Built on privacy-by-design controls that map to GDPR data-subject rights — access, erasure and consent. Full GDPR obligations apply only where we process EU residents’ data; see the GDPR section below.
Privacy Policy
Plain language commitment: This policy is written to be understood, not to confuse. If anything is unclear, email us at hello@skilwi.ai and we will explain it in plain language.
Contents
1Who we are
SKILWI.ai is India's first Workforce Intelligence Operating System. We are operated by SKILWI Technologies, incorporated in Bangalore, Karnataka, India.
We provide a software platform that helps organisations understand the skills their employees have, identify gaps, run Training Needs Analysis (TNA), manage recruitment, and make workforce planning decisions.
For the purposes of India's Digital Personal Data Protection Act 2023 (DPDP 2023), SKILWI.ai is the Data Fiduciary. For the purposes of GDPR, SKILWI.ai acts as a Data Controller for our own marketing and website data, and as a Data Processor for employee and candidate data processed on behalf of our enterprise clients.
Our details
2What data we collect
We collect different types of data depending on whether you are a candidate (applying for a job through SKILWI.ai), an employee (whose employer uses SKILWI.ai), or a visitor to our website.
Candidate data
| Data type | Examples | How collected |
|---|---|---|
| Identity | Name, email, phone number | CV upload or direct entry |
| Resume / CV content | Work history, education, skills, certifications | CV upload (PDF/Word) |
| Skill profile | Extracted skills mapped to ESCO taxonomy, proficiency levels, match scores | Automated AI extraction from CV |
| Assessment results | Personality assessment scores (TKI, DiSC, EQ-i) if conducted | Assessment platform |
| Consent record | Date, time, purpose of consent given | Consent screen at CV upload |
What we strip out: Our CV parser is configured to discard Aadhaar numbers, PAN numbers, date of birth, and biometric data unless your employer has explicitly enabled these for a specific, stated purpose. These fields are never used for matching or scoring.
Employee data (when your employer uses SKILWI.ai)
| Data type | Examples | Source |
|---|---|---|
| Profile | Name, role, department, seniority level | Employer upload or HR system |
| Skill inventory | Current skills, proficiency levels, ESCO codes, confidence scores | CV import + manager assessments + learning completions |
| Performance data | Review scores, goal achievement, skill ratings from manager | Performance review submissions |
| Learning data | Training assigned, in progress, completed, validated | Platform tracking + LMS integration if enabled |
| Career data | Career aspirations (if voluntarily entered), readiness scores, mobility matches | Employee self-entry + automated calculation |
| Wellbeing signals | Anonymous pulse survey responses, aggregate burnout risk score | Weekly 5-question pulse (anonymous) |
| Contact PII | Phone number (encrypted), Aadhaar last 4 digits (encrypted if collected), PAN (encrypted if collected) | Employer HR records |
Website visitor data
If you visit skilwi.ai, we collect standard web analytics data (pages visited, browser type, referring URL, time on page) if you accept analytics cookies. We do not collect this data if you decline cookies. We do not use third-party advertising cookies.
Demo request form data
If you fill in our demo request form, we collect your name, work email, company name, company size, and industry. This data is used only to contact you about a product demo and is never sold or shared with third parties for marketing.
3Why we collect it
We collect data only for specific, stated purposes. We do not collect data speculatively or "just in case."
| Purpose | Legal basis (DPDP 2023) | Legal basis (GDPR) |
|---|---|---|
| CV parsing and candidate matching | Consent (given at CV upload) | Consent / Legitimate interest (recruitment) |
| TNA and skill gap analysis | Consent + Employer legitimate interest | Contract performance / Legitimate interest |
| Performance management | Employer legitimate interest | Contract performance |
| Career pathing and internal mobility | Employee consent | Consent |
| Wellbeing pulse surveys | Anonymous, consent not required | Anonymous, consent not required |
| Decision intelligence (upskill vs hire) | Employer legitimate interest | Legitimate interest |
| Platform security and audit logs | Legal obligation | Legal obligation |
| Demo request follow-up | Consent (form submission) | Consent |
Purpose limitation: Data collected for recruitment is not used for performance scoring without fresh consent. Data collected for TNA is not used for marketing. Each dataset has one primary purpose and does not migrate to another without your knowledge.
4How we use it
Concretely, here is what happens to your data inside SKILWI.ai:
- Your CV is parsed by our 4-layer AI pipeline (rule-based extraction → spaCy NER → semantic embeddings → LLM cleanup) to extract your skills and map them to the ESCO skill taxonomy.
- Your skill profile is matched against job descriptions using a 5-signal scoring engine. Every score is explained, you can see exactly why you ranked where you did.
- If hired, your skill profile carries forward automatically to your employee record. A Training Needs Analysis is run against your actual role requirements.
- Your manager's performance ratings update your skill profile with a higher-confidence weight than your self-reported skills.
- If you participate in the wellbeing pulse, your individual responses are never stored. Only aggregated, anonymised team-level signals are stored and only shown to HR, never to your direct manager.
- Your salary data (if provided by your employer) is used only for the upskill-vs-hire cost model. It is never shown to other employees or used for external benchmarking without explicit consent.
