Privacy policy

Who is responsible for what

Ornool is used by staffing and consulting firms. Each firm puts its own employees', contractors' and candidates' data into Ornool and decides what to collect and why. AEYEON Technologies Private Limited ("AEYEON", "we") runs Ornool and processes that data on the firm's behalf and under its instructions.

If you are an employee, contractor or candidate of a firm that uses Ornool, that firm is responsible for how your data is used. Questions about your data are best sent to them first; we will help them answer.

What Ornool holds

Account data

Name, email address, organisation and role within that organisation. Sign-in is through Microsoft Entra ID, Google, or a one-time link sent by email. Ornool does not store passwords.

Workforce records

For each employee or contractor: name, email, job title, employment type, country, skills, cost rates and billing rates.

Candidate records

Name, email, expected rate, skills, and how the candidate was sourced (direct, agency, referral, job board or inbound).

Documents

CVs and compliance documents uploaded by the firm.

Operational records

Timesheets, expenses, invoices, payments, vendor invoices, and client and contact records.

Audit log

A record of who did what and when, including who downloaded which document. Document reads are recorded on purpose, so that a request about a person's data can be answered accurately.

Résumés and documents

CVs and other documents are uploaded by the firm and stored by Ornool until the firm deletes them. They are served through the application rather than by shareable link, so every download is recorded in the audit log and access can be revoked.

A CV is stored whether or not AI-assisted parsing is used, because the firm needs the document itself.

AI-assisted résumé parsing

This feature is not switched on. The code is written and no model endpoint is configured, so no CV has ever been sent to a model and none can be until a firm turns it on. Uploaded CVs are stored and read by your own staff. This section describes what will happen when it is enabled, and we will say so here on the day that changes.

Ornool has one AI feature: résumé parsing. It reads an uploaded CV and fills in form fields so a recruiter does not have to retype them. It is optional; a recruiter can enter the details by hand instead.

It extracts seven fields and nothing else: full name, email, phone, current job title, years of experience, skills, and previous employers. This limit is enforced technically: the instructions sent to the model forbid any other field. Ornool therefore does not extract date of birth, nationality, marital status, gender or photographs, even when a CV contains them.

It does not score, rank or make decisions about people. It extracts information. A person at the firm makes every decision.

Provider

Not yet chosen. It will be a large language model hosted inside our own Microsoft Azure environment. We will name it here before the feature is switched on.

How it is accessed

Through Microsoft Azure, so the model runs inside the same cloud tenancy as the rest of Ornool. We do not send CVs to a model provider directly.

What is sent

The CV document itself is sent to the model, not text extracted from it.

What is recorded

A record of each parsing request is stored, including the output and a version identifier for the instructions used.

Where data is processed

Application, database and documents

Microsoft Azure, in a single region: currently Central India.

AI-assisted parsing

Not applicable while the feature is switched off. When it is enabled we will state the region it runs in, and whether that is the same region as your data, before any CV is processed.

In short: your data at rest and the application are in one region, and nothing is sent to a model today.

How long data is kept

Deletion

Documents. When a document is deleted, the stored file is destroyed first. The record is then marked as deleted and its original filename is removed, because filenames often contain a person's name. A database rule ensures a deleted record keeps nothing identifying and that every deletion has a recorded reason.

AI parsing records can be redacted for a specific person on request.

What cannot currently be erased. A candidate's name and email address cannot at present be removed from the candidate record. CVs can be destroyed and AI records redacted, but the candidate record itself is kept while the firm's account exists. We are building a way to redact candidate contact details and will update this policy when it is available.

Security

How data is isolated, accessed and audited is described on our security page. Ornool is not SOC 2 or ISO 27001 certified, no audit is in progress, and no external penetration test has yet been performed.

Privacy enquiries

For any question about personal data in Ornool, or to ask for a document to be deleted or AI records to be redacted, email privacy@ornool.com. If your data was entered by a firm that uses Ornool, please also contact that firm, as it decides how your data is used.

AEYEON Technologies Private Limited, 1/58, 3rd Cross, Kalkere, Ramamurthy Nagar, Bangalore North, Bengaluru – 560016, Karnataka, India. CIN U62011KA2025PTC212385.