Privacy notice

Tulifo is run by Tulifo Private Limited ("Tulifo", "we", "us"), registered office 1st Floor, Room Bearing No. 19/35, Little Mount, Mount Road, Chennai, Tamil Nadu 600015, India. This notice covers tulifo.ai and app.tulifo.ai. It explains how we handle personal data under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the Information Technology Act, 2000 and its rules on sensitive personal data.

We play one of two parts, depending on how you use Tulifo:

• When a company uses Tulifo to hire — it invites you to an AI interview, or you apply to one of its roles — that company decides why and how your data is used. Under the DPDP Act the company is the Data Fiduciary, and we process your data on its behalf as its Data Processor.
• When you have your own Tulifo account as a job seeker or an interviewer, book a session with an interviewer, sign up for a company workspace, visit our website or contact us, we decide how that data is used and we are the Data Fiduciary.

Your account

Your name and email address, and your mobile number if our sign-in asks you to confirm one. The notices you agreed to — the terms, this notice, and that you are 18 or over — with the version and the time. Records that keep sign-in secure, such as when a sign-in code was sent and used, and the devices signed in to your account: the type of device and browser, and an IP address, which we store and show shortened. Supabase, our sign-in provider, also records the full address with each session.

Your résumé and profile

If you are a job seeker or an interviewer: the résumé you upload and the details read from it, such as work history, education and skills. Companies you list are shown as claims you made. If you confirm a work email, we keep only its domain (for example @acme.com), never the address.

Interviews

Video and audio of you; your screen, on a computer and only when that interview records it; a transcript; what you write in the code editor or draw on the whiteboard, and the result of any code you run; the scores, the evidence behind them and the report; and integrity events, such as a second voice, a second face, a voice that does not match your lip movements, a virtual camera, or switching away from the interview tab. Also the latest still from your camera, which the company can watch live and which is kept even when video is not recorded; a small photo from each identity re-check during the interview, or the full frame when it does not match; and your browser, operating system, type of device, screen size, time zone and network speed. Your browser may also look for a pulse in your face video, as a sign that a live person is there.

Identity checks

A photo of your government ID, a selfie, and the results of the face match and liveness checks. See “Identity checks and your biometric data” below.

Payments

The amount, date, status and Razorpay reference of each payment and refund, and what it was for (the role and company, or the session); for an AI interview, also the résumé you attached at checkout, until you delete your account. You enter card, UPI or bank details on Razorpay’s own page; we never see or store them. If you are an interviewer, the UPI ID you give us for payouts and a record of each payout.

Interviewer sessions

The time you booked, the role you named, any notes you add, the résumé you share with the interviewer, the call recording and the interviewer’s scorecard. If you are the interviewer: your profile (headline, bio, the companies and roles you list, years of experience, languages and tier), the times you offer, the sessions you hold and whether you attended, a count of the sessions you cancelled or missed, your scorecards, and your voice in the job seeker’s recording, which is kept with their copy.

Company workspaces

For people who use Tulifo for a company: your name, work email and role in the workspace, and what you add — job descriptions, the résumés and candidate details you upload (such as a phone number and location and, if you record them, date of birth and gender), invitations, hiring decisions and your conversations with the Tulifo assistant.

Website and enquiries

What you send through the contact form (name, email, an optional phone number, company, what you are hiring for and your message), and the technical details every web request carries, such as IP address and browser type. If you try Tulifo without an account, the job description and résumés you add are processed to produce the screening but are not stored on our servers; your work stays in your browser, though our analytics recordings can capture what the page shows (see “Analytics and cookies”).

• To run the interview or session you take part in, including the AI interviewer’s questions and voice.
• To produce the scores and evidence-linked report a company asked for, or your own result as a job seeker.
• To check identity and integrity: that the person in the interview is the person invited, and that it was taken fairly.
• To let you send your result to a company, and to take it back.
• To take payments, send receipts, make refunds, pay interviewers and keep the tax records the law requires.
• To send the emails you need: invitations, sign-in codes, receipts, reminders and updates.
• To keep the service secure, prevent fraud and abuse, and fix problems.
• To understand how the website and app are used, so we can improve them.
• To meet our legal obligations and answer lawful requests.

