Draft pending legal review. Highlighted text is a placeholder to be completed before launch.
Data Processing Agreement
Last updated October 5, 2026
This agreement applies between a company using Colrnx (“you”) and [legal entity name] (“Colrnx”) whenever Colrnx processes personal data on your behalf. It forms part of the Terms of Service. If you need a signed copy for your records, contact [contact email].
1. Roles
For candidates you bring to Colrnx yourself (for example, by adding GitHub usernames to a shortlist), and for your use of candidate data inside your pipeline, you decide why the data is processed and Colrnx processes it for you (you are the Data Fiduciary and Colrnx the Data Processor under India's DPDP Act, and Colrnx is your service provider under US state privacy laws). For candidates who signed up to Colrnx themselves, Colrnx is responsible for their data under its own Privacy Policy.
2. What we process
- Data: candidates' names, GitHub usernames and public GitHub activity, and the notes, stages and interview details you record.
- Purpose: scoring and matching candidates for your open roles, and running your hiring pipeline in Colrnx.
- Duration: while you use Colrnx, then as described in section 6.
3. Your responsibilities
- You have a lawful reason to evaluate each person you add, and give them any notice the law requires.
- You comply with employment laws that apply to you, including laws on automated hiring tools. A person at your company makes each hiring decision.
- Your instructions to us are lawful. Using Colrnx as designed is your instruction to us.
4. Our commitments
- We process the data only to provide Colrnx to you, or where the law requires.
- We don't sell the data, or use it to train AI models.
- Everyone at Colrnx with access to it is bound by confidentiality.
- We protect it with appropriate security measures, including encryption in transit and at rest, and access logging.
- We tell you without undue delay, and within 72 hours, after we become aware of a breach affecting it, and help you meet any notification duties.
- We help you respond when a candidate exercises their rights over data we process for you.
- We give you the information you reasonably need to show compliance with this agreement.
5. Sub-processors
You authorise us to use the sub-processors below. We hold each to data protection terms at least as protective as these, and remain responsible for them. We'll give you at least 30 days' notice of a new sub-processor; if you object on reasonable grounds and we can't resolve it, you may stop using Colrnx.
| Provider | What it does for us | Where |
|---|---|---|
| Microsoft Azure | Hosting, database, file storage, and AI models (Azure AI Foundry) | United States (Central US) |
| GitHub | Sign-in, and the public repository data we analyse | United States |
| Sign-in with Google | United States | |
| Resend | Transactional email (verification codes, notifications) | United States |
| Slack | Internal operational alerts to the Colrnx team | United States |
6. When the relationship ends
When you close your company account, we delete the personal data we process for you within 30 days, unless the law requires us to keep it. Profiles of engineers you added who never joined Colrnx are also deleted automatically 180 days after they were last in a pipeline.
7. International transfers
Data is stored in the United States (Microsoft Azure, Central US). Transfers from India are made as permitted by the DPDP Act and any restrictions the Government of India notifies.