Privacy Policy

This Privacy Policy is published by Hyumeans Private Limited, the company that owns and operates the Hawksyn mobile application. It explains what personal data we collect from users of the Hawksyn application, why we collect it, how we use it, who we share it with, how we protect it, and what rights you have over your own data.

The words "we," "us," and "our" in this policy mean Hyumeans Private Limited. The word "you" means any person who downloads, installs, creates an account on, or uses the Hawksyn mobile application.

This policy applies to all users of the Hawksyn mobile application regardless of which country they are in. Where specific rights or requirements apply to users in a particular country or region, this is stated clearly in the relevant section.

This policy covers the following markets specifically: India, the United Arab Emirates, Singapore, the United Kingdom, the European Union, and the United States. If you are using Hawksyn from any other country, the general principles in this policy apply to you.

Company Name

Hyumeans Private Limited

CIN

U62099GJ2025PTC169748

DIPP Recognition

DIPP246851

Privacy Contact

privacy@hawksyn.com

Website

hawksyn.com

Effective Date

01 September 2026

Hawksyn collects two categories of personal data. The first is data that you actively provide to us. The second is data that is collected automatically when you use the application.

2.1 Data You Actively Provide

When you create an account and use the Hawksyn application, you provide us with the following personal data:

• Your full name and email address, collected when you create your account.
• Your resume or curriculum vitae document, which you upload to the application for analysis.
• Your employment history, including the names of employers you have worked for, your job titles, and the time periods of each role.
• Your skills, qualifications, and professional certifications as included in your resume or provided through the structured intake process.
• Your responses to the structured career intake questionnaire inside the application, which helps the analysis engine produce more accurate results.

All of the data listed above is provided voluntarily by you. You choose what to include in your resume and what to answer in the intake process. However, if you do not provide this data, the Hawksyn application cannot produce its analysis and outputs for you.

2.2 Data Collected Automatically

When you use the Hawksyn application, certain data is collected automatically through Firebase, which is Google's analytics and crash reporting platform. This data does not include your career information or your resume content. It covers only the technical and behavioural information described below.

Through Firebase Analytics, the following data is collected:

• The general features of the application you use and how you navigate through it, recorded as anonymous event data.
• The version of the Hawksyn application you are using.
• The type of device you are using and its operating system version.
• Your Android ID, which is a device identifier classified as a device or other ID under Google Play's Data Safety requirements. This identifier is used by Firebase for analytics session management.

Through Firebase Crashlytics, the following data is collected only when the application experiences a technical error or crash:

• A crash report describing the technical state of the application at the moment of the error.
• Your device type and operating system version at the time of the crash.
• The version of the Hawksyn application that was running.
• A Firebase installation identifier used to associate the crash report with a device session.

Hawksyn does not collect your precise or approximate location. Hawksyn does not access your phone contacts. Hawksyn does not access your camera or microphone. Hawksyn does not use advertising identifiers. Hawksyn does not collect any financial information.

Every piece of data that Hawksyn collects has a specific, stated purpose. We do not collect any data that we do not need to deliver the service.

• Your name and email address are collected to create and maintain your account, to send you transactional communications related to your account, and to allow you to log in to the application securely.
• Your resume or curriculum vitae document is collected so that the Profile Signal Discovery Engine can read your career record and generate your Hawksyn Intelligence Profile, Skill Clock scores, and four downloadable career documents.
• Your employment history, skills, and qualifications are collected as part of the same career analysis process. This information is the core evidence from which all outputs are derived.
• Your structured intake questionnaire responses are collected to provide the analysis engine with additional context that makes the outputs more specific and accurate for your individual career situation.
• Firebase Analytics data -- including app usage events, device type, operating system version, and Android ID -- is collected to help us understand how users interact with the application so that we can identify areas for improvement and measure whether the application is working as intended.
• Firebase Crashlytics data is collected to help us identify and fix technical errors in the application quickly, so that the experience of all users is improved.

This section applies to users in the United Kingdom and the European Union. Under the General Data Protection Regulation, every organisation that processes the personal data of people in the UK or EU must have a lawful basis for doing so.

