Who we are
Xipp (xipp.ai) is operated by AIX Solutions LLP, B-643 Money Plant High Street, near Ganesh Glory 11, Ahmedabad, Gujarat 382470, India. For job seekers, we are the controller of the information in your Xipp profile. For employers, we process candidate information to provide our recruiting services. You can reach us at info@xipp.ai.
Information we collect
Job seekers
- Account details: your name, phone number, email address and password or sign-in method.
- Profile and CV: work history, education, skills, languages, location, salary expectations, job preferences and the CV files you upload.
- Messages you send to our WhatsApp number, including the documents you share there.
- Identity documents, only if you choose to verify your identity. They are stored encrypted.
- Applications, screening answers and AI interview answers, which may include voice responses.
Employers and recruiters
- Account details: your name, work email, phone number and company details.
- Job posts, shortlists, notes, interview schedules and messages you create in Xipp.
- Billing details. Card and bank payments are handled by our payment providers (Razorpay and Stripe); we do not store full card numbers.
Sign in with Google
- If you sign in with Google, we receive your name, email address and profile picture. We use them only to create your account and sign you in.
Collected automatically
- Device and usage information such as IP address, browser type, pages visited and error reports, which we use to keep Xipp secure and working.
- Cookies and similar technologies for sign-in, remembering your preferences, analytics (Google Tag Manager) and measuring our advertising (Meta Pixel). You can block non-essential cookies in your browser.
Information from other sources
- Employers and recruiters who add, upload or import candidates into Xipp (for example from their own ATS).
- Publicly available professional information and data providers we work with, used only to build professional profiles for recruiting. If we hold such a profile about you, you can ask us to delete it at any time.
How we use your information
- To run your account and provide Xipp: building your profile from your CV, matching job seekers with jobs, and letting employers find, shortlist and contact candidates.
- To communicate with you by WhatsApp, email or phone about your account, applications, interviews and jobs that match you. You can opt out of marketing messages at any time.
- To verify identity and prevent fraud, spam and misuse.
- To process payments and keep billing records.
- To improve, secure and fix Xipp, and to meet our legal obligations.
Our legal bases
Where data protection law asks for a legal basis (for example the GDPR), we rely on:
- Contract: to provide the Xipp account and services you asked for.
- Consent: for optional features such as identity verification, marketing messages and non-essential cookies. You can withdraw consent at any time; this does not affect processing that already happened.
- Legitimate interests: to help employers find suitable candidates, keep Xipp secure and prevent fraud, and improve our services, balanced against your rights.
- Legal obligation: to keep invoices and answer lawful requests.
Under India's Digital Personal Data Protection Act, 2023, we process your data on the basis of your consent or for legitimate uses the Act allows, such as the purpose for which you gave us your data.
AI and automated scoring
Xipp uses AI services, including Google Gemini, to read CVs and documents, suggest matches, prepare scores such as the XIPP Score and run AI interviews. These results help employers decide; they are not the final hiring decision, which is always made by the employer. You can ask us to review or correct any information we hold about you.
Integrations, the Chrome extension and Google user data
Companies can connect Xipp to tools they already use. A connection only accesses what it needs to carry out an action the company or recruiter asks for, and only the account owner can connect or remove one.
How connections work
- Where a tool supports it, Xipp connects through the tool's own approval screen and asks for the narrowest permissions available; otherwise the company provides a key issued by the tool.
- Access tokens and keys are encrypted and permanently deleted when the connection is removed.
- We keep a log of integration activity for up to 180 days and delivery records for up to 30 days, so the company can see what was sent and fix errors.
Recruiting systems, HR systems and CRMs
- Xipp sends a candidate's profile, and their CV where the system accepts files, only when a recruiter chooses to, and only for candidates the company has unlocked.
- Before sending, Xipp may check whether the person already exists in that system to avoid duplicates. It does not copy the company's other records.
Team messaging and notifications
- Xipp posts short hiring updates, such as a new application or a completed interview, to the channel or chat the company picks. It does not read messages, files or member lists there.
Exports and automation
- Companies can export candidate lists as files or send hiring events to an address they set up. Once data reaches a destination the company chose, that company and the destination's terms govern it.
Documents, spreadsheets and file storage
- Xipp can only see and change the documents, sheets, folders and files it creates or that the user explicitly shares with it, never the user's other files.
- Xipp can send email from a user's own mailbox, only when the user asks it to. It asks for send-only permission and cannot read, search, change or delete any message.
Calendars and video meetings
- When a company connects its calendar or video-meeting account, Xipp books the company's live interviews there: it creates, moves and cancels only the interview events it books, with a meeting link, and the invitation goes to the candidate and the interviewer.
- Each event holds the interview's title, time, job and the participants' names and email addresses. Xipp does not read, store or use any of the user's other events or meetings.
- If the connection stops working, the interview is booked on Xipp's own calendar instead and the company is told.
Interview notes and transcripts
- When a note-taking tool is connected, Xipp imports the summary, action items, transcript and recording link of interviews recorded by that account, so they appear on the matching candidate. Meetings not linked to a candidate within 30 days are deleted automatically.
- The company must tell interview participants that a meeting is recorded.
