Privacy Policy — Bibha AI Labs Private Limited

1. Introduction and Scope

Welcome to Bibha AI Labs Private Limited (“Bibha AI,” “we,” “us,” or “our”). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you access or use our websites, platforms, applications, and services.

This policy applies to all users of our products and services, including:

• TalentFlow — our recruitment automation SaaS platform used by staffing firms, HR teams, and recruiters.
• AgentsHub — our AI agent creation platform where users design, configure, and deploy AI workers with job titles, system prompts, 500+ tool integrations, knowledge bases, voice/accent/language capabilities, phone numbers, video presence, and multi-agent orchestration.

This Privacy Policy applies to visitors of our websites (including https://bibha.ai and all subdomains), registered users, customers, candidates whose data is processed through our platforms, and any other individuals whose personal data we process in connection with our services.

By using our services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described in this policy, please discontinue use of our services.

2. Data Controller Information

The data controller responsible for your personal data is:

Bibha AI Labs Private Limited
Bangalore, Karnataka, India
Email: info@bibha.ai
Website: https://bibha.ai

For EU/EEA data subjects, Bibha AI Labs Private Limited acts as the data controller under the General Data Protection Regulation (GDPR). Where our customers use TalentFlow or AgentsHub to process personal data of their own end users, candidates, or clients, the customer acts as the data controller and Bibha AI acts as the data processor. In such cases, the relationship is governed by a Data Processing Agreement (DPA).

3. Types of Data We Collect

3.1 Personal Data You Provide

Account and Identity Data:

• Full name, email address, phone number
• Company name, job title, department
• Billing address, payment information
• Login credentials (hashed and encrypted)

TalentFlow-Specific Data:

• Candidate resumes, CVs, and cover letters
• Candidate contact details (email, phone, address)
• Employment history, education, skills, and qualifications
• Interview notes, assessments, and recruiter feedback
• Client company information (name, contacts, job descriptions)
• Communication logs between recruiters and candidates

AgentsHub-Specific Data:

• AI agent configurations (job titles, system prompts, persona definitions)
• Knowledge base content uploaded by users
• Voice configuration preferences (accent, language, tone)
• Phone numbers assigned to AI agents
• Orchestration workflows and canvas configurations
• Tool integration credentials and API keys (encrypted)
• Conversation logs between AI agents and end users
• Video call recordings (where enabled by the user)

3.2 Usage and Technical Data

• IP address, browser type, operating system, device identifiers
• Pages visited, features used, clickstream data
• Session duration, timestamps, referring URLs
• Error logs and performance data
• API call logs and usage metrics

3.3 AI-Generated Data

• Outputs generated by AI agents (text, voice, video responses)
• AI model predictions, recommendations, and classifications
• Automated screening results and scoring (TalentFlow)
• Agent interaction transcripts and summaries (AgentsHub)
• Analytics derived from AI processing

3.4 Data from Third Parties

• Information from single sign-on (SSO) providers (Google, Microsoft, etc.)
• Data from integrated third-party tools and services (CRMs, ATS platforms, communication tools)
• Publicly available professional information (LinkedIn, company websites)
• Payment verification data from payment processors

4. How We Collect Data

4.1 Direct Collection

We collect data directly from you when you:

• Create an account or register for our services
• Complete forms, surveys, or questionnaires
• Upload documents, files, or knowledge base content
• Configure AI agents or recruitment workflows
• Communicate with us via email, chat, or phone
• Subscribe to our newsletters or marketing communications

4.2 Automatic Collection

We automatically collect certain data when you interact with our platforms, including:

• Technical data via cookies, web beacons, and similar technologies (see Section 10)
• Usage data through server logs and analytics tools
• Device information through browser headers and APIs
• Location data inferred from IP addresses

4.3 Third-Party Sources

We may receive data from:

• Authentication and SSO providers
• Third-party integrations activated by users (e.g., HubSpot, Salesforce, Slack)
• Payment processors and billing platforms
• Publicly accessible databases and directories
• Our business partners and resellers

5. Legal Bases for Processing

Under the General Data Protection Regulation (GDPR), we process personal data based on the following legal grounds:

Where we rely on legitimate interests, we have conducted balancing tests to ensure your rights and freedoms are not overridden. You may object to processing based on legitimate interests at any time (see Section 11).