5Who we share your data with
We do not sell your data. We do not share your data with advertisers. We share data only in the following limited circumstances.
Your employer
If you are a candidate or employee, your employer (who is our client) can see your skill profile, TNA results, and performance data. Your employer cannot see your individual wellbeing pulse responses, only anonymised team aggregates.
Sub-processors (technology partners)
| Partner | Purpose | Data shared | Location |
|---|---|---|---|
| Groq (Llama 3.3 70B) | AI skill extraction and IDP generation | CV text excerpts, skill names (no PII) | USA |
| Google (Gemini 2.0 Flash) | AI fallback for content generation | Anonymised text prompts (no PII) | USA / EU |
| Hostinger KVM2 | Server hosting and infrastructure | All platform data (encrypted at rest) | EU (Amsterdam) |
| ChromaDB | Vector search for CV-JD matching | Skill embeddings (no raw PII) | On-premise (same server) |
Important: We are in the process of obtaining written confirmation from Groq and Google that they do not train their models on SKILWI customer data. Until this is confirmed in writing, we treat all AI provider calls as potentially retaining data and minimise PII in prompts accordingly.
Legal disclosure
We may disclose your data if required by Indian law, court order, or a lawful request from a government authority. We will notify you of any such request where legally permitted to do so.
6How long we keep your data
| Data type | Retention period | Reason |
|---|---|---|
| Rejected candidate profiles | 90 days after rejection | DPDP 2023 data minimisation requirement |
| Active candidate profiles | Duration of recruitment process + 90 days | Employer legal obligation |
| Employee skill profiles | Duration of employment + 1 year | Employer legal obligation / audit |
| Performance reviews | Duration of employment + 3 years | Labour law compliance |
| Wellbeing pulse (aggregates only) | 2 years rolling | Trend analysis, no individual data retained |
| CV files (raw) | 90 days after last use | Storage cost + privacy minimisation |
| Demo request data | 2 years or until you opt out | Sales follow-up |
| Website analytics | 13 months | Standard analytics retention |
| Audit/access logs | 5 years | Security and legal compliance |
You can request deletion of your data at any time. See Your Rights below.
7How we protect your data
We take security seriously. Here is what is currently implemented:
- AES-256 encryption at rest for all PII fields (phone number, Aadhaar last 4, PAN number). Encryption keys are managed via environment variables, never hardcoded.
- TLS 1.2+ in transit for all connections. HTTP is redirected to HTTPS on all pages.
- Cryptographic separation for wellbeing data, individual pulse responses are not stored; only aggregates are retained and manager roles are blocked from individual-level data at the database query level.
- Role-based access control: admins, hiring managers, and recruiters see only the data their role permits. Organisation-level data isolation (multi-tenancy) is enforced at the query level with
org_idfilters on all data access. - JWT authentication with bcrypt password hashing for all user sessions.
- Daily encrypted backups to isolated storage. Backups are tested monthly.
Upcoming: We are planning a full penetration test and VAPT assessment before onboarding our first enterprise client. Database access logging (who queried what PII and when) is scheduled for Sprint 3.
Data breach response
In the event of a data breach, we commit to notifying affected data principals within 72 hours of discovery (as required by GDPR) and as soon as reasonably practicable under DPDP 2023. We will notify the Data Protection Board of India and relevant EU DPAs as required by law.
8Your rights
You have the following rights over your personal data. To exercise any of these rights, contact us at privacy@skilwi.ai. We will respond within 30 days.
Right to Access
Request a copy of all personal data we hold about you, in a readable format.
Right to Rectification
Ask us to correct inaccurate data, for example, a skill incorrectly extracted from your CV.
Right to Erasure
Request deletion of your personal data ("right to be forgotten"). We will hard-delete all PII within 30 days.
Right to Portability
Receive your data in a machine-readable format (JSON) to transfer to another service. (GDPR only)
Right to Object
Opt out of automated profiling or TNA scoring. You can request human review of any AI-generated score.
Right to Withdraw Consent
Withdraw consent at any time. This does not affect processing done before withdrawal but stops future processing.
How to make a request
Email privacy@skilwi.ai with the subject line "Data Rights Request" and the following: your full name, email address used in SKILWI.ai, your employer (if an employee), and the specific right you wish to exercise. We will respond within 30 days. If we need to verify your identity, we will ask for confirmation before acting on the request.
9AI and automated decisions
SKILWI.ai uses artificial intelligence in several parts of the platform. We are transparent about where AI is used and what decisions it influences.
| AI function | What it does | Human oversight |
|---|---|---|
| CV skill extraction | Extracts skills from your resume and maps them to the ESCO taxonomy | Every extracted skill is visible to the recruiter and candidate. You can dispute any extraction. |
| Candidate match scoring | Ranks candidates against a job description using a 5-signal weighted score | Score is advisory only. Every score shows its reasoning. Hire/reject decisions are made by humans. |
| TNA gap analysis | Identifies skill gaps between an employee's current profile and their role requirements | Gap results are presented as recommendations. Employees and managers can override any gap classification. |
| IDP generation | Writes a personalised development plan narrative using Groq Llama 3.3 70B or Gemini 2.0 Flash | All AI-generated text is clearly marked as AI-generated. Managers and HR edit and approve before sharing. |
| Upskill vs hire recommendation | Calculates the cost and timeline of upskilling vs external hiring | Output is a cost model, not a mandate. Leadership makes the final decision. |
No AI makes a final hiring decision. SKILWI.ai scores and ranks candidates, but every hire, reject, and offer decision is made by a human recruiter or hiring manager. The platform is designed to inform decisions, not replace them.