Professional networks and job posting
- A recruiter can connect a personal professional-network account so Xipp can publish the company's jobs on it when they choose. Xipp uses only their name and profile picture to show the connection and does not read their feed, contacts or messages.
Xipp for recruiters (Chrome extension)
- On a supported profile page, the extension sends Xipp only the page's address, to check whether the person is already in the company's Xipp talent pool. It does not read or send page content and does not run on or track other websites.
- The recruiter's sign-in code stays in that browser and can be revoked in Xipp at any time. The extension never shows contact details.
Google user data
- Xipp's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
- From Google we use: your name, email and profile picture to sign you in; only the files and folders Xipp creates in Google Drive and Sheets; permission to send the emails you ask Gmail to send; and only the interview events Xipp books in Google Calendar.
- Google user data is used only to provide these features. It is not sold, not used for advertising, not used to train general-purpose AI or machine-learning models, and not read by people at Xipp except with the user's consent, for security, or where the law requires it.
You can remove any connection at any time under Integrations in Xipp, or revoke Xipp's access in the tool's own account settings.
How long we keep information
We keep your information while your account is active and as long as needed to provide Xipp. When you delete your account or ask us to delete your data, we delete it or make it anonymous, except where we must keep some records by law (for example invoices) or to resolve disputes. Integration activity logs are kept for up to 180 days.
Security
We protect information with encryption in transit (HTTPS/TLS), encryption at rest for sensitive data such as identity documents and connection keys, access controls and monitoring. No system is completely secure, so please keep your sign-in details private and tell us at once if you suspect misuse.
If a security incident puts your data at risk, we will tell you and the relevant authorities as the law requires.
International transfers
Xipp and its service providers may store and process information in India and in other countries. When information from the EU, UK or other regions is transferred, we protect it as the applicable law requires.
Your rights and choices
- Access, correct or update your information, most of it directly in your profile.
- Delete your account and data, or ask us to do so.
- Withdraw consent and opt out of marketing messages at any time.
- Object to or restrict certain processing, and receive a copy of your data, where the law gives you these rights (including the EU and UK GDPR and India's Digital Personal Data Protection Act, 2023).
- Receive your data in a portable format (data portability).
- In India, nominate another person to exercise your rights if you die or become unable to, and escalate an unresolved complaint to the Data Protection Board of India.
- In California, know what we collect, ask us to delete it, and opt out of the "sharing" of personal data for advertising. We do not discriminate against anyone who uses these rights.
- Complain to your local data protection authority.
To use these rights, write to info@xipp.ai. We answer within 30 days. Our grievance officer for India can be reached at the same address.
Children
Xipp is not intended for anyone under 18, and we do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.
Free CV Analyzer and ATS Score Checker
When you use the free CV Analyzer or ATS Score Checker without an account:
- We store the CV you upload and the report we create from it.
- If your CV has an email address that isn't linked to a Xipp account, we add your CV to the candidates employers can search on Xipp. On our EU-language pages we only do this if you tick the box on the upload form. Employers see your contact details only after they unlock them.
- If you later create a Xipp account with that email address, the CV and report become part of your account.
- You can ask us to delete your CV and report at any time through our contact page.
- To limit free checks to one a day, we keep a one-way, salted fingerprint of your IP address - never the address itself.
Uploaded files are stored privately and are never published as a download link.
Changes to this policy
We may update this policy. We will change the date at the top and, for important changes, tell you by email, WhatsApp or a notice in Xipp before they take effect.
Integration Policy
Standards that every partner integration with Xipp must meet. This policy defines how integrations are developed, implemented, tested, monitored, and maintained to ensure data security, performance, privacy compliance, and a superior user experience across all connected systems.
Scope
- This policy applies to all integration points between the Xipp.AI platform and external systems, including but not limited to:
- Applicant Tracking Systems (ATS)
- Human Resource Information Systems (HRIS)
- Job boards and sourcing platforms
- Scheduling and calendar tools
- Background check and assessment tools
- Any third-party service that exchanges candidate or employer data with Xipp.AI
Secure Communication & Authentication
- All integrations must use encrypted communications (HTTPS/TLS).
- Authentication should follow industry standards such as OAuth 2.0 or secure token-based systems to protect API access.
Data Protection & Privacy Compliance
- Data handling must comply with applicable privacy laws, including GDPR, CCPA, and other relevant regional data protection regulations.
- Personal data must be encrypted both in transit and at rest.
- Integrations must support processes for data subject rights, including access, correction, and deletion upon request.
Development requirements
- Partners must provide up-to-date API documentation that details endpoints, data models, authentication schemes, rate limits, and error handling.
Ethical use and transparency
- AI-driven decisions that affect candidate outcomes should be transparent and explainable.
- Xipp.AI encourages integrations that allow for human review and override of automated recommendations to promote fairness and accountability.
Suspension and termination
- Xipp.AI reserves the right to suspend or terminate any integration if it:
- Violates this policy or security standards
- Harms system performance or data integrity
- Fails to comply with regulatory or contractual obligations
Affected stakeholders will be given notice where feasible and opportunities to remediate issues before termination.
Support and Contact
Questions about this policy, your data or an integration? Write to our privacy and integration team at
info@xipp.ai