WSI AnalyticsPrivacy notice
How WSI Analytics handles personal data: what we collect, why, where it is kept, for how long, and how you can reach us about it.
1. Who we are
WSI Analytics is a service of WebSols India ("we", "us"), offered at models.websolsindia.com and api.websolsindia.com. Its candidate and recruiter service, Hire-o-meter, is offered at hire-o-meter.com and api.hire-o-meter.com (hire-o-meter.in and hireometer.in lead there); this notice covers both. Payments for both are collected on models.websolsindia.com. For the personal data described in this notice we decide why and how it is used, so we are its Data Fiduciary under India's Digital Personal Data Protection Act, 2023.
2. What this notice covers
- People who visit the website or send us an enquiry.
- People who sign in to the platform for an organisation that uses it (client users), and WSI administrators.
- Job seekers who create a candidate profile with us (candidates). See section 3A.
Data that client organisations enter into their projects (for example role plans, costs, or information about job candidates) belongs to that organisation. We process it only on the organisation's instructions and under our agreement with it, as its Data Processor. The organisation is responsible for telling those people about it and for having a lawful basis to use it. Questions about such data should go to that organisation first; we will help it respond.
A candidate profile that a job seeker creates with us is different: for that, WebSols India decides what is collected and why, so we are its Data Fiduciary (section 3A).
3. What we collect and why
| Data | Why we use it | Kept for |
|---|---|---|
| Enquiries, including recruiters registering interest in Hire-o-meter: name, designation, organisation, work email, phone (if given), areas of interest or hiring volume, and your message | To reply to you, prepare a quote or approve evaluation access. Collected through the form on our website, with your consent. | 12 months |
| Account: work email, name, designation, mobile number, organisation and role | To let you sign in and to show you only your organisation's projects | While your organisation's access is active, then deleted within 90 days |
| Sign-in codes (stored only in scrambled form) and the email they were sent to | To confirm it is you signing in | Valid for minutes; deleted after 1 day |
Session cookie __Host-wsi (a random token), browser type and when it was last used | To keep you signed in, and to show you on your profile where you are signed in. It is essential, so it is set without a consent banner. | Until the browser closes, or 7 days if you tick "Keep me signed in"; always ends after 12 hours without use or when you sign out |
| Activity log: which account did which action (for example "project saved") and when | Security, investigating problems, and showing clients who changed what | 2 years |
| Network data: IP address, request time | To stop abuse (for example too many sign-in attempts) and to protect the service. Our database does not store it. | In memory for minutes; in rotating server logs for a few days |
| Sign-up and billing: organisation's legal name, GSTIN and address, billing email, and the name, designation and email of the person who accepts the Terms | To make the contract, issue GST tax invoices and keep the legal record of acceptance (with time and IP address) | 8 years after the end of the financial year, as GST and contract law require |
| Payment details | Handled by CCAvenue, Cashfree, PhonePe or Razorpay on their own secure pages. We pass on your mobile number, which the payment gateway requires. We receive only the payment reference and status, never card or bank details. | 8 years, with the invoice |
| Job descriptions you tailor your resume for (candidates): the job text you paste, the company and notes you add, and the scores worked out for it | To compare the job with your profile, show your Hire-o-meter and build a resume aimed at that job | Your newest 10 are kept; all are deleted with your profile |
| Your job applications tracker (candidates): job titles, companies, links, status, dates, next steps and notes you enter | To help you keep track of your applications and, if you leave reminders on, to email you on the follow-up dates you set | Until you remove them; all are deleted with your profile |
| Your networking log (candidates): names, companies, roles and LinkedIn links of people you choose to add, and your notes | A private list for you to keep track of people you contact. Only you can see it; we do not contact these people or use their details for anything else. Add only what they have made public or agreed to share. | Until you remove them; all are deleted with your profile |
| Interview practice (candidates): the answers you write, and for each practice the question, the time taken and the boxes you ticked. Video and audio recordings are never uploaded: they stay in your browser and are gone when you leave the page, unless you download them | To let you build and keep your interview answers and see your practice progress | Your newest 300 answers and 200 practice sessions; all are deleted with your profile |
| Company research notes (candidates): companies you research and your notes on them | For your own interview preparation; your "why I want to join" note is used in your cover letter for that company | Until you remove them; all are deleted with your profile |
| Your portfolio page (candidates, only if you publish it): your name, role, city, years of experience and the sections you choose to show (summary, results, experience, skills, education, certifications, projects, and optionally your photo and LinkedIn link). Your phone, email and Candidate ID are never shown. | To give you a public page to share with employers. It is off until you publish it, and hidden from search engines unless you allow them. You can hide it at any time. | Until you hide it or delete your profile |
| Messages sent to you through your portfolio page: the sender's name, email and message are emailed to you; we keep only the time and a one-way scrambled code of the sender's network address, to stop abuse. We count page views per day, without visitor details. | To let employers contact you without seeing your email address, and to show you how many people viewed your page | Message records: until you delete your profile. The message itself is not kept by us. |
| News emails: your email address, name (if given), when you agreed and when you confirmed | To send occasional news about WSI Analytics (new features, career tips and offers), only if you subscribed on our News page and clicked the confirmation link, or ticked "Send me news" as a candidate or client user. Every email has a one-click unsubscribe link. | Until you unsubscribe. After that we keep only your email address on a do-not-email list, so you are never emailed again. |
| Where you first came from: the campaign name and site in the link you first clicked to reach us (for example "linkedin", "career-ladder"), the page you landed on and the date | To learn which of our posts bring people to WSI Analytics. It is kept in your own browser for 30 days and reaches us only if you create a candidate profile or a client account in that time. Our short links (api.websolsindia.com/r/…) count clicks without recording who clicked. | With your profile or account |
| Project content entered by client users | To run the models for that organisation | As the client instructs; deleted within 90 days after the agreement ends |
Your browser also keeps some settings on your own device (such as the last project you opened). That data does not reach us, except the "where you first came from" record described above.