Where we rely on legitimate interests as our lawful basis, we have assessed that our interest in improving the application does not override your fundamental rights and freedoms. The data collected for these purposes is technical and behavioural in nature and does not include your career information or resume content.

UK and EU users who wish to object to processing carried out on the basis of legitimate interests may do so by contacting us at privacy@hawksyn.com. We will assess each objection individually and respond within 30 days.

Your personal data is used only for the following specific purposes.

• To run the Profile Signal Discovery Engine and generate your Hawksyn Intelligence Profile. This is the primary purpose for which you provide your career data.
• To generate your four Skill Clock scores -- Career Compounding, Operating Level, Profile Trust, and Evaluation Readiness -- from the same analysis.
• To generate your four downloadable career documents -- the HIP PDF, the CV Improvement Blueprint, the Positioning Talking Points, and the Interview Intelligence document. These documents are generated on your device and delivered directly to your device. They are not stored on Hawksyn's servers.
• To create and maintain your user account and allow you to access your profile inside the application.
• To send you transactional communications related to your account, such as confirmation emails and important service notifications.
• To improve the Hawksyn application using anonymised and aggregated data derived from Firebase Analytics. This improvement work uses aggregate patterns across all users and cannot be linked back to any individual user's career data.

Hawksyn does not use your career data for advertising purposes. Hawksyn does not use your career data to build advertising profiles. Hawksyn does not allow any employer, recruiter, or third-party organisation to access your career data without your explicit, individual, and separately obtained consent. Hawksyn does not sell your personal data to any third party for any purpose.

This section is required by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules 2026, issued by the Ministry of Electronics and Information Technology, Government of India, which came into force on 20 February 2026. It is also relevant under the General Data Protection Regulation for UK and EU users.

The personal data you submit to Hawksyn -- including your resume, employment history, skills, and intake questionnaire responses -- is processed by an artificial intelligence powered analysis engine. This engine is called the Profile Signal Discovery Engine. It reads your career evidence and checks it against 330 different signals across 8 dimensions of professional career evidence to produce your Hawksyn Intelligence Profile and Skill Clock scores.

This processing is automated. It does not involve a human professional reviewing your individual career record as part of the standard service. The outputs are produced entirely by the analysis engine based on the evidence you have submitted.

What you should understand about this automated processing:

• The outputs are structured intelligence derived from your career evidence. They are interpretations based on patterns found in your career record, not independently verified facts.
• The same career evidence submitted by two different professionals may produce different outputs depending on how that evidence is structured, described, and presented in the submitted documents.
• The accuracy of the outputs depends directly on the completeness and accuracy of the career evidence you submit.

If you have questions about how the automated processing works, or if you wish to understand more about how a specific output was produced, you may contact us at privacy@hawksyn.com. We will respond within 15 working days.

This section applies to users in the United Kingdom and the European Union under Article 22 of the General Data Protection Regulation.

Under the GDPR, profiling means the automated processing of personal data to evaluate personal aspects relating to a natural person. This includes evaluating aspects relating to that person's professional performance, reliability, and behaviour. The processing carried out by the Hawksyn Profile Signal Discovery Engine falls within this definition because it analyses career evidence to evaluate professional characteristics.

However, Hawksyn's outputs are not decisions that are made about you by Hawksyn or by any employer. They are intelligence tools provided to you for your own use and benefit. No legal decision, employment decision, or other decision that produces significant effects for you is made automatically by Hawksyn based on the outputs. You receive the outputs and you decide what to do with them.

UK and EU users have the right under GDPR Article 22 to:

• Request that a human member of the Hawksyn team reviews the outputs produced about their career record, rather than relying solely on the automated analysis.
• Express their point of view regarding the automated outputs and ask us to take it into account.
• Contest any output that they believe is materially inaccurate or unfair.

To exercise any of these rights, please contact us at privacy@hawksyn.com with a description of your request. We will acknowledge your request within 5 working days and provide a substantive response within 30 days.