Bias and fairness
We are aware that AI models can reflect biases present in training data. Our matching engine scores candidates on skill evidence, not on names, gender, location, or caste. We are planning a formal bias audit, testing the matching engine for gender, age, and location discrimination, scheduled before our first enterprise client onboarding.
If you believe an AI score has treated you unfairly, you have the right to request human review. Contact us at privacy@skilwi.ai.
10DPDP 2023, India
The Digital Personal Data Protection Act 2023 applies to all personal data of Indian citizens processed by SKILWI.ai. This section sets out our obligations and your rights under DPDP 2023 specifically.
Data Fiduciary obligations
As a Data Fiduciary under DPDP 2023, SKILWI.ai commits to:
- Collecting only the personal data necessary for the stated purpose
- Processing personal data only for the purpose for which consent was given
- Ensuring accuracy and completeness of personal data
- Implementing appropriate security measures
- Deleting personal data when the purpose is fulfilled or consent is withdrawn
- Notifying the Data Protection Board of India of any personal data breach
Consent under DPDP 2023
We obtain consent before collecting personal data. Consent must be:
- Free, not a condition of using unrelated services
- Specific, for a particular stated purpose
- Informed, you know what you are consenting to
- Unambiguous, a clear affirmative action, not a pre-ticked box
Grievance redressal
DPDP 2023 requires us to have a Grievance Officer. Our Grievance Officer is:
If you are not satisfied with our response, you may escalate to the Data Protection Board of India (once constituted) or approach a court of competent jurisdiction.
Cross-border data transfers
Some of your data is processed by our AI providers (Groq, Google Gemini) whose servers are located outside India, primarily in the United States. We process the minimum necessary data through these providers and are monitoring the Government of India's notifications on permitted cross-border transfer countries under DPDP 2023.
11GDPR, European Union
GDPR applies to SKILWI.ai when we process data of EU citizens, for example, if an EU-based company uses our platform or an MNC employee in India holds EU citizenship.
Our role under GDPR
When we process employee and candidate data on behalf of an enterprise client, we act as a Data Processor. The enterprise client is the Data Controller. If you wish to exercise GDPR rights over data held in an employer's SKILWI.ai account, please contact your employer first, they will instruct us accordingly.
For data we collect directly (website analytics, demo requests), we act as a Data Controller.
GDPR rights
In addition to the rights listed in Section 8, EU residents have the right to lodge a complaint with the Data Protection Authority (DPA) of your EU member state if you believe we have violated GDPR.
International transfers from the EU
Where we transfer EU personal data outside the EU/EEA, we use:
- Standard Contractual Clauses (SCCs) as approved by the European Commission
- Adequacy decisions where applicable
We are in the process of executing SCCs with Groq and Google for EU data transfers. Until these are finalised, we minimise EU PII in all AI provider calls.
Data Protection Officer
We do not currently have a formally appointed DPO. As we grow and our processing of EU data increases, we will appoint a DPO or engage a GDPR-specialist legal advisor. For all GDPR queries, contact privacy@skilwi.ai.
12Cookies
We use cookies on skilwi.ai. The cookie consent banner on our homepage lets you accept or decline non-essential cookies.
| Cookie type | Purpose | Can be declined? |
|---|---|---|
| Essential | Keeps you logged in, remembers your theme preference (light/dark), cookie consent choice | No, required to use the site |
| Analytics | Understand which pages are visited and how (no personal data) | Yes, decline in the banner |
| Advertising | We do not use advertising cookies | N/A |
Your cookie preference is stored in your browser's localStorage under the key skilwi-cookie-consent. To change your preference, clear your browser's localStorage for skilwi.ai or contact us.
13Changes to this policy
We will update this policy as our practices evolve, as we add new features, or as laws change. When we make material changes, we will:
- Update the "Last updated" date at the top of this page
- Email notice to all registered users if the change significantly affects your rights
- Show a notice on the SKILWI.ai platform for 30 days after a significant change
Continued use of SKILWI.ai after a policy change constitutes acceptance of the updated policy. If you disagree with a change, you may exercise your right to erasure or contact us to discuss.
14Contact and grievances
For any privacy-related question, data rights request, complaint, or grievance, use the channels below.
Get in touch
Escalation
If you are not satisfied with our response to your complaint:
- India: Escalate to the Data Protection Board of India (once constituted) or approach a court of competent jurisdiction under the DPDP Act 2023.
- EU/EEA: Escalate to the Data Protection Authority of your member state.
- UK: Escalate to the Information Commissioner's Office (ICO) at ico.org.uk.