We do not sell personal data, we do not use it for advertising, and we do not use your recordings, transcripts, scores or identity images to train AI models. If that ever changes, we will update this notice first and ask for your consent where the law requires it. Our service providers handle data under their own terms, which may allow some of them to keep it for a time or to use it to improve their own services.

For your own account, your sessions and your own AI interviews, we rely on your consent, which you can withdraw (see “Your rights”). For a company’s interview, the consent you give before your camera turns on is given to that company, through Tulifo. Some processing does not need consent under the DPDP Act — keeping tax records, for example, or complying with a legal order.

An AI interviewer asks the questions and AI scores the answers. Every score links to the parts of the interview that support it, so a person can check it.

When a company uses Tulifo to read résumés, AI scores each one against the job description. If the company turns it on (it is off until they do), a résumé that clearly meets the requirements is invited to an AI interview automatically. No résumé is declined automatically: below the bar it waits for a person at the company.

Tulifo does not reject anyone for a job automatically: people at the company make hiring decisions. Integrity signals are flagged, with a confidence level, for a person to review; they do not fail a candidate on their own. A report may include an advisory AI reading of your answers — their tone or traits — made from the words you used, not from your face or voice. It is not part of your score. We never score your facial expressions.

Two things can stop an interview, and you are told about each before it happens. If your face does not match your ID in three tries at the identity check, you cannot join that interview; the company (or Tulifo, for a job seeker’s own attempt) can see this and review it. And unless the company has turned it off (it is on by default, and on for a job seeker’s own interview), an interview ends when your screen is not shared or your face is not in view through 3 on-screen warnings of 30 seconds each; what you said up to then is still scored.

You can ask for a person to review any decision about you. For a company’s interview, ask the company. A job seeker’s result decides nothing on its own; if you think it is wrong, write to us.

Your face and your ID are sensitive personal data. We ask for your consent on its own screen before your camera turns on, and we use these images only to confirm who you are, and to show the people reviewing that check the evidence for it.

Before an interview

Before an interview you photograph a government ID and take a selfie. A face-matching service compares the two: Amazon Rekognition, run by Amazon Web Services in Mumbai, or, when we use it, Didit. For a job seeker’s own interview it is always Amazon Rekognition, and if no service is available, a person reviews the images instead. If you are a job seeker whose Tulifo account is already verified, a selfie alone may be enough for your own AI interview. You may be asked to blink or turn your head, and your browser checks the camera feed for signs of a live person rather than a photo or a video. During the interview, frames from your camera are compared with your selfie from time to time, to confirm it is still you.

The ID photo and the selfie are kept with that interview and deleted when the interview is deleted (see “How long we keep it”). When Didit carries out this check, we instruct it not to keep the images. We also keep the name Didit reads from the ID and a masked document number in that interview’s log.

Your account’s identity check

If you are a job seeker or an interviewer, we may ask you to verify your identity once for your Tulifo account. You give a separate consent for it before your camera turns on.

• You photograph a PAN card, passport or driving licence and take a selfie; we do not accept Aadhaar. When our document check can read the number, an Aadhaar card is refused and not stored; if one reaches a person for review, its image is deleted when they decide.
• A face-matching service compares your selfie with the photo on your ID. We use Amazon Rekognition, in Mumbai, and may also use Didit to check the document, match the faces and confirm you are a live person. When Didit does this check for your account, we instruct it not to keep the images.
• If the check passes, the ID image is not stored at all. If a person needs to review the check, the ID image is kept only until they decide, then deleted.
• We keep one reference photo of your face to confirm it is you when you start a later AI interview on Tulifo as a job seeker. It stays until you remove your verification on your account’s Security page, withdraw your consent, or delete your account.
• We never store your date of birth or your full document number. We keep the type of document you chose, the match scores, a log of the check and, when our document check reads them, the name printed on the ID, its last four characters and whether it shows you are 18 or over.
• A failed match is not final on its own: after three failed tries, or when the result is uncertain — for example the name our check reads does not match your profile, or the ID suggests you are under 18 — a person reviews it.

