Privacy policy

Last updated 2 November 2026

Croot is a hiring platform. This page says what we collect, why, where it lives, how long we keep it, and how to ask us to change or delete it.

Who we are

Croot (thecroot.com) is a hiring platform for companies in India. Companies use it to plan a role, publish a job, assess applications, book interviews, send offers and collect joining documents. Candidates use its careers sites to apply.

Legal entity and registered address: to be added here. For anything in this policy, write to tech@tronetechnology.com.

Who is responsible for what

• A company that uses Croot decides why and how it uses its candidates’ and employees’ data. For that data, Croot is the processor: we run the platform on the company’s instructions.
• Croot is responsible for the accounts people hold with us (a company user’s sign-in, a candidate’s careers account) and for the waitlist on this website.
• If you are a candidate and want something about an application changed or deleted, the company you applied to is the one to ask. We help it do that.

What we collect

Company users (recruiters, hiring managers, administrators)

• Your name, work email, role and the team you belong to.
• Your sign-in method (an emailed code or link, a passkey, or your company’s single sign-on), and your active sessions.
• What you do in the product that the company needs a record of: approvals, decisions, notes, and who did them and when.
• If your company connects its calendar or HR mailbox: the data described under Google user data and Microsoft 365 data.

Interviewers

• Your name and email, so we can send you a link.
• Your availability, as busy and free times, if you connect your calendar or give it by link.
• Your scorecards and notes on the interviews you take part in.
• If you use the interview recorder in your browser, the recording you make.

Candidates

• What you type when you apply: name, email, phone, where you live, current job and company, your answers.
• The resume and documents you upload.
• What you agreed to, in the exact words, which version, and when.
• Your sign-ins and your saved searches and alerts, if you have a careers account.
• Where each application stands and what has happened on it.
• If you do an AI interview: the recording, what you said written down, and when you started and stopped.
• If you get an offer: your questions about it, and when and how you signed it.
• If you join: the documents you send before your first day.
• Your replies to interview invitations, when the company has connected its HR mailbox (see Google user data).

Each careers site also has its own privacy notice for the companies hiring there. It covers the same ground in more detail for candidates.

Visitors and the waitlist

• If you join the waitlist on this website: your email address, your company name if you give it, and the answers to a few optional questions if you choose to answer them.
• This website sets no cookies for visitors and runs no advertising or tracking scripts. Its fonts load from Google Fonts, so your browser contacts Google when you open the page.

Why we use it

We use personal data only to run the hiring product and keep it safe:

• to let a company and its candidates do the hiring steps they have chosen to do;
• to sign people in, keep accounts secure and prevent misuse;
• to keep the records a company needs (who decided what, and when);
• to send the emails that the product needs to send, and the waitlist emails you asked for;
• to find and fix faults, and to measure what the service costs to run.

In India, we rely on your consent where the law asks for it, and on the other grounds the Digital Personal Data Protection Act, 2023 allows, such as an employment-related purpose and your own voluntary sharing. Where the GDPR applies, our grounds are the contract with the company, our legitimate interest in running a secure service, and consent where we ask for it.

We do not sell personal data. We do not use it for advertising.

How AI is used

Croot reads applications against the criteria the company set for the job, and shows what it found for each criterion with the words from the application that support it. It does not produce a score or a rank for a person. A person always decides who is hired and what is offered.

Some roles include an interview run by AI. Before it starts, the candidate is told that it is run by AI and recorded, what it looks at, who sees it and how long it is kept, and can choose a person instead.

In one narrow case, for a job in India, a company can choose to let Croot send a “not this time” message by itself to people in a batch a person has already decided, two working days later unless a person holds it. It is never used for the hire decision or an offer.

We do not use candidate data, or data from a connected Google or Microsoft account, to train or improve general-purpose AI models. The AI services we use receive only what they need to answer the request.

Where it is stored and how it is protected

The service runs on Cloudflare, placed in India (Mumbai) where Cloudflare offers it. Data is encrypted in transit. Sign-in tokens and the keys our users give us for connected services are encrypted before they are stored, and are never written to logs or shown back in the product. One company’s data is kept apart from every other company’s by the application, and we test that.

Who we share it with

We share data only with the companies and people it belongs to in the product, and with the services that help us run it. They may handle personal data only on our instructions:

• Cloudflare: hosting, databases and queues.
• Google Cloud: the live-interview service.
• OpenRouter and the AI models it routes to: reading applications and running AI interviews.
• Groq and Deepgram: turning interview audio into text.
• ZeptoMail (Zoho): sending our emails.
• Leegality: electronic signing of offers, for companies that use it.

We may also disclose data when the law requires it.

