Privacy policy

Who we are

CapSight is made and run by HireSense.ai Private Limited, registered at 764/E, 19th Main, 22nd Cross Road, Sector 2, HSR Layout, Bengaluru, Karnataka 560102. For anything about your privacy, write to capsight@hiresense.ai.

What we collect

When you have an account, and when you only visit the public pages, CapSight handles the following.

• Account details: your name and work email address, the organisation you belong to and your role in it. Your password is never stored; only a one-way digest of it is.
• A session cookie that keeps you signed in. It is needed for sign-in to work, it can only be read by our servers and it is sent only over a secure connection. (If sign-in with Google or Microsoft is ever switched on, that sign-in also sets one more short-lived cookie while it runs.) Product analytics sets no cookie: it keeps its identifier in your browser's local storage, as described under Product analytics below. If you accept analytics on the public pages, Google Analytics sets two first-party cookies (named _ga and _ga_ followed by a code) to tell visits apart; we remove them if you withdraw. Microsoft Clarity, which runs on the public pages after an accept and inside the signed-in app, may set two first-party cookies (named _clck and _clsk); we remove them if you withdraw on the public pages or when Clarity is not permitted. The product has no advertising cookies.
• The questions you ask Ask CapSight and the answers, and technical details of each call (which model answered, how much text it processed and what it cost), kept so that we can apply usage limits and check the answers.
• The words you type into the contacts directory's search by meaning. This search is processed on a service hosted outside India, in the United States, where the words are read by an AI model.
• Payments for report credits are made through a payment processor. We receive the order and payment identifiers, the amount, the currency and the status. We do not receive or store your card, UPI or bank details.
• Transactional emails (for example verifying your address or resetting a password) are sent through an email delivery provider, which receives your email address for that purpose.
• When the product fails, technical details (what failed, on which page, in which browser) are sent to an error-tracking service so we can fix it. They normally do not include your account details, cookies or what you typed.
• Standard server logs: your IP address, the page requested and the time. The product also uses your IP address and email address to limit repeated sign-in attempts.
• Each sign-in session keeps the approximate network it came from (the first part of the IP address, not the whole address) and the browser and device type. You can see your sessions in Settings, and each is removed when the session ends or expires.
• For requests made while you are signed in, the access log also records your account ID and your organisation's ID, which are pseudonymous identifiers rather than your name or email address, for up to 90 days.
• Each sign-in, and each failed sign-in to an existing account, is recorded with the time, the browser and device type, and the approximate network. The administrator of your organisation can see this sign-in activity for its members, and how many sessions each member has open, but not your full IP address.
• If you turn on two-step sign-in, we keep your authenticator secret encrypted and your recovery codes only as one-way keyed digests. They are deleted when you turn two-step sign-in off, when it is reset for you, or with your account. If you ask us to remember a browser, it is remembered for 30 days.
• We email your own address about security events on your account: a sign-in from a new browser or network, a lock after repeated failed sign-ins, and changes to two-step sign-in.
• If you book a demo, the booking page is provided by a scheduling service and receives what you enter there.
• Your searches in the contacts directory and the hiring-demand views are run on a search service hosted in India.
• Company logos shown in the product are loaded in your browser from a logo service, which receives your IP address and the name of our site when it serves them.

People in the contacts directory

CapSight's contacts directory holds professional profile information so that signed-in business customers can search for people relevant to GCC talent and hiring work (for example name, current or recent role and employer, location, and other career or skills information shown in the product). We obtain this information from (i) publicly available professional sources and (ii) third-party data providers that are authorised to supply such information for business use. We do not ask individuals to create a CapSight account in order to appear in the directory.

We process this information under India's Digital Personal Data Protection Act, 2023. Information that a person has made publicly available themselves is used as that Act permits for publicly available personal data. Information from data providers is used on the basis of the consent or other lawful ground under which the provider supplies it for business use, and we require providers to hold one.

An organisation can save people to its own lists and, where that is switched on, spend credits to unlock a person's email address or phone number. If you are listed and want your record removed, write to capsight@hiresense.ai. A removal is applied everywhere that person could appear: search and its counts, their profile, similar people and saved lists.

AI features

Ask CapSight, and the other AI features in the product, work by sending text to AI model services run by third parties. Those services process the text on their own servers, which may be outside India.

We send only what is needed to produce the answer. It is sent over an encrypted connection, and we use providers whose terms are suited to business use. We keep the questions you ask and the answers ourselves for the period under How long we keep it.

Product analytics

Product analytics is part of the CapSight service. While you are signed in we record how the app is used (clicks, scrolling and masked session recordings, in which the text on the screen and anything you type is hidden) and link it to your account ID, an internal identifier that contains neither your name nor your email address, and to the ID of your organisation. The ID is a pseudonym, not an anonymous number: we can link it back to you. We do not send your name, your email address or your organisation's name to our analytics provider.