We do not sell personal data, show advertising, or use third-party analytics or tracking cookies.
3A. Candidates
If you create a candidate profile on our candidate page, this is how we use it. You agree to it by ticking the box when you create the profile (consent version candidate-1.0).
| Data | Why we use it | Kept for |
|---|---|---|
| Name, email, mobile number, city and state, current or wanted role, years of experience, profile summary, skills, certifications, job functions and industries, work history (job titles, employers, dates, what you did), education (qualifications, institutions, years, scores), LinkedIn address (if given), whether you are open to work | To give you a Candidate ID, let you sign in and keep your profile up to date, and, when job listings open, to send your profile to the employers you choose to apply to | Until you delete the profile, or 2 years after your last sign-in, whichever is first |
| Your profile photo, if you add one (optional) | To show on your profile and your visual resume, and to employers you apply to. We re-save it as a plain image, which removes location, camera and other hidden details. It never appears on the plain resume. | Until you remove it or delete the profile; stored encrypted in Amazon S3 in Mumbai; replaced or deleted copies are erased within 30 days |
| Your resume file (PDF or Word), if you upload one | To send with your applications to the employers you choose, and to help you improve it. Only you and WSI administrators can open it until you apply. It is stored encrypted in Amazon S3 in Mumbai, India. | Until you remove it or delete the profile, or 2 years after your last sign-in. A replaced or deleted file stays in our encrypted backup for up to 30 days, then is erased. |
| If someone invited you: who referred you (a candidate, or a client organisation and its staff member) | To credit the person who referred you and tell them, by first name only, that you joined. We share nothing else about you with them. | As long as the profile |
| Your Candidate ID, the date you agreed and the consent version | To show what you agreed to and when | As long as the profile, then 2 years in the activity log |
- Employers do not see your profile. It is shared with an employer only when you apply to that employer's job listing. Each application will say clearly what is shared.
- WSI administrators can see profiles to answer your questions and keep the service working. We do not sell profiles or share them with recruiters or other third parties.
- You can change or delete your profile at any time after you sign in. Deleting it removes the profile, your resume and your Candidate ID from our records at once; only the activity-log line that a profile was deleted remains. If you are also a client user, your client account is not affected.
- Referral invites. A candidate or a client user can ask us to email someone an invitation to create a profile. We then hold that person's name, email and the referrer's short note only to send that one invite and credit the referrer. If the person does not join, we delete these details within 90 days. Anyone can stop all future invites with the link in the email; we then keep only a scrambled marker of the email address so we never write again. We do not let anyone upload another person's resume.
- Premium payments. If you buy Premium, we keep the payment and the tax invoice (your name, Candidate ID, city and state, the amount and the payment reference) for 8 years, because tax law requires it. This applies even if you delete your profile; the invoice is then kept only for tax records. A copy of each invoice is stored encrypted in Amazon S3 in Mumbai. Payments are handled by the payment gateways named in section 5; we never see your card or UPI details.
- Referral rewards. When a friend you referred completes their profile, we record that date to work out your Premium months. We tell you that they completed it, by first name only.
- Profiles are for adults. Do not create one if you are under 18.
4. Our basis for using it
We use client users' data because you, or your organisation on your behalf, asked us to give you access to the service (a legitimate use and your consent under the DPDP Act). Where we rely on consent, you can withdraw it at any time by writing to us (section 9). We will then close your access and delete the data, except what we must keep by law. Withdrawing consent does not affect what was done before.
5. Where it is stored and who helps us
The platform's database and servers run on Amazon Web Services in Mumbai, India, encrypted at rest and in transit. Our emails are sent from our own mailbox on our web hosting provider's mail server in the United States. These companies process data for us under their own data protection terms:
- Amazon Web Services (India): hosting, database, file storage (resumes) and backups.
- PDR Solutions, our web hosting provider (United States): runs the mail server for no-reply@websolsindia.com, which sends sign-in codes, acceptance records and invoices. It sees the email address and the content of those emails.
- CCAvenue (Avenues India), Cashfree, PhonePe and Razorpay (India): take payments for plans.
- Cloudflare: delivers the website and protects it from attacks. Your requests may pass through Cloudflare servers outside India.
- Google: the fonts on our pages (your browser fetches these from Google, which sees your IP address).
We share personal data with authorities only when Indian law requires it.
6. How we protect it
- Sign-in by one-time code: no passwords to steal. Codes and session tokens are stored only in scrambled (hashed) form.
- Each organisation's data is separated, and every request is checked against the signed-in user's organisation.
- Encrypted connections (HTTPS) end to end; the database is not reachable from the internet; daily backups.
- Administrator pages have a second, separate login.
If a breach affects your personal data, we will tell you and the Data Protection Board of India as the law requires.
7. Your rights
You can ask us to:
- give you a summary of the personal data we hold about you and how we use it;
- correct, complete or update it;
- erase it, when it is no longer needed or you withdraw consent;
- accept a nominee who can act for you if you die or cannot act yourself.
Write to the address in section 9. We may ask you to confirm your identity. We will reply within 30 days. If you are not satisfied with our reply, you can complain to the Data Protection Board of India.
8. Children
The service is for business users. It is not meant for anyone under 18, and we do not knowingly collect their data.
9. Contact and grievance officer
10. Changes to this notice
We will update this page when our practices change, with a new version number and date at the top. If a change affects how we use your existing data, we will tell signed-in users before it takes effect.