For special categories of personal data (such as health information, ethnic origin, or religious beliefs that may appear in candidate resumes), we process such data only with your explicit consent or as permitted by applicable law.

6. Purpose of Data Processing

We process your personal data for the following purposes:

Service Delivery:

• Providing, operating, and maintaining TalentFlow and AgentsHub
• Processing candidate applications, screenings, and placements (TalentFlow)
• Creating, configuring, deploying, and managing AI agents (AgentsHub)
• Facilitating multi-agent orchestration and tool integrations
• Enabling voice, phone, and video capabilities for AI agents

Account Management:

• Creating and managing user accounts
• Processing payments and invoicing
• Providing customer support and responding to inquiries

Product Improvement:

• Analyzing usage patterns to improve features and user experience
• Conducting A/B testing and product research
• Training and improving AI models (using anonymized and aggregated data only, unless you opt in to broader usage)
• Debugging, troubleshooting, and performance optimization

Communication:

• Sending transactional communications (account alerts, billing receipts, service updates)
• Sending marketing communications (with your consent or under legitimate interest for existing customers)
• Responding to support requests and feedback

Security and Compliance:

• Detecting, preventing, and responding to fraud, abuse, and security incidents
• Enforcing our Terms of Use and acceptable use policies
• Complying with applicable laws, regulations, and legal processes

7. Data Sharing and Third-Party Disclosures

We do not sell your personal data. We may share your data with the following categories of recipients:

7.1 Service Providers and Sub-Processors

We engage trusted third-party service providers who process data on our behalf, including:

• Cloud Infrastructure: Amazon Web Services (AWS) and Google Cloud Platform (GCP)
• Payment Processing: Stripe and Razorpay
• Email and Communication: AWS SES, Google Workspace, Microsoft Outlook, and SendGrid
• Analytics: Google Analytics 4
• AI/ML Providers: OpenAI, Google (Gemini), Anthropic, and other API-based inference providers as necessary to deliver the Services. A current list of sub-processors is available upon request at privacy@bibha.ai
• Customer Support: Email-based support via info@bibha.ai (no embedded third-party chat tools)

All sub-processors are bound by Data Processing Agreements and are required to maintain appropriate security measures. A current list of sub-processors is available upon request at info@bibha.ai.

7.2 Customer-Directed Sharing

When our customers use TalentFlow or AgentsHub, data may be shared with:

• Third-party tools and services integrated by the customer (e.g., CRMs, ATS platforms, communication tools)
• End users interacting with deployed AI agents
• Client companies receiving candidate information (TalentFlow)

7.3 Legal and Regulatory Disclosures

We may disclose your data when required by law, regulation, legal process, or enforceable governmental request, including:

• Court orders, subpoenas, or other legal processes
• Requests from law enforcement or regulatory authorities
• Protecting our legal rights, safety, or property

7.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your personal data may be transferred to the acquiring entity. We will notify you of any such change and the choices available to you.

8. International Data Transfers

Bibha AI Labs Private Limited is headquartered in Bangalore, India. We operate globally and process data across 39+ countries. Your personal data may be transferred to, stored in, and processed in countries outside your country of residence, including India and other jurisdictions where our service providers operate.

8.1 Safeguards for EU/EEA Data

For transfers of personal data from the EU/EEA to countries not recognized by the European Commission as providing adequate data protection, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements incorporating appropriate safeguards
• Binding Corporate Rules where applicable

8.2 Safeguards for UK Data

For transfers from the United Kingdom, we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs, as applicable.

