Privacy Policy

1.Who we are

Caddie is operated by OutsideIn Private Limited, a company incorporated in India with its registered office in Hyderabad, Telangana. In the language of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), OutsideIn Private Limited is the Data Fiduciary for the personal data described here, and you are the Data Principal.

This policy covers the Caddie web application at caddiehq.in and the Caddie browser extension. It does not cover the websites of employers or applicant tracking systems you visit, which have their own policies and are outside our control.

2.What we collect

Everything below is given to us by you, or generated by your use of the product. We do not buy personal data about you from anyone.

What you give us

• Account details — your email address and authentication credentials. If you sign in with Google or LinkedIn, we receive your name, email address and profile identifier from that provider, and nothing else.
• Your CV or résumé, and everything parsed from it — employment history, education, titles, dates, achievements.
• Your saved application details — the answers you save to reuse across applications, which may include your address, phone number, notice period, right-to-work details and pay history.
• Your job preferences — the seniority, area of work, locations, pay and non-negotiables you are searching against.

What the product generates

• Evaluations — scores and reasoning produced when a role is measured against your spec.
• Application records — which roles you prepared, what was filled, what was left blank, and what you chose to do next.
• Generated drafts — CV variants and letters produced from facts already in your profile.

Technical data

• Log and security data: IP address, browser and device type, timestamps, and error diagnostics, used to keep the service running and to investigate abuse.

3.Why we process it

Each purpose is stated separately, because under the DPDP Act consent has to be specific rather than bundled.

4.Consent, and how to withdraw it

Where we rely on consent, that consent is yours to withdraw at any time, and withdrawing it must be as easy as giving it was. You can withdraw by writing to hello@caddiehq.in. You can also delete your account from Settings.

Withdrawal is not retrospective — it does not undo processing that already lawfully happened, and it does not reach an application you have already sent to an employer, which is between you and them. It does stop the processing going forward, and where we have no other basis to keep the data, we delete it.

5.Who your data reaches

We do not sell your personal data. We have no advertising business, and we do not share your data for anyone else’s marketing.

Your personal data goes outside OutsideIn Private Limited in exactly four situations:

1. When you send an application. You press Submit on the employer’s own form, and what you filled in goes to that employer. Caddie never submits on your behalf.
2. To service providers who run infrastructure for us under contract, listed in section 7.
3. To the OutsideIn group, on the terms in section 6 — and, for the search desk, only with a separate opt-in; search-desk sharing is not currently available.
4. Where the law requires it — a valid order of a court or an authority with jurisdiction. We will tell you unless we are prohibited from doing so.

6.The OutsideIn group

OutsideIn Private Limited operates more than one product. Alongside Caddie there are TigerHire, HolaHumans and eSigned / SignTiger, and OutsideIn also runs an executive search practice.

We want to be exact about this, because the loose version — “your data stays within our group of companies” — sounds reassuring and is not a promise of privacy. Group companies are separate legal entities. Under the DPDP Act they are third parties, not extensions of us. Being related to us does not by itself entitle them to your data.

So the position is:

• Your Caddie data is used to run Caddie. That is its default and only purpose.
• Shared services. Some infrastructure is common across the group — hosting, authentication, billing, support tooling. Group entities providing those act as processors on our instructions and may not use your data for their own purposes.
• The search desk is opt-in. Your candidate profile is made visible to OutsideIn’s recruiters, or to TigerHire, only with separate opt-in consent. This sharing feature is not currently available, and your profile is not sent to the search desk.
• No onward sale. No group entity may sell your data or pass it to a further third party for their own purposes.

7.Service providers

We use a small number of providers to run the service. Each is engaged under contract, may process your data only on our instructions, and may not use it for their own purposes. We remain responsible to you for what they do.

This list is kept current. If we add a provider that processes personal data, we update this page.

8.Company and market data

Caddie also holds information about companies — funding, headcount, sector, job postings, hiring signals. This is business information, not personal data about you, and it is a shared resource rather than something attached to your account.

Every fact of this kind carries a record of where it came from:

• Public — funding announcements, company websites, published job postings.
• Licensed — obtained from a data provider under terms.
• Derived — computed by us from the above.
• Confidential — told to us in confidence during search work. This never appears on a product surface, to any user, including the user it relates to.

We do not scrape LinkedIn, and we do not build profiles of individuals from their LinkedIn activity.

9.Your search is confidential

Senior candidates search while employed. The product is built around that, and these are commitments, not aspirations:

• We never contact your current employer — not for references, not to verify employment, not for any reason.
• We answer “may we contact your current employer?” as No on every form, every time.
• We never publish or list you anywhere a search is visible, absent the opt-in in section 6.
• Reference lists exclude current-employer contacts.

10.Where AI is involved

Some features use AI models to read a job description or draft text. Where that happens, the model receives what is needed for that task and the output is shown to you as a draft until you accept it.

We do not permit your personal data to be used to train third-party models.

One rule governs everything generated: we do not invent facts about you. A CV, letter or form answer is assembled from what is already in your profile. Where a stronger claim would need a number we do not hold, the product asks you for it rather than producing a plausible one.

11.How long we keep it

• While your account is open — we keep your profile, saved application details and application history, because that is the product.
• When you delete your account — personal data is deleted within 30 days, except where law requires us to retain it.
• Financial records — invoices and tax records are retained for the period Indian law requires.
• Security logs — retained for a limited period and then deleted.

12.Security

Data is encrypted in transit and at rest. Access is scoped to your account: every request is filtered by the identity in your session token, never by a value a client can set. Internal access to production data is limited and logged.

If a breach affects your personal data, we will notify you and the Data Protection Board of India as the DPDP Act requires.

No system is perfectly secure, and we will not claim otherwise. Use a strong, unique password, and tell us at hello@caddiehq.in if you think your account has been accessed by someone else.

13.Your rights

Under the DPDP Act you have the right to:

• Access a summary of the personal data we hold about you and how it is being processed.
• Correct data that is inaccurate, and complete data that is incomplete.
• Erase data where the purpose it was collected for is served or you withdraw consent.
• Withdraw consent at any time.
• Nominate another person to exercise these rights if you die or become incapacitated.
• Have a grievance heard — section 14.

You can correct your saved details in Resume and delete your account from Settings. For access requests, consent withdrawal, nomination, or other help, write to hello@caddiehq.in and we will respond within the period the DPDP Rules require.

14.Grievances

If something about how we handle your data is wrong, tell us first — we would rather fix it than have you escalate.

If you are not satisfied with our answer, you may complain to the Data Protection Board of India. Using us first does not take that right away.

15.Children

Caddie is for working professionals and is not for anyone under 18. We do not knowingly collect data from children. If we learn that we have, we delete it. If you believe a child has created an account, write to hello@caddiehq.in.

16.Where data is stored

Data is hosted with the providers in section 7, whose infrastructure may be located outside India. Where personal data is transferred outside India, we do so consistently with the DPDP Act and any restrictions the Central Government notifies, and under contracts requiring protection equivalent to this policy.

17.Changes

We update this policy when the product changes. The date at the top always says when. If a change materially affects how we use your data, we will tell you directly rather than relying on you to notice — and where the change needs your consent, we will ask for it.

18.Contact

Privacy questions: hello@caddiehq.in. Anything else: about the company.

OutsideIn Private Limited, Hyderabad, Telangana, India.