• The company that invited you, or that you applied to, sees your interview — live while it happens if someone there is watching, who can send you a message or give the AI interviewer an instruction — and its report, its recording and the ID photo and selfie from your identity check, for its own hiring. Other companies do not.
• As a job seeker, you alone see your own interviews and results. A company sees a result only if you choose to send it to them: your name, email address and résumé; the scores, report and transcript; the integrity notes and the identity-check statement; which attempt it was; and access to watch the recordings while your result stays sent. It stops seeing the result when you take it back — though it may already have read it. If the company has already invited you to its own interview from that application, that record is the company’s.
• The interviewer you book sees your name, the role you named, your notes and the résumé you share. You see the scorecard they write, except any private notes the interviewer keeps for themselves (Tulifo staff can also see those).
• If you are an interviewer, job seekers see your name and profile — headline, bio, the companies and roles you list, years of experience, languages and tier — and the times you offer.
• A small number of Tulifo staff can see data when it is needed to help you, review an identity or integrity check, handle a payment, or keep the service secure.
• Our service providers, listed below, each receive only what their task needs.
• Authorities, when the law requires us to share data; and a buyer or successor if Tulifo’s business is transferred, who must protect it as this notice does.

These companies process personal data for us. Our database and file storage are in Mumbai, India. Several providers process data outside India — mostly in the United States — for the part of the service they run. Some are used only when the feature that needs them is switched on. We share personal data outside India only with the providers listed here, for the tasks listed, and not with any country the Government of India restricts under section 16 of the DPDP Act.

Supabase

Database, sign-in and file storage, in Mumbai. Holds the data described in this notice.

Vercel

Hosts the website and app and runs our server code in Mumbai; measures how fast pages load. Sees requests as they pass through, including your IP address.

Daily

Connects the live video of interviews and interviewer sessions. Carries your audio and video while the call is live.

Deepgram

Turns your speech into text during an AI interview. After an AI interview ends, it also receives the camera recording (video and audio) to check whether more than one person was speaking. If you apply to be an interviewer, it also turns your speech into text while you record your introduction video, and receives the finished video to transcribe it and check whether more than one person was speaking.

ElevenLabs and Sarvam AI

Give the AI interviewer its voice. Receive the interviewer’s words, which may include your name.

OpenAI, Anthropic, Google Cloud (Vertex AI) and Sarvam AI

AI models that run the interview conversation, read résumés and job descriptions, score interviews and write reports. Receive the text of the conversation, résumés, job descriptions and your code. Anthropic also receives still frames of your screen recording, to check for AI tools in use, when that check is switched on.

Amazon Web Services (Rekognition)

Matches faces for identity checks, in Mumbai. Receives your ID photo, your selfie and frames from your camera.

Didit

Checks ID documents, matches faces and confirms liveness. Receives your ID photo and your selfie.

Hugging Face

Gives an AI reading of your answers (their tone or traits). Receives the text of your answers.

Judge0 (through RapidAPI)

Runs the code you write in an interview. Receives that code.

Resend

Sends our emails. Receives your email address, your name and the email’s content.

MSG91

Sends mobile sign-in codes by SMS or WhatsApp when sign-in asks for one. Receives your mobile number and the code.

Razorpay

Takes payments and makes refunds. Receives your name, email address and what you are paying for; you give your payment details to Razorpay directly, and we receive back the amount, status and reference.

Google

If you sign in with Google, confirms who you are and tells us your name and email address.

PostHog

Product analytics, in the United States. Receives page views, clicks, recordings of how pages were used and an approximate location (see “Analytics and cookies”).

• A company’s interviews — recording, transcript, scores, report, identity images and résumé — are kept for as long as that company keeps them; each company decides. They are deleted, stored files included, when the company deletes the interview, the candidate, the job or its workspace, or when a deletion request is carried out.
• A job seeker’s interviews, results and session recordings are kept until you delete your account or ask us to delete them. After deletion a record of each booked session remains — its time, the role you named, the price and the interviewer’s scorecard — no longer linked to your account, as the record of that payment.
• Your account’s identity check: the ID image is deleted once a decision is made; the reference photo is kept until you remove your verification, withdraw your consent or delete your account.
• Payment records are kept for as long as tax law requires, even after the account is deleted, with your details removed: what remains is what was bought (the role and company, or the session), the amount, the date, its status, the payment reference and whether you confirmed you were 18 or over.
• Mobile and work-email codes are deleted about a day after they are used or expire; the record that a session passed sign-in is deleted when the session ends, or after 90 days. The record of the notices you agreed to is kept for as long as your account exists.
• Contact-form enquiries are kept while we deal with them and afterwards as a record, until you ask us to delete them.

