Privacy policy — Team Paracitamol

Team Paracitamol (MMD Hiring Solution) (“we”, “us”) respects your privacy. This policy explains what information we collect on this website, in our client portal and in our CRM, why we collect it, who we share it with, how we keep it safe, and the choices and rights you have, including under the California Consumer Privacy Act as amended by the CPRA (“CCPA”) and India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”).

1. We do not sell your personal information

We have not sold personal information in the past 12 months and we do not sell it. We only “share” information for cross-context advertising (as the CCPA defines it) if you switch on Advertising in Your privacy choices. It is off until you choose, and we automatically respect a Global Privacy Control (GPC) signal from your browser as an opt-out.

2. What we collect, and where it comes from

When	What we collect	Why we use it
You send an enquiry (contact or service forms)	Name, phone number, email, organisation, the service you are interested in, budget range, your message; the page you sent it from, the site that referred you, campaign tags in the link (UTM), and your IP address	To reply to you, prepare a proposal, follow up, and protect the form from spam
You comment on the blog	Name, email (not published), your comment, IP address	To publish and moderate comments and prevent abuse
You become a client and use the portal	Your name, email, phone, job title; company name, billing address and GSTIN; your password (stored only as a one-way hash); messages, voice notes, photos and files you share; support tickets; project comments; signed documents	To deliver and manage your projects, communicate with you, invoice you and meet tax obligations
Video calls and meetings	Meeting times, the invitation, and call audio/video while the call is running (handled by Zoom; we do not record calls)	To meet with you online
Payments	Amount, date, invoice and a payment reference. Card and bank details are entered directly with the payment provider (e.g. Razorpay, Stripe or PayPal) and never reach our servers	To record payments and send receipts
Signing in with Google or Facebook	Your name, email and account ID from that service	To create and secure your account
Browsing this website	Necessary cookies (session, security token, your privacy choices); anonymous daily page-view counts that contain no personal data; and, only if you allow them, analytics, advertising and session-replay cookies (see section 5)	To run the site securely, and with your permission to improve it and measure our ads

We do not ask for, and ask you not to send us, sensitive information such as health records, government ID numbers or financial account credentials. We do not knowingly collect information from children under 16; this site is meant for businesses.

3. How we use information

Respond to enquiries, give quotes and provide the services you buy.
Run your client account: projects, messages, calls, files, support and invoices.
Keep accounts and systems secure, prevent fraud and spam, and fix problems.
Meet legal duties, such as keeping invoices and tax records.
With your permission only: understand how the site is used and measure advertising.

We do not use your information for automated decisions that have legal or similarly significant effects on you.

4. Who we share it with

Only with service providers who process it for us under contract and may not use it for their own purposes, and when the law requires it:

Our website hosting and email delivery providers.
Google Analytics / Tag Manager — Analytics (only if you allow it).
Google reCAPTCHA — Bot protection on sign-in and password reset.
Zoom — Video calls and meetings with clients.
Anthropic (Claude) — AI assistant our team uses for summaries and drafts inside our CRM.
Payment providers, when you pay an invoice online.
Professional advisers (e.g. our chartered accountant) and authorities, when the law requires it.

When our team uses the AI assistant, the relevant CRM details (for example an enquiry or project status) are sent to Anthropic to produce a summary or draft. Anthropic processes this data for us under its commercial terms, which do not allow it to train its models on that data. Our team checks AI-written text before using it.

5. Cookies and your privacy choices

When you first visit, nothing optional loads until you choose. Accept all and Reject all are equally easy, and you can pick categories one by one. You can change your mind any time with the Your privacy choices link at the bottom of every page. Your choice is kept in your browser for 30 days; after that we ask again, once.

Necessary (always on): sign-in session, security (CSRF) token and your privacy choices.
Partner referral (only when you arrive through a partner’s link): a first-party cookie holding the partner’s referral code for 60 days, so the partner who introduced you is credited if you get in touch. It holds no personal data and is never shared.
Client portal security log (signed-in users only): changes you make and your sign-ins are recorded with the date, your IP address and browser, so we can investigate misuse. Kept for 365 days.
Push notifications (off until you turn them on in your profile): your browser gives us an address to send notifications to. Turn them off there at any time.
Analytics (off until you allow it): anonymous statistics about visits.
Advertising (off until you allow it; kept off if your browser sends GPC): measuring our ads on Google, Meta, LinkedIn and TikTok.

