Privacy Policy

Padmi (“Padmi,” “we,” “us”) operates padmi.ai and the services provided there. Today that is two connected products: a platform where applicants build a profile, collect referrals, and apply to open roles; and Padmi Recruiter, an AI recruiting agent that helps companies source candidates, run outreach from their own email, and schedule conversations. By using Padmi, you agree to the practices described here.

From applicants. When you sign in with Google, we receive your name and email address. When you build your profile, we store what you choose to share: your full name, LinkedIn and GitHub URLs, a personal website and other links, a resume you upload, and your job preferences. You may also add the email addresses of people you’d like to ask for a referral.

From referrers. If you respond to a referral request, you verify your identity by signing in with LinkedIn. We receive your name, email address, and a LinkedIn identifier, and we store the ratings and short explanation you provide. Referrals stay anonymous on both ends: applicants never see who said what, and referrers never learn where the applicant applied.

From companies using Padmi Recruiter. We collect your workspace details (company name, team member names and emails), the role and candidate criteria you define, the sender identity you configure, and — if you connect a mailbox or calendar — Google account data described in the dedicated section below.

About prospective candidates. On behalf of the companies that use Padmi Recruiter, we process professional profile information about prospective candidates — name, role, employer, location, public professional URLs, and contact details — obtained from licensed third-party data providers and publicly available professional sources. We use it solely to evaluate fit against a role and, where appropriate, to send a small number of personalized recruiting messages. See “Candidate choices” below for how to opt out.

Automatically. Our infrastructure providers log basic technical data such as IP address, browser type, and timestamps to keep the service secure and working.

When a company connects a Google account to Padmi Recruiter, we request the minimum scopes the product needs:

• Send email (gmail.send) — to send the recruiting emails and follow-ups that you compose or approve, from your own address.
• Read email (gmail.readonly) — to detect replies on the threads Padmi created, so follow-ups stop the moment someone answers and no one is ever contacted twice.
• Calendar events (calendar.events) — to create and update interview invites when a candidate agrees to talk.
• Free/busy (calendar.freebusy) — to read availability so the agent proposes times that actually work.

We only read messages on threads that Padmi itself started, plus the minimum metadata needed to recognize a reply or an unsubscribe request. We do not scan, index, or analyze the rest of your mailbox.

Limited Use disclosure. Padmi’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We only use Google user data to provide and improve the user-facing features of Padmi Recruiter. We never use it for advertising, and we never sell it.
• We do not use Google user data to develop, improve, or train generalized AI or machine-learning models.
• No human reads your Google data except with your explicit permission (e.g. a support request), where necessary for security or abuse investigation, to comply with applicable law, or after aggregation and anonymization for internal operations.
• We only transfer Google user data to others where necessary to provide the service (see subprocessors below), to comply with law, or as part of a merger or acquisition with prior notice to you.

Padmi Recruiter uses large language models from Anthropic to evaluate candidate fit, draft outreach in your voice, and triage replies. Content is processed through these models solely to provide the service; under our API terms with Anthropic it is not used to train their models. Companies control whether drafts send automatically or wait for human approval.

• To create and maintain accounts, profiles, and workspaces.
• To send referral requests to the people applicants nominate, and to let referrers verify identity and respond.
• To review applications and forward strong ones to the companies applicants applied to.
• For companies: to source and evaluate candidates against the role you define, send the outreach you approve from your connected inbox, detect replies, and schedule conversations on your calendar.
• To operate, secure, and improve the platform.
• To contact you about your account.

We do not sell personal information. We share data only with the vendors required to run Padmi, limited to what each needs:

• Supabase — authentication, database, and file storage.
• Vercel and Railway — application hosting.
• Google — sign-in, and Gmail/Calendar APIs for connected accounts.
• Anthropic — AI processing described above.
• Licensed candidate-data providers — professional profile and contact data used for sourcing on behalf of companies.
• Resend — transactional email (referral requests, account notices).
• LinkedIn — identity verification for referrers (OpenID Connect).
• Cal.com — scheduling for introductory calls booked through our site.
• Greenhouse and Ashby — public job-listing data we display.

We may disclose information if required by law or to protect the rights, safety, or security of Padmi and its users.

If a Padmi-powered recruiting email reaches you and you’d rather not hear from us: reply with a one-line opt-out or email privacy@padmi.ai. We maintain a global do-not-contact list that applies across every company using Padmi — once you opt out, no Padmi customer can reach you through us again. You may also request a copy or deletion of the professional profile data we hold about you.

We keep account, profile, referral, and workspace data for as long as the account is active or as needed to provide the service. Google user data is retained only as long as needed for the features above — disconnecting your Google account revokes our access and we delete stored Gmail and Calendar data within 30 days, except records we’re required to keep by law. Do-not-contact entries are kept indefinitely, since deleting them would defeat their purpose.

Depending on where you live (including under GDPR and CCPA/CPRA), you may have the right to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to non-discrimination for exercising those rights. Email privacy@padmi.aiand we’ll respond within 30 days. You can also revoke Padmi’s access to your Google account at any time at myaccount.google.com/permissions.

OAuth tokens and personal data are encrypted in transit, access is restricted to systems and personnel that need it, resumes live in a private bucket, and the two sides of every referral are kept separate by design. No system is perfectly secure, but we work to protect your information using industry-standard measures, and we will notify affected users of any breach as required by law.

Padmi is not directed to children under 16, and we do not knowingly collect their personal information.

We may update this policy as Padmi evolves. When we do, we’ll revise the “last updated” date above and, for material changes, take reasonable steps to let you know.

Questions about this policy or your data? Email privacy@padmi.ai.