Privacy Policy

Overview

Zivaro Software, Inc., doing business as Tukadi ("Tukadi", "we", "us", "our"), a Delaware C Corporation, operates an AI-powered talent acquisition platform. This Privacy Policy explains how we collect, use, store, and protect personal data when you use our services — whether as a recruiter, candidate, or visitor.

By using Tukadi, you agree to the practices described below.

This policy applies to users worldwide, including specific disclosures for residents of the United States (including California, Illinois, Colorado, and other states with privacy legislation) and the European Union.

Information we collect

Account information

• Name, email address, and company name when you sign up
• Profile details you provide (phone, location, LinkedIn, GitHub, portfolio links)
• Organization and role information for recruiter accounts

Candidate data

• Resumes and documents you upload
• Work experience, education, and skills you enter or that we extract from your resume using AI
• Job preferences, salary expectations, and availability

Interview data

• Audio recordings of AI voice interviews
• Transcripts generated from interview recordings
• AI-generated evaluation scores, feedback, and skill assessments
• Interview metadata (duration, timestamps, completion status)

Application data

• Job applications and their status history
• Eligibility screening results
• Recruiter notes and decisions

Usage data

• Pages visited, features used, and session duration
• Device type, browser, operating system, and IP address
• Referral source and geographic region (inferred from timezone)

How we use your data

• Deliver the service — run AI screenings, conduct voice interviews, generate evaluations, and manage the hiring pipeline
• Improve AI quality — analyze aggregate patterns to improve interview conduct, scoring accuracy, and screening relevance
• Communicate — send interview invitations, reminders, status updates, and respond to support requests
• Security — detect abuse, prevent fraud, and maintain platform integrity
• Analytics — understand product usage to improve the experience

We do not sell your personal data, and we do not "share" it for cross-context behavioral advertising as those terms are defined under California law. On our public marketing website we use PostHog for analytics only, and you can opt out at any time (see the Cookies and Your privacy choices sections below).

AI processing and automated decision-making

Tukadi uses AI models to:

• Extract structured data from resumes (name, skills, experience)
• Evaluate candidate eligibility against job criteria
• Conduct voice interviews via our AI interview agent
• Generate interview scores and feedback

Automated decision-making disclosure

Tukadi employs automated employment decision tools (AEDTs) as part of its hiring workflow. These tools assist with:

1. Resume screening — AI analyzes resume text to extract skills, experience, and qualifications
2. Eligibility evaluation — AI compares candidate qualifications against job requirements
3. Interview scoring — AI generates scores based on interview responses

Important: AI-generated outputs (scores, evaluations, summaries) are recommendations only — final hiring decisions are always made by human recruiters. AI-eligible candidates may be automatically invited to interview when enabled by the hiring organization, while AI ineligible or uncertain outcomes are routed for recruiter review before a final adverse eligibility decision.

Your rights regarding automated processing

You have the right to:

• Request information about how AI is used in evaluating your application
• Request human review of any AI-generated evaluation
• Appeal hiring decisions that relied on automated processing
• Request that your application be evaluated without AI assistance (where feasible)

To exercise these rights, contact us at ashish.so@tukadi.com. For more information about our AI practices, see our AI Disclosure page.

Candidate sourcing

Some organizations use our candidate sourcing feature (currently an experimental alpha) to discover people who may fit an open role. When a recruiter runs sourcing for a job, we search publicly available professional data — such as professional profiles and public web pages — through a third-party search provider (Exa) and surface matching profiles to that recruiter.

This processing is deliberately narrow:

• We send the provider only job-related search terms derived from the job's title and criteria. We do not send resumes, interview data, or any candidate-uploaded data to the sourcing provider.
• We surface profiles; we do not score, rank, or decide. Sourced profiles are presented to the recruiter in no particular order, with factual notes about which job criteria they appear to meet. There is no score, ranking, or automated decision at this stage, and no one is automatically rejected, advanced, or contacted.
• The recruiter decides and reaches out directly. Any outreach (for example, an email a recruiter chooses to send) comes from the recruiter, not from Tukadi. We do not send messages on a recruiter's behalf.
• If a sourced person applies, they go through the normal application process, and the disclosures in this policy and our AI Disclosure apply to them as a candidate.
• Short retention. Sourced profiles are automatically deleted 30 days after they are surfaced. If a person never applies, their information does not persist beyond that window.

If you believe your information may have been surfaced through candidate sourcing and you want it removed, email ashish.so@tukadi.com and we will delete it (see Your rights below).