8.3 India

Data processing within India is governed by the Information Technology Act, 2000 and its rules, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. We also monitor compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) as rules and regulations under it come into effect.

You may request a copy of the safeguards in place for international transfers by contacting us at info@bibha.ai.

9. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, and enforce our agreements.

When data is no longer needed, we securely delete or anonymize it. Customers using TalentFlow and AgentsHub may configure shorter retention periods within their account settings.

10. Cookies and Tracking Technologies

We use cookies and similar tracking technologies (web beacons, pixels, local storage) to operate our websites, analyze usage, and deliver personalized experiences.

For detailed information about the types of cookies we use, their purposes, and how to manage your cookie preferences, please refer to our Cookie Policy.

Categories of cookies we use:

• Strictly Necessary Cookies — required for website functionality (authentication, security, load balancing). These cannot be disabled.
• Analytics Cookies — help us understand how visitors interact with our websites (e.g., Google Analytics).
• Functional Cookies — enable enhanced features and personalization (e.g., language preferences, chat widgets).
• Marketing Cookies — used to deliver relevant advertisements and measure campaign effectiveness.

You can manage your cookie preferences through the cookie consent banner displayed on our websites or through your browser settings.

11. Your Rights Under GDPR

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have the following rights under the GDPR:

• Right of Access (Art. 15) — Request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16) — Request correction of inaccurate or incomplete data.
• Right to Erasure (Art. 17) — Request deletion of your personal data (“right to be forgotten”), subject to legal retention requirements.
• Right to Restriction (Art. 18) — Request that we limit processing of your data in certain circumstances.
• Right to Data Portability (Art. 20) — Receive your data in a structured, commonly used, machine-readable format and transmit it to another controller.
• Right to Object (Art. 21) — Object to processing based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent (Art. 7(3)) — Withdraw consent at any time without affecting the lawfulness of prior processing.
• Right Not to Be Subject to Automated Decision-Making (Art. 22) — Request human review of decisions made solely by automated means that significantly affect you.

To exercise any of these rights, please contact us at info@bibha.ai or write to our Data Protection Officer (see Section 16). We will respond to your request within 30 days.

If you are unsatisfied with our response, you have the right to lodge a complaint with your local Data Protection Authority.

12. Your Rights Under CCPA

If you are a California resident, the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA) grants you the following rights:

• Right to Know — Request disclosure of the categories and specific pieces of personal information we have collected, the sources of collection, the business purposes for collection, and the categories of third parties with whom we share data.
• Right to Delete — Request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out of Sale or Sharing — We do not sell your personal information. If this changes, we will provide a “Do Not Sell or Share My Personal Information” link.
• Right to Correct — Request correction of inaccurate personal information.
• Right to Limit Use of Sensitive Personal Information — Direct us to limit the use and disclosure of sensitive personal information to what is necessary.
• Right to Non-Discrimination — We will not discriminate against you for exercising your privacy rights.

To submit a CCPA request, please email privacy@bibha.ai with the subject line “CCPA Request”. We will verify your identity before processing any request and respond within 45 days.

13. Your Rights Under IT Act 2000 (India)

If you are located in India, the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 grant you the following rights:

• Right to Access — You may request access to your personal information and sensitive personal data or information held by us.
• Right to Correction — You may request correction or amendment of inaccurate personal information.
• Right to Withdraw Consent — You may withdraw your consent to the collection or processing of your sensitive personal data at any time. Note that withdrawal may affect your ability to use certain features of our services.
• Right to Grievance Redressal — You may file a grievance with our Grievance Officer (see Section 16) regarding any privacy concerns.

Under the Digital Personal Data Protection Act, 2023 (DPDP Act), once its rules are notified and in effect, additional rights may become available, including the right to nominate another person to exercise your rights and the right to approach the Data Protection Board of India. We will update this policy as DPDP Act rules are finalized.

To exercise your rights under Indian law, contact our Grievance Officer at info@bibha.ai.

