Privacy Policy

Last updated: 3 October 2026

This policy explains how Candor ("we", "us") handles personal data when companies ("customers") use Candor to prepare performance feedback. It is written to align with India's Digital Personal Data Protection Act, 2023.

Our role

For employee data uploaded by a customer, the customer is the Data Fiduciary and Candor acts as a Data Processor, processing data only on the customer's instructions.

Data we process

Account data: name, work email and role of managers and HR administrators.
Employee data entered by customers: name, employee ID, designation, department, manager, performance figures, achievements, behaviour notes and feedback.
Acknowledgement data: name typed as signature, comments and time of acknowledgement.
Payment data: processed by Razorpay; we do not store card or bank details.

How we use it

Only to provide the service: generating feedback drafts, storing reviews, showing dashboards, sending shared links and processing subscriptions. We do not sell personal data or use customer data to train AI models. When a user chooses "AI polish", the selected section text is sent to our AI provider (Google Gemini) solely to return a rewritten version.

Access and security

Data is stored in a managed database in India (Mumbai region) with encryption in transit, and access rules that keep each company's data separate. Managers see only their team; HR administrators see their company; employees see only feedback shared with them through a private link.

Retention

Data is kept while the customer's account is active. Customers can delete records at any time; on account closure we delete customer data within 90 days unless law requires otherwise.

Your rights

Employees who wish to access, correct or erase their data should contact their employer (the Data Fiduciary). We will support customers in responding to such requests.

Contact

For privacy questions or grievances, contact the Grievance Officer at the email address shown on our website.