Data sharing

We share data only with service providers necessary to operate the platform:

Provider	Purpose	Data shared
Amazon Web Services (AWS)	Hosting, storage, database, and transactional email (ECS, S3, RDS, SES)	Resumes, recordings, email addresses, request logs, IP addresses, encrypted data at rest
ElevenLabs	AI voice interviews	Interview audio, candidate name, job context
Google AI (Gemini)	Resume extraction, eligibility screening	Resume text, job descriptions
Exa (Exa Labs, Inc.)	Candidate sourcing — searching publicly available professional data (recruiter-initiated, alpha)	Job-related search terms only (no candidate-uploaded data)

We do not share candidate data between organizations. Each organization's data is isolated.

Analytics provider (public website only)

On our public marketing website, we use a single analytics provider. It runs only on our public marketing pages — it is not active in the signed-in application, candidate, or interview areas, where no such tracking occurs:

Provider	Purpose	Data shared
PostHog	Product analytics and session replay of page visits	Page views, interactions, session recordings (text inputs masked), device, IP address

Data retention

• Active accounts — data retained while your account is active
• Interview recordings — retained for 12 months after the interview, then deleted
• Deleted accounts — personal data is removed within 30 days of account deletion. Anonymized aggregate data may be retained
• Application data — retained for the duration of the hiring process plus 12 months
• Sourced candidate suggestions — automatically deleted 30 days after they are surfaced to a recruiter

Data security

• All data is encrypted in transit (TLS) and at rest (AES-256)
• Database access is restricted to application servers via private networking
• File storage uses private S3 buckets with presigned, time-limited access URLs
• Authentication uses secure session tokens with HTTP-only cookies
• We conduct regular security reviews of our infrastructure

Your rights

You have the right to:

• Access — request a copy of your personal data
• Correction — update or correct inaccurate data
• Deletion — request deletion of your account and associated data
• Export — receive your data in a portable format (data portability)
• Objection — object to specific processing activities
• Human review — request human review of automated decisions affecting you

To exercise any of these rights, contact us at ashish.so@tukadi.com.

We will respond to requests within 30 days (or 45 days for California residents as required by CCPA/CPRA).

California residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know — request information about categories of personal information collected, the purposes for collection, and categories of third parties with whom we share your data
• Right to Delete — request deletion of personal information we have collected
• Right to Correct — request correction of inaccurate personal information
• Right to Opt-Out of Automated Decision-Making — request that we not use automated decision-making technology in evaluating your candidacy
• Right to Opt-Out of Analytics — opt out of the analytics cookies on our public marketing website
• Right to Non-Discrimination — we will not discriminate against you for exercising your privacy rights

We do not "sell" your personal information for monetary consideration, and we do not "share" it for cross-context behavioral advertising as defined under CPRA — we run no advertising trackers. Our public marketing website uses PostHog analytics cookies only, and never in the signed-in application, candidate, or interview areas. You can opt out of marketing-site analytics at any time using the "Your Privacy Choices" link in our website footer, or by enabling Global Privacy Control (GPC) in your browser, which we honor as a valid opt-out request.

To submit a verifiable request, email ashish.so@tukadi.com with "CCPA Request" in the subject line.

Illinois residents (AIVFA)

If you are an Illinois resident applying for a job that uses our AI video interview service:

• You will receive notice at least 5 business days before your interview that AI will be used
• You must provide explicit consent before AI analyzes your video interview
• You may request deletion of your interview recording at any time (we will delete within 30 days)
• You have the right to request human review of AI-generated evaluations

Colorado residents (Colorado AI Act)

If you are a Colorado resident, you have the right to:

• Receive notice when AI is used in employment decisions affecting you
• Appeal decisions made with the assistance of AI
• Request information about how the AI system works

Other US states

Residents of Virginia, Connecticut, Utah, and other states with comprehensive privacy laws have similar rights. Contact us to exercise your rights under applicable state law.

Cookies

We use essential cookies for authentication and session management across the platform. These are always active and cannot be disabled.

On our public marketing website only — never in the signed-in application, candidate, or interview areas — we also use analytics cookies from the provider listed in the "Analytics provider" section above:

• Analytics (PostHog) — measure traffic, understand how visitors use the site, and record marketing-page sessions with text inputs masked.

We do not use any advertising cookies. You can opt out of analytics cookies at any time — see Your privacy choices below.

Your privacy choices

To opt out of analytics cookies, use the "Your Privacy Choices" link in our website footer. We also honor the Global Privacy Control (GPC) signal: if your browser sends a GPC signal, we treat it as a valid opt-out and do not start analytics tracking on your visit.

These choices apply to our public marketing website. The signed-in application and candidate interview areas do not use analytics or advertising trackers at all.

Children

Tukadi is not intended for use by anyone under 18. We do not knowingly collect data from minors.

Changes to this policy

We may update this policy from time to time. We will notify registered users of material changes via email. Continued use of the service after changes constitutes acceptance.

Contact

For privacy inquiries or data requests:

Email: ashish.so@tukadi.com

For US-specific privacy requests, please include "US Privacy Request" in your subject line.

Zivaro Software, Inc. A Delaware C Corporation