Hawksyn shares your personal data only with the following categories of organisations, and only for the specific purposes described. We do not share your personal data with any other organisation for any other purpose.

8.1 Technology Partners Acting As Data Processors

The following organisations process your personal data on Hawksyn's behalf and under Hawksyn's instructions. They are data processors, meaning they are not permitted to use your data for their own purposes.

• Amazon Web Services (AWS), Mumbai Region (ap-south-1) -- our cloud infrastructure provider. AWS hosts the Hawksyn application and stores the personal data you submit through the application on servers located in Mumbai, India. AWS processes your data only under our instructions and in accordance with its own data processing agreements.
• Firebase by Google -- our analytics and crash reporting platform. Firebase receives only the technical and behavioural data described in Section 2.2 of this policy. Firebase does not receive your resume content, your career history, your employment information, or any other personal career data. Firebase is governed by Google's own data processing terms, which are compliant with applicable data protection laws.

8.2 No Sharing With Employers Or Recruiters

Hawksyn does not share your career data with any employer, recruiter, hiring organisation, or talent acquisition platform under any circumstances without your explicit, individual, and separately obtained consent. This is an absolute commitment. The trust architecture of the Hawksyn product depends on this guarantee being maintained without exception.

8.3 No Sale Of Data

Hawksyn does not sell your personal data to any third party for any purpose. This includes selling to data brokers, advertising platforms, market research organisations, or any other commercial entity.

8.4 Legal Disclosure

In limited circumstances, Hawksyn may be required to disclose personal data to a government authority, law enforcement agency, or court in response to a valid legal order, court order, or government direction. In such cases, we will disclose only the minimum amount of data required to comply with the legal obligation. Where we are legally permitted to do so, we will notify the affected user before complying with the disclosure requirement.

9.1 Where Your Data Is Stored

The personal data you submit to the Hawksyn application -- including your resume, career information, account details, and analysis outputs -- is stored on Amazon Web Services infrastructure located in the Mumbai region of India, identified as ap-south-1. This means your primary data is stored within India.

The four downloadable career documents generated for you -- the HIP PDF, the CV Improvement Blueprint, the Positioning Talking Points, and the Interview Intelligence document -- are generated directly on your device and downloaded to your device. These documents are not stored on Hawksyn's servers at any point.

When you upload a new CV to the application, all previous career data stored on our servers is permanently replaced. Previous versions of your profile are not stored or retained.

9.2 How Your Data Is Protected

Hawksyn implements the following technical and organisational security measures to protect your personal data from unauthorised access, loss, alteration, or disclosure:

• All data transmitted between your device and Hawksyn's servers is encrypted using Transport Layer Security (TLS). This means your career data is protected in transit and cannot be read by any third party intercepting the connection.
• All personal data stored on Hawksyn's AWS infrastructure is encrypted at rest. This means your data is stored in an encrypted format and cannot be read without the appropriate decryption credentials.
• Access to personal data within Hyumeans Private Limited is restricted on a need-to-know basis. Only personnel who require access to personal data to perform a specific function are granted that access.
• Access controls and authentication requirements are maintained for all systems that store or process personal data.

No security system is completely impenetrable. While we implement the measures described above, we cannot guarantee the absolute security of your data against all possible threats. If you have reason to believe that your account has been compromised, please contact us immediately at privacy@hawksyn.com.

9.3 Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, Hawksyn will notify the relevant supervisory authorities and, where required, affected users within the timelines required by the applicable law in your country:

• India -- DPDP Act 2023: We will notify the Data Protection Board of India in accordance with the breach reporting requirements under the Act and the DPDP Rules 2025.
• United Kingdom and European Union -- GDPR: We will notify the relevant supervisory authority without undue delay and within 72 hours of becoming aware of the breach where feasible. Where the breach is likely to result in a high risk to your rights, we will also notify you directly without undue delay.
• United Arab Emirates -- UAE PDPL: We will notify the UAE Data Office within 72 hours of becoming aware of the breach.
• Singapore -- PDPA: We will notify the Personal Data Protection Commission within 3 business days where the breach causes or is likely to cause significant harm to affected individuals.