How long we keep it

Each kind of record is deleted on a schedule, and a legal hold pauses a schedule while it lasts.

• Interview recordings: 12 months, or less if the company chooses, and never less than 90 days.
• What was said in interviews, written down, and the hiring team’s notes and assessments: 24 months.
• Messages we send: 24 months. Whether an email was delivered: 90 days.
• Offers, signed offer letters and the record of how they were approved: 7 years.
• The record of changes in the product (who did what, and when): 7 years.
• Waitlist entries: until you ask us to remove you.
• Accounts, profiles and files: until the account is deleted.
• Calendar and mailbox connections: until they are disconnected (see below).

Your rights and how to use them

You can ask for a copy of your data, ask for it to be corrected or deleted, withdraw consent you gave, and complain. Candidates can do this from their careers account (Your account, then Your data) or by asking the company they applied to. Everyone else can write to tech@tronetechnology.com. To leave the waitlist, write to the same address from the email you joined with.

When we delete something at your request, we keep only a scrambled marker so you are not added or contacted again. If we cannot resolve your complaint, you can take it to the data protection authority in your country; in India, that is the Data Protection Board of India.

Google user data

A company can connect a Google account to Croot in two ways. A person can connect their own Google Calendar, and a company administrator can connect the company’s HR mailbox (Google Workspace). Each is optional, started by the person in Recruit, and uses Google’s own sign-in screen. Here is every Google permission we ask for and exactly what it is for:

• calendar.freebusy: we read when you are busy, never what the events are, so we can offer interview times when you are free.
• calendar.events.owned: we create, change and cancel the interview events that Croot itself made, on calendars you own, with a Google Meet link when the interview needs one. We do not read, change or delete your other events.
• gmail.send: for the HR mailbox, we send hiring emails (such as interview invitations) from the company’s own address.
• gmail.readonly: for the HR mailbox, we read new mail in the inbox so that a candidate’s reply to an invitation shows up on the right interview. We keep only a reply that comes from a candidate who has an interview with that company: the sender, subject, date and up to the first 20,000 characters of the text. Mail from anyone else is not kept. We do not read or keep anything to build a profile of you or the mailbox.
• openid and email: to know which Google account was connected.

Storage and protection. The sign-in tokens Google gives us are encrypted before they are stored, and are never written to logs or sent back to the browser. Busy times are kept only as a list of time ranges, with no titles or details, and are used to offer interview slots.

What we do not do. We do not sell Google user data. We do not use it for advertising. We do not use it to train or improve general AI models. People at Croot do not read it, except where you ask us for support, where it is needed to look into abuse or a fault, or where the law requires it.

Croot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting.

• Your own calendar: disconnect it in Recruit under your calendar connections. We stop watching your calendar, delete your stored tokens and busy times, cancel the future interview events Croot created, and ask Google to revoke the grant.
• The company’s HR mailbox: an administrator disconnects it in Recruit under HR account settings. We delete the stored tokens and mail goes back to our own mailer. This does not remove the grant on Google’s side, so also remove Croot at myaccount.google.com/permissions. Candidate replies already kept stay with their interview record until the company deletes them.
• You can always remove Croot’s access at myaccount.google.com/permissions. If you do, we can no longer reach your account, and the connection shows as needing reconnection.

Microsoft 365 data

The same two options exist for Microsoft: a person can connect their calendar, and an administrator can connect the company’s HR mailbox (a work or school Microsoft 365 account; personal Microsoft accounts can connect a calendar only). Each is optional and uses Microsoft’s sign-in screen. The permissions, through Microsoft Graph:

• User.Read: to know which Microsoft account was connected.
• Calendars.ReadWrite: Microsoft offers this as one permission for reading and writing a calendar. We use it to look up when you are busy and to create, change and cancel the interview events Croot made, with a Teams meeting link when the interview needs one. Microsoft’s lookup can return event titles and places; we keep only the busy time ranges and discard the rest. We do not change your other events.
• Mail.Send: for the HR mailbox, to send hiring emails from the company’s address.
• Mail.Read: for the HR mailbox, to read new inbox mail so a candidate’s reply lands on the right interview. We keep only replies from candidates who have an interview with that company, as described under Google user data above. Mail from anyone else is not kept.
• offline_access: so the connection keeps working without asking you to sign in each time.

Tokens are encrypted before storage. We do not sell this data, use it for advertising, or use it to train or improve general AI models. To disconnect, follow the same steps as above in Recruit, and you can remove Croot’s access in your Microsoft account under app access (work or school accounts: myapps.microsoft.com).

Changes to this policy

If we change this policy in a way that matters, we will update the date at the top and tell company administrators in the product.

Contact

tech@tronetechnology.com. See also our terms of service.