Privacy Policy

Nervyn AI Private Limited ("Nervyn", "we", "us", "our") is a company registered in India, with its registered office at E4/99 Aastha Tower, Arera Colony, Bhopal 462016, Madhya Pradesh, India. We operate this website (nervynai.com) and the Nervyn hiring platform (app.nervynai.com), including the Nervyn browser extension.

We are the data controller for website visitors, demo enquiries, and the accounts of people who sign in to the platform. For candidate and other recruiting data that our customers (employers) put into the platform, the employer is the controller and we process that data on their behalf as a processor.

Questions about this policy: info@nervynai.com.

On this website

• Enquiry forms (Book a Demo, Pricing) — your name, work email, company name, role, team size, revenue range and any notes you add.
• Meeting booking — if you book a call through the embedded Cal.com calendar, the name, email and time you enter.
• Usage data — IP address, browser type, pages visited and time on page, and, only if you allow it, analytics and session-recording data (see Cookies below).

On the Nervyn platform

• Account data — name, work email, role, workspace and sign-in records for talent team members, hiring managers and administrators.
• Candidate data — name, contact details, resume or CV, work history, skills, applications, interview schedules, feedback, scorecards and offer details, provided by the candidate or by the employer.
• Communications — email, SMS, WhatsApp and Slack messages sent or received through the platform, and their delivery status.
• Calendar data — when you connect a Google or Microsoft calendar: free/busy times and the interview events the platform creates (details in the Google user data section below).
• Log data — IP address, browser type, pages visited and error reports, used to run and secure the platform.

• Respond to demo and pricing enquiries and schedule calls you book.
• Provide the platform: requisitions, roles, candidate pipelines, interviews, offers and onboarding.
• Schedule interviews and send the messages you or your workspace ask us to send.
• Run AI features that suggest matches, draft messages, summarise feedback and coordinate scheduling. People review AI suggestions; the platform never moves a candidate's stage or extends an offer on its own.
• Send transactional emails (account setup, onboarding, support), and product updates if you opted in.
• Secure the website and platform, prevent abuse, and meet legal obligations.

We do not sell personal data. We do not use personal data for advertising. We do not use customer or candidate data to train AI models.

When you connect a Google account to the Nervyn platform, we request only these permissions and use each one only as described:

• See your email address (userinfo.email) — to identify which Google account you connected, so events are created on the right calendar.
• See your calendars (calendar.readonly) — to read your free/busy times so Nervyn only proposes interview slots when you are available.
• View and edit events on your calendars (calendar.events) — to create, update and cancel the interview events you or your scheduling assistant book, including Google Meet links.

What we access, and what we don't. From your calendar we read only free/busy time ranges (start and end times). We do not read the titles, descriptions, attendees or locations of your existing events, your contacts, your email, or your Drive files. We write only the interview events booked through Nervyn.

How we use it. Free/busy ranges are fetched when an interview is being scheduled. Our own code uses them to work out when you are free, and those free times are offered to the candidate and shown to you. If your workspace has AI-written scheduling messages turned on, the proposed times (not your calendar) are included in the text sent to our AI inference provider, DeepInfra, only to word that message. DeepInfra processes it on our behalf and may not use it for any other purpose.

What we store. (a) Your Google OAuth refresh token, encrypted with AES-256-GCM before it is written to our database; (b) the email address of the connected Google account; (c) for each interview Nervyn books, the Google Calendar event ID and the interview time, so the event can be updated or cancelled. We do not store your free/busy data; it is discarded once the free times are worked out.

How we protect it. Google data travels only over encrypted connections (TLS) and is stored encrypted at rest. The token-decryption key is held separately from the database. Access is limited to the Nervyn services that schedule interviews and, under the conditions below, a small number of authorised engineers.

Who we share it with. Only the providers that host Nervyn on our behalf (Supabase, Railway, Vercel) and, for the proposed times only, DeepInfra. Interview events we create are visible to their invited attendees through Google Calendar, like any meeting invite.

Retention and deletion. We keep the refresh token and connected email only while your calendar is connected. When you click Disconnect in Nervyn (Interviews → Settings → Connectors), we revoke the token with Google and delete the token and connected email immediately. Interview event IDs are part of the interview record and are deleted with it when your workspace deletes that interview or closes its account (within 30 days; backups roll off within 90 days). You can also remove Nervyn's access at any time from your Google Account permissions page, and ask us to delete any Google data we hold by emailing info@nervynai.com.