Hawksyn retains your personal data only for as long as necessary to deliver the service to you and to comply with our legal obligations.

• Your account data and career data submitted to Hawksyn are retained for as long as your account is active. If you have not logged into your account for a continuous period of 24 months, we may contact you to confirm whether you wish to keep your account active. If we do not receive a response, we may delete your account and all associated data after a further 30-day notice period.
• When you upload a new CV, all previous career data is immediately and permanently replaced on our servers. Previous versions are not retained.
• When you delete your account through the in-app deletion function, all personal data associated with your account -- including your resume, career history, intake responses, and profile data -- will be permanently deleted from our servers within 30 days of the deletion request.
• Firebase Analytics aggregated and anonymised usage data may be retained beyond the deletion of your account for the purpose of product improvement. This data cannot be linked back to your individual identity after anonymisation.
• Firebase Crashlytics crash report data is retained for 90 days by Firebase in accordance with their standard data retention policy, after which it is automatically deleted.

After the retention periods described above, your personal data will be permanently and irreversibly deleted from our systems. We do not archive personal data beyond these periods.

You have rights over your personal data. The specific rights available to you depend on the country you are in. All the rights described in this section can be exercised by contacting us at privacy@hawksyn.com. We will acknowledge your request within 5 working days and provide a substantive response within 30 days.

11.1 Rights For All Users

Regardless of which country you are in, the following rights apply to all Hawksyn users:

• The right to access your data. You can ask us to confirm what personal data we hold about you and to provide you with a copy of it.
• The right to correct your data. If any personal data we hold about you is inaccurate or incomplete, you can ask us to correct it.
• The right to delete your data. You can ask us to delete all personal data we hold about you. You can also do this directly through the account deletion function inside the application without contacting us.
• The right to download your data. You can ask us to provide your personal data in a structured and readable format so that you can take it with you.

11.2 Rights For Users In India -- DPDP Act 2023

• The right to erasure under Section 8(7) of the DPDP Act and Rule 8 of the DPDP Rules 2025. We will complete this deletion within 30 days of your request.
• The right to nominate another person to exercise your data protection rights on your behalf if you are unable to do so yourself.
• The right to raise a complaint with the Data Protection Board of India if you believe that Hawksyn has handled your personal data in a manner that violates the DPDP Act.

11.3 Rights For Users In The United Kingdom And European Union -- GDPR

• The right of access -- to receive a copy of the personal data we hold about you.
• The right to rectification -- to have inaccurate personal data corrected.
• The right to erasure -- also known as the right to be forgotten -- to have your personal data deleted.
• The right to restriction of processing -- to ask us to limit how we use your personal data in certain circumstances.
• The right to data portability -- to receive your personal data in a machine-readable format and to transfer it to another service.
• The right to object -- to object to the processing of your personal data where we rely on legitimate interests as our lawful basis.
• The right to request human review of automated profiling -- as described in Section 7 of this policy.
• The right to raise a complaint with your local supervisory authority. For UK users, this is the Information Commissioner's Office. For EU users, this is the data protection authority in your member state.

11.4 Rights For Users In The United Arab Emirates -- UAE PDPL

• The right to access the personal data Hawksyn holds about you.
• The right to correct personal data that is inaccurate or incomplete.
• The right to request deletion of your personal data.
• The right to receive your personal data in a portable format.
• The right to raise a complaint with the UAE Data Office if you are not satisfied with our response to a data rights request.

11.5 Rights For Users In Singapore -- PDPA

• The right to access the personal data Hawksyn holds about you and information about how it has been used or disclosed in the past year.
• The right to correct personal data that is inaccurate.
• The right to raise a complaint with the Personal Data Protection Commission of Singapore if you are not satisfied with our response.

