Draft pending legal review. Highlighted text is a placeholder to be completed before launch.
Privacy Policy
Last updated October 5, 2026
Colrnx helps companies find engineers by looking at the work engineers have actually done. That means we handle personal data about candidates, and about the people at companies who use Colrnx. This policy explains what we collect, why, who sees it, how long we keep it, and what you can do about it. It applies to colrnx.com and the Colrnx app, and is written for people in India and the United States.
1. Who we are
Colrnx is operated by [legal entity name and registered address]. For the purposes of India's Digital Personal Data Protection Act, 2023 (DPDP Act), we are the Data Fiduciary for the personal data of candidates and company users described here. Where a company uses Colrnx to evaluate candidates it brings itself, we also act on that company's behalf, as set out in our Data Processing Agreement.
2. What we collect
If you are a candidate
- Account details: your name, email address, and a password (stored only as a one-way hash), or the basic profile Google or GitHub shares when you sign in with them, including your profile photo.
- Profile details you give us: current role, years of experience, work history, location, availability, preferred domains, and skills you list yourself.
- Public GitHub activity: once you connect GitHub, we read your public repositories, the commits you authored, pull requests merged into other projects, and README files. We do not access private repositories.
- What you tell our assistant: your conversations in the Colrnx chat (for example, the “Your story” interview), and any files you attach to it.
- References: the name, email address and relationship of up to three people you name as references. Only share someone's details if they have agreed to it. Colrnx never contacts your references.
- Activity on Colrnx: jobs you apply to, project submissions, interview bookings, and anything you post or comment on the Colrnx feed.
If you use Colrnx for a company
- Your name, work email, and password or sign-in provider details.
- Company details, job postings, project briefs, and your conversations with the Colrnx assistant.
- Notes, stage changes and interview scheduling for the candidates in your pipeline.
People who haven't signed up
- A company can add an engineer to its shortlist by GitHub username. We then analyse that person's public GitHub activity for that company only. The company must have a lawful reason to evaluate them (see our Terms).
- Anyone can look up the public score card for a GitHub username. We keep that result for up to 30 days so repeat lookups are fast.
Technical data: your IP address when you accept these terms or use rate-limited features, and basic server logs. We store your sign-in token in your browser's local storage. We do not use advertising or analytics cookies.
3. Why we use it
- To run your account and let you sign in.
- To score candidates' public engineering work, match candidates to roles, and show companies the results. How scoring works explains this in detail.
- To send verification codes, interview confirmations and other messages about your account.
- To keep Colrnx safe: preventing abuse, moderating the feed, and investigating problems.
- To meet legal obligations.
We process your data on the basis of the consent you give when you create an account, and, where the law allows, for legitimate uses such as security and complying with the law. You can withdraw consent at any time (see section 7); withdrawing doesn't affect processing that already happened.
We do not sell your personal data, share it for targeted advertising, or use it to train AI models.
4. AI and automated assessment
Colrnx uses software, including AI models, to assess candidates. Most of the Profile Score is calculated by fixed formulas over public GitHub data; one part, and the written explanations companies read, are produced by an AI model. The overall recommendation a company sees is decided by fixed rules, not by the AI model.
These assessments help companies decide whom to interview. They are not hiring decisions. A person at the company makes every decision about you. If you think an assessment of you is wrong, you can ask us to review it (see section 7).
5. Who sees your data
- Companies. When you apply to a job, or a company finds you as a match, that company sees your profile, scores, the story you shared, and your references (labelled as provided by you and not verified). Your public profile page is visible to anyone with the link.
- Service providers who run parts of Colrnx for us, listed below. They may only use your data to provide their service to us.
- Authorities, when the law requires it, or to protect the rights and safety of people on Colrnx.
- A buyer or successor, if Colrnx is merged or sold, under the same protections as this policy.
| Provider | What it does for us | Where |
|---|---|---|
| Microsoft Azure | Hosting, database, file storage, and AI models (Azure AI Foundry) | United States (Central US) |
| GitHub | Sign-in, and the public repository data we analyse | United States |
| Sign-in with Google | United States | |
| Resend | Transactional email (verification codes, notifications) | United States |
| Slack | Internal operational alerts to the Colrnx team | United States |
6. Where your data is stored, and for how long
Our servers are in Microsoft Azure's Central US region. If you are in India, your data is transferred to and stored in the United States, which the DPDP Act permits.
| Data | How long we keep it |
|---|---|
| Your account and profile | Until you delete your account |
| Public score card lookups | 30 days |
| Profiles of engineers a company added by GitHub username who never joined | 180 days after they were last in a company's pipeline |
| Email verification codes | 1 day |
| System logs (AI usage and email delivery) | 12 months |
| Read notifications | 6 months |
When you delete your account we delete your personal data, except where the law requires us to keep a record. Backups are overwritten on a rolling schedule of [backup retention period].
7. Your rights
Depending on where you live, you can:
- get a copy of the personal data we hold about you;
- correct data that is wrong or incomplete;
- delete your account and personal data;
- withdraw your consent;
- ask a person to review an automated assessment of you;
- in India, nominate someone to exercise these rights for you if you die or become unable to, and raise a grievance with us and then with the Data Protection Board of India.
You can do most of this from your account settings. Otherwise, email [privacy contact email]. We reply within 30 days. We won't treat you differently for using any of these rights.
If you never signed up and want your GitHub data removed from Colrnx, email the same address and we will verify that the GitHub account is yours and remove it.
8. Security
Data is encrypted in transit and at rest. Access by Colrnx staff is limited to what their role needs, and administrative actions are logged. Our logs of AI usage record only metadata such as timing and cost, never the text sent to the model. No system is perfectly secure; if a breach affects your data, we will tell you and the relevant authorities as the law requires.
9. Children
Colrnx is for people aged 18 and over. We don't knowingly collect data from anyone younger. If you believe a child has given us their data, contact us and we will delete it.
10. Changes to this policy
If we change this policy in a way that matters, we'll update the date above and ask you to review and accept the new version the next time you use Colrnx.
11. Contact and grievance officer
Questions, requests or complaints: [privacy contact email].
Grievance Officer (India): [name, email and postal address].