Privacy Notice

Last updated: 25 October 2026

This notice explains what personal data HeadhuntCFO (“we”, “us”) collects about you, why, how long we keep it, and the rights you have over it. It is written to meet our obligations under India’s Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.

For that data, HeadhuntCFO is the Data Fiduciary and you are the Data Principal. If anything here is unclear, or you think we have got something wrong, please write to reachus@headhuntcfo.com — we would rather hear from you than not.

1. What we collect, and exactly why

We collect only what the service needs. Each row states the specific purpose, what permits us to process it, and how long we keep it.

DataPurposeWhy we may process itRetention
Name, email address, phone number, and optionally company and account typeCreating and operating your account, signing you in, and contacting you about the serviceConsent, given at sign-upWhile your account is open, then up to 90 days after closure
How you found us when you signed up: the first page you landed on, the website that linked you here, and any campaign tags in that link (kept in your browser until you sign up, then saved with your account)Understanding which pages and channels bring sign-ups, so we can improve the siteConsent, given at sign-upSame as account data
Password (stored only as a salted hash — never in readable form)Authenticating you securelyConsentSame as account data
Plan, trial end date, subscription status, and payment confirmationsGiving you the access you have paid for, and issuing receiptsPerformance of our contract with you; statutory accounting duties8 years, as required by Indian tax and company law
Which companies you searched or unlocked, and quota usedEnforcing plan limits and showing you your own historyPerformance of our contract with youWhile your account is open
Hiring and contact enquiries: your name, designation, work email, phone, company and location, plus the page you contacted us fromResponding to your enquiry and, if you engage us, running your CFO searchConsent, given when you submit the formUp to 24 months from your last contact with us, or until you ask us to delete it
Email engagement state (which onboarding emails you have been sent, opt-out flag)Sending the onboarding sequence and honouring unsubscribesConsent, withdrawable via any email’s unsubscribe linkWhile your account is open; opt-out flag kept as long as needed to respect it
Session cookie, IP address, browser and device type, and server logsKeeping you signed in, and detecting abuse, fraud and security incidentsNecessary to provide a service you have requested; our legitimate security interestSession cookie 7 days; security logs up to 180 days
Google Analytics identifiers and page-view data (_ga cookies)Understanding which pages are useful so we can improve themNotice on your first visit; you can switch it off at any time in Cookie preferences14 months in Google Analytics; deleted from your browser if you switch it off

We do not sell your personal data, and we do not use it to build advertising profiles. We never see your full card or UPI details — those go directly to our payment provider.

2. Cookies, and your control over them

One strictly-necessary cookie. A session cookie keeps you signed in. It is HTTP-only, secure, expires after 7 days, and carries no tracking. Without it you cannot log in, so it is set whenever you use an account.

Analytics cookies. We use Google Analytics to understand how the site is used — which pages are visited and which buttons are clicked — so we can improve it. It runs for all visitors, with IP anonymisation on and Google’s advertising features off, and we never use it to build advertising profiles. You can switch it off at any time: we then stop loading it on that browser, delete its _ga cookies and remember your choice.

Switch analytics off (or back on) at any time: Cookie preferences. Switching it off changes nothing else about how the site works for you.

3. Your rights as a Data Principal

Under the DPDP Act you have the right to:

  • Access — a summary of the personal data we hold about you and how it is processed.
  • Correction and completion — have inaccurate or incomplete data put right.
  • Erasure — have your data deleted, unless a law requires us to keep it (invoices, for example, must be retained for tax purposes). You can do this yourself, immediately, from your profile page — see section 9.
  • Withdraw consent — at any time, as easily as you gave it. We stop the processing that relied on it.
  • Nominate — name another person to exercise your rights if you die or become incapable of acting.
  • Grievance redressal — complain to us and get an answer (section 5).

To exercise any of these, email reachus@headhuntcfo.com from the address on your account and tell us which right you are exercising. We may need to verify who you are before acting, to protect you. We respond within 90 days, and usually far sooner. There is no charge.

You do not have to ask us to delete your account — you can do it yourself at any time from your profile page. Section 9 sets out exactly what that removes and what it does not.

4. Who else handles your data

We share data only with providers who help us run the service, under contract and only for the purposes below. Some are outside India — the DPDP Act permits this except to countries the Central Government restricts.

ProviderWhat they do for usProcessing location
HostingerHosting and the database holding your accountEuropean Union
Dodo PaymentsTaking payment and issuing invoicesAs per their terms
ResendSending verification, onboarding and transactional emailUnited States
Google AnalyticsWebsite analytics (on by default; you can switch it off)United States
Google (Gemini)Reading and summarising public company filings for CFO profilesUnited States

We may also disclose data where the law requires it. We will tell you unless we are forbidden from doing so.

5. Grievance Officer

If you are unhappy with how we have handled your data or your request, contact our Grievance Officer. This is the route the DPDP Act requires us to provide.

If we do not resolve it to your satisfaction, you may complain to the Data Protection Board of India.

6. Children

HeadhuntCFO is a professional tool intended for people aged 18 and over, and we do not knowingly collect data about children. We do not track children, profile them, or show them targeted advertising. If you believe a child has created an account, tell us at reachus@headhuntcfo.com and we will delete it.

7. If something goes wrong

We keep reasonable security safeguards — encryption in transit, hashed passwords, access controls, and nightly encrypted backups. No system is perfectly secure.

If a personal data breach affects you, we will notify you and the Data Protection Board of India within 72 hours of becoming aware, as the DPDP Rules require, describing what happened, the likely consequences, and what we are doing about it.

8. CFO profiles: data about executives, not about you

Separately from your account, HeadhuntCFO publishes profiles of the chief financial officers of Indian listed companies. These are compiled from publicly available sources — company annual reports and stock-exchange filings — and summarised with AI. They cover people in their professional capacity, for legitimate recruitment and research purposes, and contain no personal contact details beyond what those companies have themselves published.

If you are a CFO featured on HeadhuntCFO and want to see what we hold, correct an error, or ask us to remove your profile, email reachus@headhuntcfo.com and we will deal with it under the same rights and timelines set out in section 3.

9. Deleting your account: exactly what happens

You can delete your account yourself from your profile page. It takes effect immediately and cannot be undone. We ask for your password to confirm, because a signed-in session alone should not be enough to destroy an account.

Deleted permanently

  • Your name, email address, phone number and company
  • Your password
  • Your plan, trial dates and subscription history held by us
  • The record of which companies you searched or unlocked, and your quota usage
  • Your email preferences and onboarding-email state
  • Any enquiry you submitted using the same email address
  • Every session, so you are signed out on all devices

Kept, and why

  • CFO dossiers you unlocked stay in our research library. These describe company executives and are compiled from public annual reports and stock-exchange filings — they are information about those executives, not personal data about you. Keeping them means the next person researching the same CFO is served from our library instead of us paying to rebuild it. Once your account is deleted, nothing in those records links back to you, because the record of what you unlocked is held in your account and is deleted with it.
  • Invoices held by our payment provider, which we do not control, are retained for the period Indian tax and company law requires.

If you would rather we handled the deletion, or you want confirmation in writing, email reachus@headhuntcfo.com instead.

10. Changes to this notice

If we change what we collect or why, we will update this notice and, where consent is involved, ask you again. The “last updated” date above always reflects the current version. Questions: reachus@headhuntcfo.com.

Terms & Conditions · Privacy Notice · Refund & Cancellation Policy · Contact us