Privacy Policy

the Orcred Website and Platform;

Candidate registration and verification applications;

project submissions and related technical materials;

technical verification and review Sessions;

Reviewer registration and engagement;

communications with Orcred;

payment and transaction processes;

credential issuance and verification services; and

other interactions with Orcred through its Platform, systems or services.

name;

email address;

mobile number;

educational and professional information;

college, institution or organisation details;

graduation year and related professional information;

LinkedIn profile or other professional profile information voluntarily provided by you;

information contained in your project submission;

GitHub repositories, source code, project documentation, project walkthroughs and related technical materials;

explanations regarding technical decisions, challenges and implementation;

declarations regarding the use of artificial intelligence tools in your project;

a government-issued photo identification document shown to the Reviewer on camera at the start of a Session for identity verification. Orcred does not store a copy of the document, but it will usually be visible in the Session recording;

information provided during the technical verification Session;

assessment responses, scores, observations and evaluation-related information;

Session recordings, containing the Candidate’s video, anything the Candidate shares on screen, and the voices of the Candidate and the Reviewer (Reviewers keep their camera off);

communications and correspondence with Orcred, including help requests and contact-form messages;

payment and transaction information, to the extent available to Orcred through its payment service providers. For bank transfers, Orcred stores the transaction reference (UTR) and any screenshot you choose to upload. Card and bank account details are handled by the payment service provider and are not stored by Orcred;

a record of your agreement to the Terms of Use and this Privacy Policy, of your confirmation that you are 18 or older, and of your consent when you submit an application, including the time, IP address and policy version; and

such other information reasonably necessary to provide and administer the Services.

name and contact details;

educational qualifications and professional experience;

employment and professional history;

technical expertise, skills and certifications;

professional profiles and information voluntarily provided by you;

government-issued identification information, where required;

PAN and tax-related information;

bank account and payment details required for processing professional fees;

information relating to your performance as a Reviewer;

assessment reports, scores, reviewer notes and quality metrics;

Session recordings and related information;

communications with Orcred; and

information required for contractual, tax, accounting, compliance and payment purposes.

IP address;

browser type and version;

device type and operating system;

date and time of access;

pages or features accessed;

referring or exit pages;

approximate location derived from technical information, where applicable;

log and diagnostic information; and

information relating to your interaction with the Platform.

Orcred may receive project repositories, source code, technical documentation, project walkthroughs, software architecture information and other materials submitted by Candidates for the purpose of technical verification.

Such materials may contain personal data and may also constitute intellectual property belonging to the Candidate or other third parties.

Orcred processes such materials solely for purposes connected with the verification and assessment Services, including enabling Reviewers to examine the Candidate's work before and during a Session, conducting the assessment, maintaining assessment records, quality assurance and resolving disputes.

Orcred does not acquire ownership of a Candidate's project, source code or other underlying intellectual property merely because such materials are submitted through the Platform.

Candidates should ensure that they do not submit personal data belonging to another person or confidential third-party information unless they are legally entitled to do so.

quality assurance;

assessment integrity;

reviewer performance monitoring;

dispute resolution;

investigation of suspected fraud or misconduct;

compliance and audit purposes; and

improvement of Orcred's assessment processes.

creating and administering user accounts;

processing verification applications;

facilitating technical verification Sessions;

assigning and coordinating Reviewers;

reviewing and evaluating project submissions;

verifying Candidate identity;

generating assessment scores and evaluation reports;

issuing, maintaining and verifying Orcred Credentials;

maintaining publicly verifiable credential pages where applicable;

processing payments, refunds and professional fee payments;

communicating with Candidates and Reviewers;

sending follow-up emails 30, 60 and 90 days after a Credential is issued, asking how the Credential has been received;

providing customer and technical support;

monitoring Sessions and maintaining assessment integrity;

detecting fraud, abuse, manipulation or other misuse of the Platform;

conducting quality assurance and audits;

improving the Platform, Services, assessment methodologies and user experience;

conducting internal analytics and business operations;

complying with applicable legal, tax, accounting and regulatory obligations;

protecting the rights, property, security and legitimate interests of Orcred, its users and other persons; and

such other purposes as may be notified to you at the time of collection or otherwise permitted under Applicable Law.

Where a Candidate successfully completes the applicable verification process and receives an Orcred Credential, Orcred may maintain a publicly accessible credential or verification page.

Such page may contain information such as:

Candidate name or name as provided for credential verification;

project name;

Orcred Score and its breakdown by assessment dimension;

credential status;

the date the Credential was issued; and

a unique credential or verification identifier.

The purpose of making such information publicly verifiable is to enable employers, recruiters, institutions and other third parties to verify the authenticity and status of an Orcred Credential.

