Privacy

Information we handle

Applicants provide a name, email address, answers, and any resume or work material requested by a hiring team. An invited applicant may also submit an assessment. Recruiters provide account email, job posts, screening criteria, decisions, and optional interview booking links. We also keep operational records needed for sign-in, agent access, processing, and abuse limits.

How it is used

Badal shows applications and reports to the recruiter who owns the job post, screens submitted evidence against that recruiter’s criteria, emails candidates about next steps, and can email an interview booking link supplied by the recruiter. AI screening can advance or reject an application or send it to human review. Scores and summaries are available to the recruiter; the recruiter makes the final keep decision. The hiring organization may have its own applicant privacy notice and hiring practices.

Services involved

• OpenRouter: screening sends role criteria, applicant answers, and extractable text from submitted PDF or DOCX files to the configured AI model. It does not send the original file as an attachment in that request.
• Resend: delivers sign-in links and candidate emails using the relevant email address and message content.
• Google, if the recruiter connects it: Google Sheets receives candidate details, answers, stage, scores, decisions, and protected Badal file links. Badal does not create Google Calendar events. Google sign-in uses the recruiter’s Google identity and permissions granted during consent.
• Stripe: hosts credit checkout and stores card/payment information. Badal stores payment identifiers, purchased credits, amounts, and optional automatic top-up preferences, but does not store full card details.
• Amazon Web Services: hosts the application and a private encrypted S3 bucket for uploaded resumes and files. Recruiters can grant access to their own connected agents through Badal credentials.

Those providers may process information under their own terms and privacy policies.

Google account access

When a recruiter chooses Google sign-in or connects Google Sheets, Badal requests their Google account identity and drive.file access. Badal uses the identity to sign in or link the recruiter account. It uses drive.file to create and update role-specific spreadsheets for that recruiter; it does not read unrelated Drive files. The spreadsheets contain candidate details, answers, stages, scores, decisions, and protected Badal file links. Badal stores the Google refresh token encrypted on its server to keep those requested features working. Badal does not request Calendar access, read a recruiter's calendar, or create interview events. It does not send Google account or spreadsheet contents to the screening model for training or advertising.

A recruiter can revoke Badal's Google access in their Google Account permissions or contact us at hi@mail.badal.work about the connection. Revocation stops future authorized Google API requests, but already-created spreadsheets and any copies remain in the recruiter's Google account until separately removed. The recruiter can choose a separate third-party booking page for interviews; candidates who follow that link are subject to that provider's own terms and privacy practices.

Optional marketing measurement

If you allow measurement, Badal uses Google Analytics and Google Ads to measure public marketing page visits, new recruiter signups, successful recruiter activities (such as role creation, link copying, agent connection, and screening queues), and verified live credit purchases. Google may receive browser and network information through its tag. Badal sends sanitized page paths and opaque conversion identifiers, never names, emails, candidate answers, resumes, role descriptions, private URL parameters, or Google Sheets contents. Candidate forms and credential pages do not load these tags. Measurement is disabled until you opt in; use Measurement preferences to change your choice. The workspace sends only allowlisted activity and conversion events, with no pageview or automatic form tracking. Advertising user-data sharing and personalization are disabled.

Storage and access

Badal stores application and assessment records in its database and uploaded files in private encrypted Amazon S3 storage in the United States (Ohio). Migration backup copies may remain in private server storage until removed by the service operator. Claimed uploads are available only to the recruiter who owns the job post through an authenticated download endpoint. Unclaimed uploads are removed after about 24 hours. Badal currently has no automatic deletion date for submitted applications or claimed files; they remain until removed by the service operator. An application is still stored when a recruiter has used all free AI screening credits.

Recruiter sign-in uses a session cookie. Security and rate-limit records also include hashed network identifiers. Public application and assessment links should be treated as shareable access to those forms; agent keys and connection links should be kept private.

Your choices and requests

Applicants can choose whether to submit a form, but a hiring team may require particular fields or files for that role. To ask about an application, its correction, or its deletion, contact the hiring organization or write to hi@mail.badal.work with the role and email address used. Recruiters can also write to that address about account data or connected services. We will review requests under applicable law and may need to verify identity before acting. You can also contact your local data protection authority about privacy concerns where applicable.

Updates

We may update this notice as the service changes. The date at the top shows the current version. Questions can be sent to hi@mail.badal.work.