11.6 Rights For Users In The United States -- CCPA And CPRA

• The right to know what personal data Hawksyn collects about you, why it is collected, and how it is used.
• The right to delete your personal data.
• The right to correct inaccurate personal data.
• The right to opt out of the sale or sharing of your personal data. Hawksyn does not sell personal data and does not share personal data for cross-context behavioural advertising. This right is therefore not applicable, but we state it clearly for transparency.
• The right to non-discrimination. Hawksyn will not discriminate against you for exercising any of your privacy rights.

Users in other US states with applicable state privacy laws -- including Virginia, Colorado, Texas, and others -- may exercise similar rights by contacting us at privacy@hawksyn.com. We will assess each request under the applicable state law.

Google Play Store policy requires that all applications which allow users to create accounts must also allow users to delete those accounts. Hawksyn fully complies with this requirement.

You can delete your account directly from within the Hawksyn application at any time. You do not need to contact us, send an email, or wait for assistance. The account deletion function is accessible inside the application settings without any additional steps, confirmation screens designed to discourage deletion, or waiting periods.

When you delete your account:

• All personal data associated with your account -- including your name, email address, resume, career history, intake responses, and analysis outputs stored on our servers -- will be permanently deleted from Hawksyn's servers within 30 days.
• Your Hawksyn Intelligence Profile and Skill Clock scores stored within the application will be deleted as part of this process.
• The four career documents you previously downloaded to your device are stored on your device only and are not affected by account deletion. They will remain on your device until you choose to delete them.
• Your Firebase Analytics device data and crash reports are subject to Firebase's own data retention policies and are managed by Google.

If you prefer to request account deletion by email rather than through the application, you may do so by contacting us at privacy@hawksyn.com with the subject line "Account Deletion Request." We will process the request within 30 days.

The Hawksyn application is not designed for, directed at, or intended for use by anyone under the age of 18. We do not knowingly collect personal data from users under the age of 18.

If you are under 18, you are not permitted to create an account on the Hawksyn application or submit any personal data to us.

If we become aware that we have collected personal data from a user who is under 18, we will immediately delete that data and close the associated account without notice.

If you are a parent or guardian and you believe that your child under the age of 18 has created a Hawksyn account or submitted personal data to us, please contact us immediately at privacy@hawksyn.com. We will investigate and take appropriate action, including deleting the data and closing the account, within 5 working days of receiving your report.

In accordance with the Personal Data Protection Act of Singapore, Hyumeans Private Limited has designated a Data Protection Officer who is responsible for overseeing the company's compliance with applicable data protection laws.

The Data Protection Officer is also the appropriate point of contact for any data protection inquiry, rights request, or complaint from users in any country.

Designation

Director, Hyumeans Private Limited

Contact Email

privacy@hawksyn.com

Acknowledgement

Within 5 working days

Substantive Response

Within 30 days

If you have any question about how Hawksyn handles your personal data, or if you wish to exercise any of the rights described in Section 11 of this policy, contacting the Data Protection Officer at privacy@hawksyn.com is the correct first step.

Your personal data is primarily stored on Amazon Web Services infrastructure located in the Mumbai region of India, identified as ap-south-1. This means your career data, account data, and analysis outputs are stored within India.

However, the nature of cloud infrastructure means that some technical processing -- such as crash report processing through Firebase Crashlytics -- may involve servers located outside India. Firebase is a Google service and Google's infrastructure may process technical data across multiple regions.

The following explains how cross-border transfers are managed under each applicable law:

• India -- DPDP Act 2023: The primary storage of your personal data is in Mumbai, India. Any transfers of personal data outside India will be handled in accordance with the requirements of the DPDP Act 2023 and any cross-border transfer notifications issued by the Ministry of Electronics and Information Technology.
• United Kingdom and European Union -- GDPR: Where personal data of UK or EU users is transferred outside the UK or the European Economic Area, Hawksyn ensures that appropriate safeguards are in place, including Standard Contractual Clauses where required. AWS and Google both maintain Standard Contractual Clauses as part of their data processing agreements.
• United Arab Emirates -- UAE PDPL: Transfers of personal data of UAE users outside the UAE are handled in accordance with the transfer requirements under the UAE Personal Data Protection Law. AWS Mumbai is used as the primary storage location.
• Singapore -- PDPA: Where personal data of Singapore users is transferred outside Singapore, Hawksyn ensures that the recipient organisation provides a standard of protection comparable to Singapore's PDPA, in accordance with the transfer obligation under the Act.

