Ratch AI Private Limited ("Ratch", "Ratch.ai", "we", "our" or "us") is a company incorporated in India and a wholly-owned subsidiary of Fabric IoT Private Limited. We own and operate websites, products and services under names such as "Ratch.ai", "Ratch Hiring", "Ratch AI Interviewer" and "AI Voice Screener" (collectively, our "Services"). The "Ratch.ai" brand and related intellectual property are owned by Fabric IoT Private Limited and licensed to us. This Policy explains how we collect, use, disclose, retain and protect personal data across all our websites (web and mobile) and Services. In this Policy, "customer" means an employer, recruiter or organisation using our Services; "candidate" means a job seeker who participates in an interview, screening or assessment through the Services.
1. Scope and our role
This Policy may apply to website visitors, prospective customers, customers and their representatives, candidates, business contacts, and individuals whose information is processed through our Services.
Where a customer uses our Services for interviews, screening, assessment, evaluation or shortlisting, that customer decides whether and how these are performed. In those cases we act as a data processor on behalf of, and per the instructions of, that customer (the controller / data fiduciary).
For our own websites, marketing, account administration, billing, security, support and service-improvement activities, we act as a data controller.
2. Personal data we may collect or process
- 2.1 Business contact & marketing data: Name, organisation, job title, business contact details; communications with us (enquiries, demos, support, events); billing/payment details; and publicly available business information, where permitted.
- 2.2 Platform, account & technical data: Account and login details, device/browser information, IP addresses, system and audit logs, activity and support records, and other data generated through use, administration or security monitoring of the Services. We also use cookies and analytics (see Section 11).
- 2.3 Candidate, interview & screening data: Our AI analyses the content of responses against job-related criteria. It does not assess emotion, personality, facial expressions, gaze, accent or voice tone. Information submitted by candidates, provided by customers, or generated through use, including: Personal details (name, email, mobile, job details, skills, education); AI Interview Data: audio, video, screen recording, transcript, metadata; proctoring/integrity events (tab-leaving, screen-share interruptions, camera/mic disconnects); AI Voice Screener Data: audio recordings, transcriptions, session metadata (duration, timestamps), employer-provided screening questions; Assessment results, scores, evaluations and workflow records; and Ratch Meet (live video interview) data: audio and video of the call, session metadata, and an AI-generated transcript and summary created as part of the standard interview record.
- 2.4 Sensitive / biometric data: We assess response content only. We do not perform emotion recognition, voice-tone, facial, gaze, accent or personality analysis, or generate biometric inferences.
We do not require more personal data than is reasonably necessary. Customers remain responsible for ensuring data they submit is collected and used lawfully and consistently with their obligations to individuals.
3. How we use personal data
- To provide, operate, maintain, secure and improve the Services
- To administer accounts, user access, subscriptions, billing and payments
- To respond to enquiries, demos, support and other communications
- To send newsletters, product updates and business communications, where permitted
- To conduct business development, market analysis and relationship management
- To conduct AI interviews and voice screenings, share results with employers, provide hiring analytics, and match candidates with opportunities
- To monitor, investigate and prevent misuse, unauthorised access, fraud or unlawful activity
- To improve our AI systems, subject to Section 6
- To comply with legal, regulatory, contractual, audit, tax, accounting or professional obligations
- For any other purpose notified to you or permitted by law
4. Legal basis and consent
We are working towards full compliance with applicable data protection laws, including the GDPR, Singapore's PDPA, and India's DPDP Act, 2023, alongside the Indian IT Act and other applicable regulations. Depending on the circumstances, our lawful grounds may include performance of a contract, legal obligations, our legitimate interests, supporting our customers' use of the Services, or consent.
- Interview/screening consent: Each AI interaction begins with a clear spoken or displayed disclaimer that the session is conducted by AI, recorded and evaluated.
- Where customers use the Services for their own recruitment purposes, the customer is responsible for the applicable legal basis, consent and notification requirements, including lawful use of recording features under local voice/video and employment laws.
5. Candidate data and employer access
Our Services act as a platform between customers and candidates. When you participate in an employer-created assessment, your information and the resulting outputs are shared with the respective employer, who is the controller of that data and is best placed to respond to requests about the assessment, decisions made, or data it holds. Such requests may need to be directed to that employer; we will assist and coordinate as appropriate (see Section 12).
6. AI features, automated processing and model use
Recruitment AI may be "high-risk" under laws such as the EU AI Act. Our Services generate transcripts, scores, voice/emotion analysis, classifications and summaries to support customer review and decision-making; and support (not replace) human decisions and analyse content only — no emotion or biometric analysis. Customers remain responsible for fair, lawful, non-discriminatory use.
- No final decisions by Ratch: We do not make final hiring, shortlisting, rejection or employment decisions. Customers remain responsible for reviewing outputs and deciding under their own policies and legal obligations.
- Right to human review: Where you are subject to processing with a significant effect, you may request human review of, and contest, decisions, and obtain meaningful information about the logic involved, as provided under applicable law.