You cannot switch product analytics off while you are signed in, because it is part of the service. We tell you about it when you first sign in and again whenever this notice changes, and we keep a record of which version of the notice you acknowledged and when.

On our public pages, analytics runs only if you accept it, and you can change that choice at any time under Cookie settings in the footer. If you accept, we count visits and clicks and record masked sessions without knowing who you are: the page path with identifiers masked, our named events, the labels of the controls you click, your browser, device and screen type, how far you scroll, and a random identifier. We do not collect the text of the pages, what you type or query strings, and nothing is collected on the sign-in, password, print, share-card or admin screens.

Analytics keeps its identifier in your browser's storage (local storage), not in a cookie. It is removed when you sign out, and when you decline or withdraw on the public pages. Our analytics provider processes this data for us on servers in the United States, and its project is set to discard IP addresses.

On the public pages, if you accept analytics, we also use Google Analytics to count visits. It receives the address of the page you view (including any query string), how you arrived, your browser, device and approximate location, and a random identifier kept in its cookies. We switch off its advertising features: no Google signals and no advertising personalisation. It is not loaded on the sign-in, password, print, share-card or admin screens or inside the signed-in app, and declining or withdrawing under Cookie settings in the footer stops it.

We also use Microsoft Clarity for session recordings and heatmaps on the public pages (after you accept analytics) and inside the signed-in app (after you acknowledge the analytics notice), on the same pages as product analytics and never on the sign-in, password, print, share-card or admin screens. It receives clicks, scrolling and a masked view of the page; inside the app it is linked to your account ID only. Declining or withdrawing under Cookie settings in the footer stops it on the public pages; you cannot switch it off while you are signed in, because it is part of the same analytics that is part of the service.

If you ask us to delete your personal data, we also delete the analytics data linked to your account ID.

The Request access form

The Request access form is protected against automated misuse by Cloudflare Turnstile, a spam-protection service. It loads only when you open the form, never on a page view. To decide whether you are a person, Cloudflare receives your IP address and signals from your browser.

Why we use it

To run your account, show you the product, take and record payments, send the emails above, keep the service secure and within its limits, understand how the product is used so that we can improve it, answer your questions to us, and fix what breaks.

Who handles it for us

To run CapSight we use these kinds of provider: a payment processor, an email delivery provider, a cloud hosting provider, an AI model provider (Ask CapSight, the other AI features and the contacts search by meaning), a search service, hosted in the United States, that processes the words typed into the contacts search by meaning, a search service hosted in India for the contacts directory and the hiring-demand views, a product analytics provider, a web analytics service (Google Analytics, only if you accept analytics on the public pages), a session-recording service (Microsoft Clarity, on the public pages after an accept and inside the signed-in app), an error-tracking service, a scheduling service (booking a demo), a spam-protection service (only when you open the Request access form) and a logo service.

We do not sell personal data, and we do not use it to show advertising.

How long we keep it

We keep personal data for these periods:

• Payment records: kept for at least 8 years, as required by Indian tax law.
• Server logs: kept for up to 90 days.
• Product analytics: events are kept for 12 months and masked session recordings for 30 days.
• Accounts: kept while your organisation uses CapSight. When an account is closed it is disabled at once. You can ask us to delete your personal data by writing to capsight@hiresense.ai; we delete or anonymise it within 90 days, except records we must keep by law, such as payment and tax records for 8 years. This includes the analytics data linked to your account ID.
• People removed from the contacts directory: no longer shown anywhere in CapSight. We keep an identifier, and a one-way fingerprint of their public profile link, on a do-not-add list so that they are not added back.
• Questions to Ask CapSight and the answers: deleted after 90 days.
• Accounts that never verified their email address: deleted after 30 days.
• IP addresses in sign-in audit records: removed after 548 days (18 months). The browser and device type in those records are kept with the record; the record of the sign-in itself is kept as part of our audit trail and is anonymised if your account is erased.
• Report files: removed after 90 days by default. The content of a report you delete: removed after 90 days by default.
• Issue reports: deleted after 365 days.
• Expired sign-in sessions: cleared every night.
• Database backups are kept for up to 42 days (35 days, and a deleted copy can linger for 7 more), so data deleted at a person's request can remain in a backup for up to 42 days and is then removed.

Your choices and rights

You can ask us for access to the personal data we hold about you, to correct it, or to delete it, and you can withdraw a consent you have given (for example for analytics on the public pages). Write to capsight@hiresense.ai.

If you have a complaint about how we handle your personal data, write to our grievance officer, Aaron George Abraham, at aaron@hiresense.ai. We acknowledge a complaint within 48 hours and resolve it within 30 days.

How we protect it

Passwords are stored as one-way digests. The session cookie is secure, host-only and cannot be read by scripts. Your organisation's own data (its reports, saved lists, questions and credits) is limited to its signed-in members. Live Signals and the public pages are open to everyone.

Changes to this page

This version takes effect on 27 October 2026, the day CapSight goes live. When it changes, we will say so on this page and tell the administrator of each organisation.