploaded by recruiters) | Name, phone number, CV / resume, employment history, current and expected CTC, notice period |
| Screening data (generated by the platform) | WhatsApp conversation transcript, candidate responses, AI-derived qualification score and status |
| Payment data | Subscription and billing records. Card / UPI details are handled directly by our payment processor (Razorpay) — Talexa never sees or stores full card numbers. |
| Technical & usage data | IP address, device / browser type, log data, and cookies strictly necessary for authentication and security. |
Recruiter account data is used to operate and secure your account. Candidate and screening data is used solely to run the recruitment screening flow configured by the recruiter. We do not sell, rent, or share personal data, and we do not use candidate data for advertising, profiling unrelated to the campaign, or training third-party AI models.
We process personal data on the basis of consent and, where applicable, the "certain legitimate uses" recognised in Section 7 of the DPDP Act — in particular, data a candidate has voluntarily provided to an employer for a job application is processed for that same recruitment purpose. Recruiters are responsible for ensuring they have a lawful basis to upload and process any candidate data on Talexa.
Talexa sends WhatsApp messages to candidates on behalf of recruiters using the Meta WhatsApp Business Platform. Candidates may receive messages from a business-verified number. Replies are processed to evaluate candidate responses against recruiter-defined criteria. Candidates can opt out at any time by replying "STOP", "UNSUBSCRIBE", or "REMOVE ME" — the number is then suppressed and receives no further messages.
We use only cookies and local storage that are strictly necessary to keep you logged in and to protect against fraud and abuse (e.g. authentication tokens, CSRF protection). We do not use third-party advertising or cross-site tracking cookies.
We share personal data only with vetted service providers who process it on our behalf under contract:
We may also disclose data where required by law, court order, or a lawful request from a government authority.
Some of our sub-processors store or process data outside India (for example, our database region and certain AI and messaging providers). The DPDP Act permits such transfers except to countries specifically restricted by the Central Government; none of our current providers are on any such list. By using Talexa you acknowledge that personal data may be processed outside India by the sub-processors listed above.
Data is stored on secure cloud infrastructure and is strictly partitioned by organisation so that no organisation can access another's data. We apply reasonable security safeguards including HTTPS/TLS in transit, bcrypt password hashing, rotating access and refresh tokens, account lockout after repeated failed logins, CSRF protection and security headers, and access-controlled signed URLs for CV documents.
Recruiter and candidate data is retained for the duration of the subscription. Following account closure or a valid erasure request, personal data (including candidate records, conversation state, and stored CV documents) is deleted or anonymised within 90 days, except where a longer period is required by law. System and security logs may be retained for up to 12 months for breach investigation.
Subject to the DPDP Act, you have the right to:
Candidates: because your organisation-of-application is the Data Fiduciary for your data, access/correction/erasure requests are usually fastest through the recruiter who contacted you. You may also contact us and we will route your request. We aim to respond within the timelines set by the DPDP Act (generally within 90 days).
Talexa is a professional recruitment tool intended for use by working professionals and is not directed at children. We do not knowingly process the personal data of individuals under 18. Recruiters must not upload data of minors.
In the event of a personal data breach, we will notify the Data Protection Board of India and affected users in accordance with the timelines and manner prescribed under the DPDP Rules, 2025.
In accordance with the DPDP Act and the IT Act, you may contact our Grievance Officer for any privacy concern or data-principal request:
Grievance Officer: Piyush (Millionways)
Email: consult@millionways.in
We may update this Privacy Policy from time to time. Material changes will be communicated via the platform or email, and the "Last updated" date above will change. Continued use after an update constitutes acceptance of the revised policy.
This Privacy Policy is governed by the laws of India, and any disputes are subject to the exclusive jurisdiction of the courts of India.
© 2026 Millionways / Talexa. All rights reserved.