- High-risk AI / jurisdictional limits: Recruitment AI may be "high-risk" under laws such as the EU AI Act. Our Services support (not replace) human decisions and analyse content only — no emotion or biometric analysis. Customers remain responsible for fair, lawful, non-discriminatory use.
- AI model improvement: We may use de-identified and aggregated data to improve our AI systems only where authorised by the relevant customer's contract. We do not use identifiable candidate data for model training, and apply de-identification safeguards appropriate to voice and facial data.
7. Disclosure of personal data
We do not sell personal data or share it for cross-context behavioural advertising.
We may disclose data where reasonably necessary to:
- Cloud hosting, infrastructure and storage providers (e.g. Google Cloud, Firebase, NeonDB)
- AI, telephony and voice providers (e.g. Anthropic, OpenAI, ElevenLabs, LiveKit)
- App stores (Google Play, Apple App Store)
- Analytics/support providers (Google Analytics, Firebase Analytics, Microsoft Clarity)
- IT support, payment processors, banks, auditors, insurers and professional advisers
- Our parent company Fabric IoT Private Limited and affiliates, where they provide infrastructure, support or operational services
- Regulators, law enforcement or courts where required or permitted by law
- Our customers, in connection with their use of the Services
- Others where you authorise it or it is permitted by law
Sub-processors access data solely to deliver the Services securely. We require appropriate contractual, technical and organisational safeguards. A current sub-processor list is available on request, and customers are notified of material changes per their contract.
8. International transfers
Personal data may be processed or stored in India and other jurisdictions where we or our providers operate (including the United States). Where we transfer data internationally, we implement safeguards required by law — such as Standard Contractual Clauses, adequacy mechanisms or equivalent contractual protections — and, for DPDP, transfer only to jurisdictions not restricted by the Government of India.
9. Retention
We retain personal data only as long as reasonably necessary, or as required by law, contract, audit, tax, legal-hold or dispute-resolution needs.
- Candidate, interview and screening data: Processed for customers, retained per the employer's plan and contract, and deleted on request by the employer or candidate, or on account termination — and in any case no longer than necessary unless legally required.
- Business contact, account, billing and contract data: Retained per applicable law and our legitimate business, accounting and audit needs.
At the end of the retention period, we delete, anonymise or securely dispose of data unless retention is legally required.
10. Security
We apply industry-standard safeguards appropriate to the data, including encryption in transit and at rest, role-based access and authentication controls, secure hosting, logging, backups, monitoring, regular audits, incident-response, staff training and vendor management. We are in the process of obtaining SOC 2 Type 2 and ISO 27001 certification.
No method of transmission or storage is fully secure. Users are responsible for keeping their own systems, devices and credentials secure. We may monitor platform and system activity for security, support, operational and compliance purposes only.
11. Cookies and analytics
Our websites and Services use cookies and similar technologies — including Google Analytics, Firebase Analytics and Microsoft Clarity — to improve functionality, security, performance and user experience, and to analyse usage. Some cookies are necessary; others are used where permitted. You can manage preferences via browser settings; disabling some cookies may affect functionality.
12. Your rights and choices
Subject to applicable law, you may have the right to: access your data; correct inaccurate or incomplete data; withdraw consent; request deletion; object to or limit certain processing; request human review of significant automated processing; and obtain information on how your data has been used or disclosed.
To request deletion of your account and data (including interview data), email support@ratch.ai. Once verified, we will process your request promptly.
Where we process data on behalf of a customer, that customer is generally responsible for decisions about the processing. In those cases we will acknowledge your request and coordinate with the relevant customer to facilitate it — we will not ignore or refuse it.
13. Data incidents
If we become aware of a data incident, we will assess and respond per our internal procedures, contracts and applicable law. Where notification is required, we will notify the relevant authority, customers and/or affected individuals within the timeframes required by law (for example, within 72 hours where the GDPR applies, and as required under the DPDP Act).
14. Grievance Officer / Data Protection Contact
In line with the DPDP Act and Indian IT Rules, you may contact our Grievance Officer / Data Protection Contact for any data-related question, request or complaint:
- Grievance Officer / Data Protection Contact: Ratch AI Private Limited (a subsidiary of Fabric IoT Private Limited)
- Email: support@ratch.ai
(To be updated with a named officer and direct contact details.)
15. Children's privacy
Ratch Hiring is intended for individuals aged 18 and above. We do not knowingly collect personal information from anyone under 18, and will delete such data if discovered.
16. Governing law
This Policy is governed by the laws of India, without prejudice to additional rights available to you under the data protection laws of your own jurisdiction.
17. Updates
We may update this Policy from time to time. The updated version will be made available through our websites or Services, with the "Last Updated" date revised accordingly.
18. Contact us
- Email: support@ratch.ai
- Company: Ratch AI Private Limited (subsidiary of Fabric IoT Private Limited)