Privacy Policy

1. Scope

This Privacy Policy explains how XDQ Labs Private Limited ("Xtallo", "we", "us") handles personal data across xtallo.com, app.xtallo.com, blog.xtallo.com, and related services (the "Services"). It is published in accordance with India’s Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 and rules thereunder, and, where applicable, the EU/UK GDPR. By using the Services you acknowledge this Policy.

2. Data we collect

2.1 Data you provide

• Account data — name, email, password (hashed), and profile details.
• Reputation content — achievements, work history, outcomes, endorsements, reviews, and supporting evidence you submit for verification.
• Communications — messages, support tickets, and contact-form submissions (sent to hello@xtallo.com).
• Billing data — for paid plans, transaction details processed by our payment partners; we do not store full card numbers.

2.2 Data collected automatically

• Usage and device data — pages viewed, features used, browser/device type, IP address, and approximate location.
• Cookies and similar technologies (see our Cookie Policy).

3. How we use data

• To provide and operate the Services, including verification workflows, Trust Scores, and AI-native talent matching.
• To let companies discover and review talent, and to enable HR-checked verification.
• To communicate about your account and, with consent where required, marketing.
• To keep the platform safe — fraud prevention, abuse detection, and enforcement of our Terms and Community Guidelines.
• To comply with legal obligations.

4. Legal basis

We process personal data on the bases of your consent, performance of our contract with you, our legitimate interests in operating and securing the Services, and compliance with law. Under the DPDP Act, we act as a Data Fiduciary and process your personal data for the lawful purposes described here. You may withdraw consent at any time (see §10).

5. Verification & public profiles

Xtallo exists to make claims verifiable. Content you choose to publish — verified badges, Trust Scores, endorsements — is visible to other users and, per your settings, may be public. Verification evidence you submit privately for HR review is not published. You control what appears on your profile.

6. Sharing & disclosure

We do not sell your personal data. We share it only with: (a) processors acting on our behalf under contract (hosting, analytics, email, payments); (b) companies and users, to the extent you publish content or apply/consent to be matched; (c) authorities where required by law; and (d) a successor entity in a merger or acquisition, subject to this Policy.

7. Cookies

We use cookies and similar technologies as described in our Cookie Policy. You can control non-essential cookies via your browser or our consent controls where shown.

8. Retention

We retain personal data while your account is active and thereafter only as needed for legitimate business or legal purposes, after which it is deleted or anonymised. You may request deletion at any time.

9. Security

We apply administrative, technical, and physical safeguards described in our Security Policy, including encryption in transit and at rest and hashed passwords. No system is perfectly secure; use a strong, unique password.

10. Your rights

Subject to applicable law, you may: access, correct, and update your data; request erasure; obtain a copy (portability); withdraw consent; nominate a person to exercise your rights in case of death or incapacity (DPDP Act); and grieve or complain. To exercise these, email info@xdqlabs.com. We respond within the timelines the law prescribes.

11. International transfers

We may process data on servers outside your country. Where we transfer personal data internationally, we use safeguards consistent with applicable law and only to jurisdictions permitted by the Government of India where required.

12. Children

The Services are intended for users aged 18 and above. We do not knowingly process the personal data of children. Where required, we will obtain verifiable parental consent or refrain from processing.

13. Grievance & contact

For privacy questions or complaints, contact our Grievance Officer at info@xdqlabs.com (see the Grievance Officer page). We update this Policy from time to time and will post changes here with a revised date.