Orcred shall not intentionally publish a Candidate's private contact information, government identification details or payment information as part of a publicly verifiable Credential.

Orcred processes personal data in accordance with the Digital Personal Data Protection Act, 2023, the applicable provisions of the Digital Personal Data Protection Rules, 2025, and other Applicable Laws relating to privacy and data protection.

Where consent is required under Applicable Law, Orcred shall seek consent in an appropriate manner and provide information regarding the personal data being collected and the purposes for which it is processed.

Where processing is necessary for purposes permitted by Applicable Law without separate consent, Orcred may process personal data for such purposes in accordance with the applicable legal requirements.

Where processing is based on consent, you may withdraw your consent subject to Applicable Law and the consequences of such withdrawal. Withdrawal of consent may affect Orcred's ability to provide certain Services where such processing is necessary for providing the relevant Service.

Orcred may share personal data only where reasonably necessary for the purposes described in this Privacy Policy or where otherwise permitted or required by Applicable Law.

Personal data may be shared with:

Reviewers: only the Candidate’s name and project materials are made available to the Reviewer assigned to the Session. Reviewers are not shown the Candidate’s college, marks or other background information;

Service Providers: the service providers listed in Section 10, who provide hosting, database, email, video-conferencing and other services needed to operate the Platform;

Payment Service Providers: Razorpay, when payments are enabled on the Platform, for processing verification fees, refunds and related transactions;

Professional and Compliance Advisers: lawyers, accountants, auditors, consultants and other professional advisers where reasonably required;

Governmental or Regulatory Authorities: where disclosure is required by law, court order, regulatory requirement or lawful governmental request;

Business Transfers: prospective or actual acquirers, investors, successors or affiliates in connection with a merger, acquisition, restructuring, financing, sale of assets or similar corporate transaction; and

Other Persons: where you have specifically authorised or requested Orcred to disclose such information.

Orcred shall seek to ensure that third-party service providers receiving personal data process such data only for authorised purposes and maintain appropriate safeguards, subject to their contractual and legal obligations.

Orcred stores and processes personal data using appropriate technology infrastructure and service providers.

Orcred’s database and application servers are hosted in the Mumbai region, India. The database is hosted through Supabase (ap-south-1).

Depending on the services used by Orcred, certain information may also be processed by third-party service providers operating infrastructure outside India. The following service providers may process personal data in the United States: Cloudflare (website delivery, security and counting visits), Resend, through Amazon SES (email delivery), Daily (live video Sessions and recording), Google Workspace (Orcred’s email, including notification emails containing account and application details) and Loom (project walkthrough videos). Where personal data is transferred or processed outside India, Orcred shall do so in accordance with Applicable Law and applicable restrictions relating to cross-border transfers.

Orcred takes reasonable technical, organisational and administrative measures to protect personal data against unauthorised access, disclosure, alteration, loss, misuse or destruction.

Such measures may include, as appropriate:

access controls and authentication mechanisms;

role-based access to personal data;

encryption or other security measures where appropriate;

secure hosting infrastructure;

monitoring and logging;

access restrictions for Session recordings and Candidate information;

contractual confidentiality obligations; and

security and incident response procedures.

However, no electronic transmission, storage system or internet-based service can be guaranteed to be completely secure. Accordingly, Orcred cannot guarantee absolute security of personal data.

Orcred shall retain personal data only for as long as reasonably necessary for the purposes for which it was collected or as required or permitted by Applicable Law.

The applicable retention period may depend upon the nature of the information and the purpose for which it is processed.

For example:

Session recordings are ordinarily retained for 90 days, subject to the exceptions described in this Privacy Policy and information relating to applications that do not result in a Credential may be retained for up to 2 years;

Transaction and payment records may be retained for periods required under applicable tax, accounting, financial and legal requirements;

Credential and verification records may be retained for as long as reasonably necessary to maintain the authenticity, integrity and verification of credentials issued by Orcred;

Account and support information may be retained for as long as reasonably necessary to administer the relevant relationship and address disputes or legal requirements; and

information may be retained for a longer period where required for legal proceedings, regulatory compliance, fraud prevention, security investigations or enforcement of contractual rights.

When personal data is no longer required, Orcred shall take reasonable steps to delete, anonymise or otherwise dispose of it in accordance with Applicable Law.

If you delete your account, your account information is anonymised and your Session recordings are deleted. Any Credential issued to you remains publicly verifiable unless you choose to remove it. Payment records, including the payer’s name and email address, are retained for the period required under tax and accounting laws.

Orcred uses only the cookies and browser storage needed for the Platform to work, such as a sign-in cookie on the dashboard and a draft of your application form kept in your browser. Orcred does not use tracking or advertising cookies or pixels. Orcred counts visits to its pages with Cloudflare Web Analytics, which sets no cookies and does not identify you. The full list is in the Cookie Policy.