Before you delete a job seeker or interviewer account, your Settings page lists what will be deleted and what will be kept. Deleted data can remain for a short time in our providers’ routine backups until they are overwritten.

Under the DPDP Act you can:

• ask for a summary of the personal data we hold about you, what we do with it, and who we have shared it with;
• ask us to correct, complete or update it;
• ask us to erase it, unless the law requires us to keep it (payment records, for example);
• withdraw your consent at any time — by removing your verification on the Security page, deleting your account, or writing to us — this does not undo what was done before, and an interview or an identity check cannot continue without it;
• nominate someone to exercise these rights for you if you die or become unable to;
• have a grievance dealt with by us and, if you are not satisfied, complain to the Data Protection Board of India.

How: job seekers and interviewers can delete their account on the Settings page and remove their identity verification on the Security page. A candidate can ask for an interview’s data to be deleted from that interview’s status page. For anything else, write to privacy@tulifo.ai from the email address on your account; we may ask you to confirm it is you. If you took a company’s interview, tell us the company’s name and the email address your invitation came to. A lawful guardian of a person with a disability can exercise these rights for them. We reply within 30 days.

If a company invited you to its interview, the company decides about that data. You can ask the company, or write to us and we will pass your request on and help get it done.

This notice is in English. If you would like it in another language listed in the Eighth Schedule to the Constitution of India, write to us and we will provide it.

If you have a concern about how we handle your personal data, write to our Grievance Officer, Arun Kumar, at privacy@tulifo.ai or by post to Tulifo Private Limited, 1st Floor, Room Bearing No. 19/35, Little Mount, Mount Road, Chennai, Tamil Nadu 600015, India. Tell us what happened and which account or interview it concerns. We reply within 30 days. If you are not satisfied with our answer, or we do not reply in that time, you can complain to the Data Protection Board of India.

Data is encrypted in transit and at rest. Each company’s data is kept apart by rules enforced inside the database, recordings and identity images are reached only through signed links that expire within hours, and only a small number of Tulifo administrators can see customer data, for the purposes in this notice.

If a personal data breach affects you, we will tell you and the Data Protection Board of India as the law requires, without undue delay: what happened, what it may mean for you, and what we are doing about it. If it affects data we hold for a company, we will tell that company straight away so it can tell you.

Tulifo is for people aged 18 or over. We ask you to confirm you are 18 or over when you create an account through our sign-in, pay for an AI interview or book a session, and companies must not invite anyone under 18. We do not knowingly process the personal data of anyone under 18; if we learn that we have, we will delete it, or ask the company that holds it to. If our account identity check reads a date of birth under 18, a person reviews it.

• Sign-in cookies keep you signed in. The app does not work without them.
• Your browser stores a few preferences, such as light or dark theme, and the work you do on Tulifo without an account.
• PostHog records page views, clicks, an approximate location from your IP address, and recordings of how pages were used. These recordings hide what you type into form fields but can include what a page shows — for example the candidate names, résumé details and scores a company user sees, or a job seeker’s results. PostHog stores an identifier in your browser. Signed-in company users are linked by an internal account number, their workspace name and their role, not by email. PostHog does not run on the AI interview pages.

We do not use advertising cookies. You can block or clear cookies in your browser settings, but signing in needs them.

We update this page when what we do changes, and change the date at the top. If a change is significant, we will tell you by email or in the app before it applies, and ask for your consent again where the law requires it.

Tulifo Private Limited (CIN U78300TN2026PTC192249), 1st Floor, Room Bearing No. 19/35, Little Mount, Mount Road, Chennai, Tamil Nadu 600015, India. Privacy questions, requests and grievances: privacy@tulifo.ai (Grievance Officer: Arun Kumar). Anything else: support@tulifo.ai.