6. How we keep your information safe

Encryption in transit: the site and portal are served over HTTPS (TLS), and browsers are told to always use a secure connection (HSTS).
Passwords are stored only as salted one-way hashes (bcrypt). Nobody, including our team, can read them.
Encryption at rest for secrets: API keys, payment-gateway and email credentials are encrypted with AES-256 before they are stored.
Sessions and cookies are encrypted, marked HttpOnly and SameSite, and sign-in can be protected with a CAPTCHA.
Password resets use a one-time 6-digit code sent to your email that expires after 10 minutes and allows only five tries.
Access control: staff see only what their role needs. Client chats are visible only to the client, their account manager, that manager’s team lead and our administrators.
Files and chat attachments are kept in private storage and are only served after checking who is asking.
Abuse protection: forms, sign-in and password reset are rate-limited, and every form is protected against cross-site request forgery.
Activity is logged, and data is backed up regularly.

No system is perfectly secure, but if a breach affecting your information ever happens we will tell you and the authorities as the law requires.

7. Job applicants and candidates

When you apply for a job on our Careers page we collect what you give us: your name, email, phone, city, LinkedIn profile link, expected salary, notice period, cover note and your CV or the resume you build with our resume builder. If you choose Apply / sign in with LinkedIn, LinkedIn shares only your name, email address and profile photo (OpenID Connect), and only after you agree on LinkedIn’s screen; we never post to LinkedIn or read your connections.

Why: to assess your application, contact you, schedule and run interviews (online interviews use Zoom), and consider you for future roles.
Who sees it: our recruiters and the interviewers for the role. We do not sell or share it for advertising.
Candidate portal: if we schedule an interview, we email you a temporary login so you can follow your application, see interview details and message our recruiters. It ends when the process is closed.
How long: we keep your profile in our candidate database for up to 24 months after your last application so we can contact you about other roles. Ask us at any time to delete it, or to stop contacting you.
Saved jobs and resume drafts are stored only in your browser (local storage) until you submit an application.

8. How long we keep it

Enquiries that do not become clients: up to 24 months after our last contact, then deleted.
Client account and project data: while you are a client and afterwards for as long as needed to support you, unless you delete your account or ask us to delete it.
Invoices, payments and tax records: as long as Indian tax law requires (at least six years under GST rules).
When you delete your portal account, your login is removed and your personal details are erased. Only invoices and tax records we are legally required to keep are retained.

9. Your rights

Depending on where you live, you can:

Know and access the personal information we hold about you, and how we use and share it.
Correct inaccurate information. Clients can do this themselves under My profile.
Delete your information. Clients with no project in progress and nothing outstanding can delete their account themselves under My profile → Delete account. Anyone else can email us.
Opt out of sale or sharing for advertising: use Your privacy choices or turn on GPC in your browser.
Limit the use of sensitive personal information: we do not use sensitive personal information to infer characteristics about you.
Not be discriminated against for using any of these rights. We never charge more or offer a worse service because you used them.
Under the DPDP Act: withdraw consent, have grievances addressed, and nominate someone to exercise your rights.

To make a request, email info@paracitamol.com. You do not need an account. We will confirm we received it within 10 days and respond within 45 days (the CCPA limit). To protect you, we may ask you to confirm details we already hold. You may use an authorised agent, with your signed permission.

10. Contact and grievances

Team Paracitamol, Plot N. 594 Kapsarh , Meerut , Uttar Pradesh , India ,250223. Email: info@paracitamol.com · Phone: +917599880079,+916399193319. This address is also our point of contact for grievances under the DPDP Act.

11. Changes to this policy

If we change this policy, we will update the date at the top of this page. If a change is significant, we will tell clients through the portal or by email.