Hawksyn does not send marketing or promotional emails to users without first obtaining their explicit and separate consent to do so.

The only communications we send to registered users without separate marketing consent are transactional communications related to their account. These include account confirmation emails, important service notifications, and notifications about material changes to these terms or this privacy policy.

Your career data submitted to Hawksyn is never used for marketing purposes under any circumstances. We do not use your career information to target you with advertisements, promotions, or commercial offers inside or outside the application.

If we introduce optional marketing communications in the future, we will ask for your explicit consent before sending them. You will always have the ability to withdraw your consent and opt out of marketing communications at any time through your account settings or by sending a request to privacy@hawksyn.com.

The Hawksyn product is a mobile application. It does not use browser cookies. The tracking and analytics functions within the application are provided by Firebase, as described in Section 2.2 of this policy.

Firebase Analytics uses a session-based tracking approach to measure how users interact with the application. It also collects the Android ID as a device identifier, as required to be disclosed under Google Play's Data Safety requirements.

Firebase Crashlytics uses a Firebase installation identifier to associate crash reports with a specific device session. This identifier is not linked to your personal identity or your career data.

Hawksyn does not use advertising tracking technologies. Hawksyn does not use cross-application or cross-site tracking. Hawksyn does not allow any third-party advertising network to track users through the application.

Firebase's own privacy policy, available at policies.google.com/privacy, explains how Google handles the technical data received through Firebase services.

We may update this Privacy Policy from time to time to reflect changes in the Hawksyn application, changes in the data we collect, changes in how we use data, or changes in applicable data protection law.

When we make material changes to this policy -- meaning changes that affect how we collect, use, or share your personal data, or changes that affect your rights -- we will notify you in the following ways:

• By email to the address registered on your Hawksyn account, at least 30 days before the changes take effect.
• By a notification inside the Hawksyn application, at least 30 days before the changes take effect.

The updated policy will clearly state the date from which it applies. If you continue to use the Hawksyn application after the updated policy has taken effect, you are confirming that you have read and accepted the updated policy.

If you do not accept the updated policy, you must stop using the application and delete your account before the effective date of the changes. Deleting your account before the effective date means that the updated policy will not apply to you and all your personal data will be deleted within 30 days.

Minor changes that do not affect your rights or our data practices -- such as corrections of typographical errors or clarifications that do not change the meaning of any provision -- may be made without prior notice and will be updated on our website at hawksyn.com.

19.1 Contacting Hawksyn

If you have any question about this Privacy Policy, wish to exercise any of the rights described in Section 11, wish to raise a data protection concern, or wish to make a complaint about how we have handled your personal data, please contact us through the following channels.

Privacy and Data Protection

privacy@hawksyn.com

General Support

support@hawksyn.com

Grievance Officer (India)

grievance@hawksyn.com

Website

hawksyn.com

Acknowledgement

Within 5 working days

Substantive Response

Within 30 days

19.2 Supervisory Authorities

If you are not satisfied with our response to a privacy concern or a data rights request, you have the right to raise your complaint with the relevant data protection supervisory authority in your country.

• India -- Data Protection Board of India. Website: meity.gov.in
• United Kingdom -- Information Commissioner's Office (ICO). Website: ico.org.uk
• European Union -- The data protection supervisory authority in your EU member state. Full list available at: edpb.europa.eu
• United Arab Emirates -- UAE Data Office. Website: uaedataoffice.ae
• Singapore -- Personal Data Protection Commission (PDPC). Website: pdpc.gov.sg
• United States -- For California residents, the California Privacy Protection Agency. Website: cppa.ca.gov. For users in other states, the relevant state attorney general's office.

We would always appreciate the opportunity to resolve a concern directly before you approach a supervisory authority. Please contact us at privacy@hawksyn.com first and we will make every effort to address your concern promptly and fairly.