14. Children's Privacy

Our services are not directed to individuals under the age of 16 (or under 13 in the United States under COPPA). We do not knowingly collect personal data from children.

• GDPR: We do not process data of individuals under 16 without verifiable parental or guardian consent.
• COPPA: We do not knowingly collect personal information from children under 13 in the United States.
• DPDP Act (India): We do not process data of individuals below 18 years of age without verifiable consent from a parent or lawful guardian, in accordance with the DPDP Act requirements.

If we become aware that we have collected personal data from a child without appropriate consent, we will take steps to delete such data promptly. If you believe we have inadvertently collected data from a child, please contact us immediately at info@bibha.ai.

15. Data Security Measures

We implement industry-standard technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction.

Technical Measures:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Multi-factor authentication (MFA) for administrative access
• Regular vulnerability assessments and penetration testing
• Network segmentation and firewall protection
• Automated threat detection and intrusion prevention
• Secure API key storage and credential management

Organizational Measures:

• Role-based access control (RBAC) with least-privilege principles
• Employee security awareness training
• Background checks for employees with access to personal data
• Incident response plan and breach notification procedures
• Regular security audits and compliance assessments

Compliance Certifications:

• SOC 2 Type II — Independently audited controls for security, availability, and confidentiality
• ISO 27001 — Certified information security management system

For details on our compliance certifications and current security posture, visit our Trust Center at https://bibha-ai.trust.site/.

While we strive to protect your data, no method of transmission or storage is 100% secure. We encourage you to use strong passwords, enable MFA, and report any suspected security incidents to info@bibha.ai.

16. Data Protection Officer

We have appointed a Data Protection Officer (DPO) / Grievance Officer to oversee our data protection practices:

Data Protection Officer / Grievance Officer:
Name: Prashant Kumar
Email: privacy@bibha.ai
Address: Bibha AI Labs Private Limited, Bangalore, Karnataka, India

You may contact our DPO for any questions regarding this Privacy Policy, to exercise your privacy rights, or to file a complaint about our data handling practices.

For EU/EEA data subjects, our EU representative can be reached at dpo@bibha.ai.

17. Policy Updates and Notification

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons.

How we notify you of changes:

• Material changes will be communicated via email to registered users and/or via a prominent notice on our websites at least 30 days before the changes take effect.
• Non-material changes (e.g., formatting, clarifications) may be made without prior notice.
• The “Last Updated” date at the top of this policy will always reflect the most recent revision.

We encourage you to review this Privacy Policy periodically. Continued use of our services after the effective date of any updated policy constitutes your acknowledgment of the changes.

18. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Bibha AI Labs Private Limited
Email: info@bibha.ai
Website: https://bibha.ai
Address: Bangalore, Karnataka, India
Trust Center: https://bibha-ai.trust.site/

For privacy-specific inquiries, please email privacy@bibha.ai or contact our Data Protection Officer (Section 16).

We aim to respond to all inquiries within 30 days.

19. Severability

If any provision of this Privacy Policy is found to be invalid, illegal, or unenforceable by a court of competent jurisdiction, such invalidity, illegality, or unenforceability shall not affect the remaining provisions. The remaining provisions shall continue in full force and effect. The invalid or unenforceable provision shall be modified to the minimum extent necessary to make it valid, legal, and enforceable while preserving its original intent.

20. Related Policies

This Privacy Policy should be read in conjunction with our other legal and policy documents:

• Terms of Use — /terms-of-use — Governs your use of our platforms and services.
• Cookie Policy — /cookie-policy — Details on cookies and tracking technologies.
• Trust Center — https://bibha-ai.trust.site/ — Security certifications, compliance reports, and data handling practices.

In the event of any conflict between this Privacy Policy and the Terms of Use, the Terms of Use shall prevail to the extent of the conflict, except with respect to data protection matters where this Privacy Policy shall take precedence.

Copyright 2026 Bibha AI Labs Private Limited. All rights reserved.