Privacy Notice
Last updated: 25 October 2026
This notice explains what personal data HeadhuntCFO (“we”, “us”) collects about you, why, how long we keep it, and the rights you have over it. It is written to meet our obligations under India’s Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.
For that data, HeadhuntCFO is the Data Fiduciary and you are the Data Principal. If anything here is unclear, or you think we have got something wrong, please write to reachus@headhuntcfo.com — we would rather hear from you than not.
1. What we collect, and exactly why
We collect only what the service needs. Each row states the specific purpose, what permits us to process it, and how long we keep it.
| Data | Purpose | Why we may process it | Retention |
|---|---|---|---|
| Name, email address, phone number, and optionally company and account type | Creating and operating your account, signing you in, and contacting you about the service | Consent, given at sign-up | While your account is open, then up to 90 days after closure |
| How you found us when you signed up: the first page you landed on, the website that linked you here, and any campaign tags in that link (kept in your browser until you sign up, then saved with your account) | Understanding which pages and channels bring sign-ups, so we can improve the site | Consent, given at sign-up | Same as account data |
| Password (stored only as a salted hash — never in readable form) | Authenticating you securely | Consent | Same as account data |
| Plan, trial end date, subscription status, and payment confirmations | Giving you the access you have paid for, and issuing receipts | Performance of our contract with you; statutory accounting duties | 8 years, as required by Indian tax and company law |
| Which companies you searched or unlocked, and quota used | Enforcing plan limits and showing you your own history | Performance of our contract with you | While your account is open |
| Hiring and contact enquiries: your name, designation, work email, phone, company and location, plus the page you contacted us from | Responding to your enquiry and, if you engage us, running your CFO search | Consent, given when you submit the form | Up to 24 months from your last contact with us, or until you ask us to delete it |
| Email engagement state (which onboarding emails you have been sent, opt-out flag) | Sending the onboarding sequence and honouring unsubscribes | Consent, withdrawable via any email’s unsubscribe link | While your account is open; opt-out flag kept as long as needed to respect it |
| Session cookie, IP address, browser and device type, and server logs | Keeping you signed in, and detecting abuse, fraud and security incidents | Necessary to provide a service you have requested; our legitimate security interest | Session cookie 7 days; security logs up to 180 days |
Google Analytics identifiers and page-view data (_ga cookies) | Understanding which pages are useful so we can improve them | Notice on your first visit; you can switch it off at any time in Cookie preferences | 14 months in Google Analytics; deleted from your browser if you switch it off |
We do not sell your personal data, and we do not use it to build advertising profiles. We never see your full card or UPI details — those go directly to our payment provider.
2. Cookies, and your control over them
One strictly-necessary cookie. A session cookie keeps you signed in. It is HTTP-only, secure, expires after 7 days, and carries no tracking. Without it you cannot log in, so it is set whenever you use an account.
Analytics cookies. We use Google Analytics to understand how the site is used — which pages are visited and which buttons are clicked — so we can improve it. It runs for all visitors, with IP anonymisation on and Google’s advertising features off, and we never use it to build advertising profiles. You can switch it off at any time: we then stop loading it on that browser, delete its _ga cookies and remember your choice.
Switch analytics off (or back on) at any time: Cookie preferences. Switching it off changes nothing else about how the site works for you.
3. Your rights as a Data Principal
Under the DPDP Act you have the right to:
- Access — a summary of the personal data we hold about you and how it is processed.
- Correction and completion — have inaccurate or incomplete data put right.
- Erasure — have your data deleted, unless a law requires us to keep it (invoices, for example, must be retained for tax purposes). You can do this yourself, immediately, from your profile page — see section 9.
- Withdraw consent — at any time, as easily as you gave it. We stop the processing that relied on it.
- Nominate — name another person to exercise your rights if you die or become incapable of acting.
- Grievance redressal — complain to us and get an answer (section 5).
To exercise any of these, email reachus@headhuntcfo.com from the address on your account and tell us which right you are exercising. We may need to verify who you are before acting, to protect you. We respond within 90 days, and usually far sooner. There is no charge.
You do not have to ask us to delete your account — you can do it yourself at any time from your profile page. Section 9 sets out exactly what that removes and what it does not.
4. Who else handles your data
We share data only with providers who help us run the service, under contract and only for the purposes below. Some are outside India — the DPDP Act permits this except to countries the Central Government restricts.
| Provider | What they do for us | Processing location |
|---|---|---|
| Hostinger | Hosting and the database holding your account | European Union |
| Dodo Payments | Taking payment and issuing invoices | As per their terms |
| Resend | Sending verification, onboarding and transactional email | United States |
| Google Analytics | Website analytics (on by default; you can switch it off) | United States |
| Google (Gemini) | Reading and summarising public company filings for CFO profiles | United States |
We may also disclose data where the law requires it. We will tell you unless we are forbidden from doing so.
5. Grievance Officer
If you are unhappy with how we have handled your data or your request, contact our Grievance Officer. This is the route the DPDP Act requires us to provide.
If we do not resolve it to your satisfaction, you may complain to the Data Protection Board of India.
6. Children
HeadhuntCFO is a professional tool intended for people aged 18 and over, and we do not knowingly collect data about children. We do not track children, profile them, or show them targeted advertising. If you believe a child has created an account, tell us at reachus@headhuntcfo.com and we will delete it.
7. If something goes wrong
We keep reasonable security safeguards — encryption in transit, hashed passwords, access controls, and nightly encrypted backups. No system is perfectly secure.
If a personal data breach affects you, we will notify you and the Data Protection Board of India within 72 hours of becoming aware, as the DPDP Rules require, describing what happened, the likely consequences, and what we are doing about it.
8. CFO profiles: data about executives, not about you
Separately from your account, HeadhuntCFO publishes profiles of the chief financial officers of Indian listed companies. These are compiled from publicly available sources — company annual reports and stock-exchange filings — and summarised with AI. They cover people in their professional capacity, for legitimate recruitment and research purposes, and contain no personal contact details beyond what those companies have themselves published.
If you are a CFO featured on HeadhuntCFO and want to see what we hold, correct an error, or ask us to remove your profile, email reachus@headhuntcfo.com and we will deal with it under the same rights and timelines set out in section 3.
9. Deleting your account: exactly what happens
You can delete your account yourself from your profile page. It takes effect immediately and cannot be undone. We ask for your password to confirm, because a signed-in session alone should not be enough to destroy an account.
Deleted permanently
- Your name, email address, phone number and company
- Your password
- Your plan, trial dates and subscription history held by us
- The record of which companies you searched or unlocked, and your quota usage
- Your email preferences and onboarding-email state
- Any enquiry you submitted using the same email address
- Every session, so you are signed out on all devices
Kept, and why
- CFO dossiers you unlocked stay in our research library. These describe company executives and are compiled from public annual reports and stock-exchange filings — they are information about those executives, not personal data about you. Keeping them means the next person researching the same CFO is served from our library instead of us paying to rebuild it. Once your account is deleted, nothing in those records links back to you, because the record of what you unlocked is held in your account and is deleted with it.
- Invoices held by our payment provider, which we do not control, are retained for the period Indian tax and company law requires.
If you would rather we handled the deletion, or you want confirmation in writing, email reachus@headhuntcfo.com instead.
10. Changes to this notice
If we change what we collect or why, we will update this notice and, where consent is involved, ask you again. The “last updated” date above always reflects the current version. Questions: reachus@headhuntcfo.com.
Terms & Conditions · Privacy Notice · Refund & Cancellation Policy · Contact us