Privacy Policy

1. Who we are and which role we play

ThetaLogics LLP ("ThetaLogics", "we") runs thetalogics.com and the products ARIA, ThetaHRMS, and ThetaDash.

For data about website visitors, people who contact us, and the account and billing details of our customers, we decide why and how the data is used. In Indian law that makes us the Data Fiduciary, and in EU law the controller.

For the content our customers put into the products, such as resumes, candidate records, employee and payroll records, and uploaded datasets, the customer decides why and how it is used. The customer is the Data Fiduciary or controller, and we act on its instructions as a Data Processor. If your employer or a recruiter uses one of our products and you have a question about your data, please contact that organization first. We will support it in answering you.

2. What we collect

• From this website: the details you choose to send us through the contact form, such as your name, work email, company, and message. Our hosting provider records standard server logs, including IP address and browser type. We use Plausible Analytics, a privacy-first tool that counts page views without cookies and without collecting personal data or cross-site identifiers.
• From product accounts: name, email address, organization, role, sign-in and security logs (including IP address and browser), and plan and usage information.
• For paid plans: billing contact details and tax identifiers such as GSTIN or VAT ID. Card and bank details are handled by our payment processors. We do not store card numbers.
• Customer content: whatever a customer uploads or creates in a product. This can include personal data about candidates and employees, and in ThetaHRMS it can include salary, bank, and government identifier details needed for payroll.

3. Why we use it, and on what legal basis

• To provide the products, sign users in, and give support: performance of our contract with the customer.
• To reply to enquiries and demo requests: your request, and our legitimate interest in answering it.
• To keep the products secure, prevent abuse, and keep audit logs: our legitimate interests, and legal obligations where they apply.
• To bill paid plans and keep tax and accounting records: legal obligation.
• To process customer content: only on the customer's instructions.

Where Indian law requires consent, we rely on your consent or on a legitimate use the law allows. You can withdraw consent at any time. Withdrawing it does not affect processing that already took place.

We do not sell personal data.

4. How the AI features handle data

• ARIA sends the resume and job description content needed for a requested function to the AI provider configured for the workspace, after applying the redaction it supports. Scores are calculated by ARIA itself. The AI provider writes the narrative.
• ThetaDash sends column names, a sample of rows, and computed aggregates from the relevant dataset to its AI provider. The figures on a dashboard are calculated by ThetaDash itself. A workspace admin can switch off the use of external AI.
• ThetaHRMS uses AI to assist with tasks such as ranking and drafting. Its suggestions are advisory and a person approves anything that affects pay, compliance, or employment status.

We do not use customer content to train general-purpose AI models. Our products support decisions made by people. We do not make decisions about candidates or employees that have legal effect solely by automated means.

5. Who we share it with

We share personal data with service providers that help us run the website and products, such as hosting, email delivery, payment processing, error monitoring, and AI providers. They may use the data only to provide their service to us. The current list is on the Subprocessors page.

We may also disclose data when the law requires it, to protect our rights or the safety of others, or as part of a merger or sale of the business, in which case the recipient must honor this policy.

6. Transfers outside your country

Some of our service providers process data outside India and outside the European Economic Area, including in the United States. Where the law requires a safeguard for such a transfer, we rely on Standard Contractual Clauses or an equivalent mechanism, and we follow any restrictions the Government of India notifies under the DPDP Act.

7. How long we keep it

• Enquiries and demo requests: for as long as needed to answer you and keep a record of the conversation.
• Account data: for the life of the account, and afterwards only as long as the law or a legitimate business need requires.
• Customer content: until the customer deletes it or the agreement ends, then removed in line with the agreement. In ThetaDash, backups are overwritten within 14 days and security and audit logs are deleted after at most 2 years.
• Billing records: for as long as tax and accounting law requires.

8. How we protect it

We use access controls scoped to each customer workspace, role-based permissions, audit logging, encrypted connections, restricted administrative access, and operational monitoring. No system can be guaranteed secure. If we become aware of a personal data breach, we will notify affected customers and the authorities as the law requires.

We do not currently hold a SOC 2, ISO 27001, or similar certification. A security questionnaire is available on request.

9. Your rights

Depending on where you live, you can ask us to confirm what personal data we hold about you and give you a summary or copy, correct or update it, erase it, restrict or object to its use, move it to another provider, and withdraw consent. Under Indian law you can also nominate another person to exercise your rights if you die or lose capacity.

To make a request, email us at the address below. We may need to verify your identity. We aim to respond within 30 days. If your data sits inside a customer's workspace, we will pass your request to that customer and help it respond.

You can also complain to a regulator. In the EU that is your local data protection authority. In India you can approach the Data Protection Board of India after first using our grievance process.

10. Children

Our website and products are for businesses. They are not directed at anyone under 18, and we do not knowingly collect their personal data outside of records a customer lawfully keeps.

11. Changes to this policy

We will post any change on this page and update the date at the top. If a change materially affects how we use personal data, we will tell account holders by email or in the product before it takes effect.