Limited Use. Nervyn's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the user-facing features above. We do not transfer it to others except as needed to provide those features, to comply with law, or as part of a merger or acquisition with notice to you. We do not use it for advertising, we do not sell it, and we do not use it to develop, improve or train generalised AI or machine-learning models. No person at Nervyn reads Google user data unless you give us permission for a specific item (for example, a support request), it is needed for security purposes such as investigating abuse, or the law requires it.

If you connect a Microsoft account, Nervyn reads your free/busy times and creates, updates and cancels interview events on your calendar. The same commitments as for Google data apply: no advertising use, no sale, no training of AI models. Disconnecting in Nervyn deletes the stored token; you can also remove Nervyn from your Microsoft account's app permissions page.

We share personal data only with the service providers below, which process it on our instructions under written agreements, and where the law requires it. Within a customer workspace, data is visible to that workspace's authorised users according to their role.

• Supabase — database, authentication, file storage; also stores website enquiries
• Vercel, Railway, Firebase Hosting (Google) — application and website hosting
• Upstash — job queue
• DeepInfra — AI model inference
• Resend, Twilio, Meta (WhatsApp), Slack — email, SMS, WhatsApp and Slack messaging
• Google, Microsoft — calendar integration, when you connect it
• EmailJS — delivers website enquiry notifications to our team
• Cal.com — meeting booking on this website
• Google Analytics, Microsoft Clarity — website analytics, only with your consent

We never share personal data with third parties for their own marketing. We may disclose data if required by law or court order, or to protect the rights and safety of Nervyn, our customers or the public.

Some providers process data outside India and outside the UK/EEA. Where the GDPR or UK GDPR applies, we rely on the Standard Contractual Clauses, the EU-US or UK-US Data Privacy Framework, or another lawful transfer mechanism.

• Website enquiries — 24 months from submission, unless you become a customer, in which case they become part of your account record.
• Platform account data — while the account is active.
• Candidate and customer data — for as long as the employer's workspace instructs us to. We delete it within 30 days of the employer deleting it or closing the workspace; backups roll off within 90 days.
• Server log data — 90 days.

We keep data longer only where the law requires it.

We use the following categories of cookies and similar technologies on this website:

Strictly necessary — required for the website and platform to function, and to remember your cookie choice. These cannot be disabled.

Analytics — Google Analytics 4 (Google Ireland Ltd) Tells us which pages are visited, where visitors arrive from, and which buttons and forms are used. Cookies set: _ga and _ga_FTSX5NV6SX, both expiring after 24 months. We do not send your name, email address, or form contents to Google, and we do not use Google Analytics for advertising or remarketing.

Session recording — Microsoft Clarity (Microsoft Corporation) Records how you interact with a page — mouse movement, scrolling, clicks and the pages you move between — so we can replay the session and see where the site is confusing. Cookies set: _clck (12 months) and _clsk (1 day). Text you type into forms is masked before it leaves your browser, so we can see that a field was filled in but not what you wrote.

Your choice Analytics and session recording only run if you allow them. If you are in the UK, EEA or Switzerland, nothing is loaded until you choose — we ask on your first visit and remember your answer. You can change or withdraw your choice at any time using the Cookie settings link in the footer of any page, or by clearing this site's data in your browser. Declining does not affect your ability to use the site.

Under India's Digital Personal Data Protection Act, 2023, you may ask to access, correct, complete or erase your personal data, withdraw consent, nominate another person to exercise your rights, and raise a grievance with us.

If the EU or UK GDPR applies to you, you also have the right to:

• Restrict processing in certain circumstances
• Object to processing based on legitimate interests
• Data portability — receive your data in a structured, machine-readable format
• Complain to your local supervisory authority (in the UK, the Information Commissioner's Office)

To exercise any right, email info@nervynai.com. We reply within 30 days. If we process your data for an employer, we will pass your request to that employer.

Data is encrypted in transit (TLS) and at rest. Each customer workspace is isolated at the application and database level, access is limited by role, and administrative access is logged. No system is perfectly secure; if a breach affects your personal data, we will notify you and the relevant authorities as the law requires. To report a security concern, email info@nervynai.com.

The website and platform are for businesses and job seekers aged 18 or older. We do not knowingly collect data from children.

We will post changes on this page and update the "Last updated" date. If a change is material, we will notify platform account holders by email before it takes effect.

Nervyn AI Private Limited E4/99 Aastha Tower, Arera Colony, Bhopal 462016, Madhya Pradesh, India

Grievance Officer / Data Protection contact: info@nervynai.com