Where required, Orcred shall provide appropriate notices or consent mechanisms in relation to non-essential cookies and similar technologies.

You may manage or disable cookies through your browser settings. Disabling certain cookies may affect the availability or functionality of parts of the Platform.

The Platform may contain links to or integrations with third-party websites, applications or services.

Such third parties may independently collect and process personal data in accordance with their own privacy policies. Orcred does not control the privacy practices of such third parties and shall not be responsible for their independent processing of personal data.

You should review the privacy policies of third-party services before providing personal data to them.

Subject to Applicable Law and any applicable conditions or limitations, individuals may have rights in relation to their personal data, including the right to:

obtain information regarding the processing of their personal data;

request access to personal data processed by Orcred;

request correction or updating of inaccurate or incomplete personal data;

request deletion of personal data where permitted under Applicable Law;

withdraw consent where processing is based on consent;

nominate another individual to exercise applicable rights in accordance with Applicable Law; and

raise a grievance regarding the processing of personal data.

Requests may be submitted using the contact details provided in this Privacy Policy.

Orcred may take reasonable steps to verify the identity of the person making a request before processing the request, particularly where the request concerns sensitive account or personal information.

You can download a copy of your data, change your email address and delete your account yourself from your profile on the Platform.

Where Orcred processes personal data on the basis of your consent, you may withdraw such consent by contacting Orcred through the designated communication channel or through any mechanism made available by Orcred for this purpose.

Withdrawal of consent shall not affect the lawfulness of processing carried out before such withdrawal.

Where withdrawal prevents Orcred from providing a Service that requires the relevant personal data, Orcred may be unable to continue providing that Service or may need to restrict certain Platform functionality.

identify and contain the incident;

assess its potential impact;

take appropriate remedial and security measures;

maintain relevant records; and

provide notifications to affected individuals, regulatory authorities or other persons where required by Applicable Law.

The Platform is intended for individuals who are 18 years of age or older.

Orcred does not knowingly seek to collect personal data from persons below 18 years of age for participation in its verification Services.

If Orcred becomes aware that personal data belonging to an individual below the applicable age has been collected contrary to Applicable Law, Orcred shall take reasonable steps to delete such information, subject to any legal obligations requiring its retention.

You are responsible for ensuring that the personal data and other information provided to Orcred is accurate, complete and up to date.

You should promptly notify Orcred of any material changes to your information where such information is relevant to your account, verification process, payment, credential or contractual relationship with Orcred.

Orcred shall not be responsible for consequences arising from inaccurate, incomplete or misleading information voluntarily provided by you.

Where an individual participates as an Orcred Reviewer, Orcred may process additional personal data relating to the Reviewer's professional engagement, including session assignments, assessment quality, performance metrics, reviewer feedback, compliance records and payment information.

Reviewer information may be processed for purposes including:

onboarding and verification;

assigning and administering review Sessions;

processing professional fee payments;

tax and accounting compliance;

quality assurance and calibration;

monitoring compliance with Reviewer obligations;

fraud prevention and assessment integrity;

maintaining Platform security; and

administering the contractual relationship between Orcred and the Reviewer.

Reviewers are required to comply with Orcred's confidentiality, data protection and information security requirements while accessing Candidate information.

Candidates shall take reasonable care when submitting information through the Platform.

Candidates shall not submit:

personal data of another person without appropriate authority;

confidential information belonging to a third party without lawful permission;

government identification documents or other information beyond what is reasonably required for verification;

malicious software or content; or

information that they are prohibited from disclosing under any contractual, legal or professional obligation.

Candidates remain responsible for the lawfulness of information and materials submitted by them to Orcred.

Orcred may update or modify this Privacy Policy from time to time to reflect changes in:

the Platform or Services;

data processing practices;

technology and security measures;

Applicable Law or regulatory requirements; or

business operations.

The updated Privacy Policy shall be posted on the Platform with the revised “Last Updated” date.

Where required by Applicable Law, Orcred shall provide additional notice or obtain consent before implementing material changes to the manner in which personal data is processed.

If you have any question, concern, request or grievance regarding the collection or processing of your personal data, you may contact Orcred at:

For privacy-related requests, you should provide sufficient information to enable Orcred to identify the relevant account, transaction or data processing activity.

Orcred shall endeavour to address privacy-related requests and grievances within the timelines prescribed under Applicable Law.

This Privacy Policy shall be governed by and construed in accordance with the laws of India.

Any dispute arising in connection with this Privacy Policy shall be dealt with in accordance with the dispute resolution and jurisdiction provisions contained in Orcred's Terms of Use, subject to Applicable Law.