Legal
Last updated: 12 July 2026 · Effective: 12 July 2026
Hyrnote (Private) Limited (“Hyrnote”, “we”, “our”, “us”) is a company incorporated under the Companies Act No. 7 of 2007 of Sri Lanka. We operate the Hyrnote platform — a two-sided employment marketplace connecting job seekers with employers in Sri Lanka and the Middle East — accessible at hyrnote.com and associated applications (collectively, the “Platform”).
For the purposes of the Personal Data Protection Act No. 9 of 2022 (“PDPA”), Hyrnote acts as a controller of personal data processed through the Platform.
Contact for data protection matters: privacy@hyrnote.com
This Privacy Policy applies to all personal data we collect from:
It does not apply to third-party websites linked from the Platform.
We process personal data only where we have a lawful basis under the PDPA:
| Basis | When we use it |
|---|---|
| Performance of a contract | To deliver the services you signed up for — matching seekers with jobs, enabling applications, facilitating messaging |
| Compliance with a legal obligation | Where Sri Lankan law requires us to retain or disclose records |
| Legitimate interests | Fraud prevention, platform security, improving the service, analytics — where our interests do not override your rights |
| Consent | Marketing emails, optional profile features, cross-border transfers to the Middle East where required |
| Category | Examples | Source |
|---|---|---|
| Identity | Full name, profile photo | You |
| Contact | Email address, phone number, contact email | You |
| Professional profile | CV/résumé, work experience, education, skills, job preferences, portfolio links, LinkedIn URL | You |
| Application data | Cover letters, answers to screening questions, application status | You and Employers |
| Account data | Password hash, account creation date, last login | Automatically |
| Communications | Messages sent to Employers through the Platform | You |
| Usage data | Pages visited, job searches, saved jobs, clicks, device type, browser, IP address | Automatically |
| Notification preferences | Alert settings, communication opt-outs | You |
| Category | Examples | Source |
|---|---|---|
| Company identity | Company name, logo, description, industry, size, location | You |
| Contact | Business email, phone number, website | You |
| Job listings | Job descriptions, requirements, salary ranges, screening questions | You |
| Team members | Names and email addresses of team members added to an account | You |
| Billing | Subscription plan; payment details are processed by our payment provider and not stored by us | You / Payment provider |
| Communications | Messages sent to Seekers, email templates | You |
| Usage data | As above | Automatically |
We do not intentionally collect sensitive personal data as defined under the PDPA (data relating to racial or ethnic origin, political opinions, religious beliefs, trade union membership, health, sexual orientation, or criminal record). You should not include such information in your CV or profile. If you do, we will treat it with additional protection and process it only on the basis of your explicit consent.
Certain paid features on the Platform use artificial intelligence powered by the Claude API, provided by Anthropic, PBC (“Anthropic”), a company based in the United States.
When you use an AI feature, we send a structured prompt to the Anthropic API containing only the data necessary for that feature:
| AI feature | Data included in the prompt |
|---|---|
| CV review | Extracted text from your uploaded CV |
| CV tailoring | Extracted CV text + job title and description |
| Cover letter generator | Your name, headline skills, experience summary + job title and description |
| AI fit score | Your skills, experience summary, and education level + job requirements |
| Interview prep | Job title, job description, and your professional summary |
| Career path suggestions | Your skills, experience timeline, and stated job preferences |
We do not send your contact details, phone number, photo, raw CV file, or messaging history to Anthropic.
Anthropic processes the prompt to generate a response and then discards it. Anthropic does not use customer API data to train its models. For full details, refer to the Anthropic Privacy Policy.
Processing for AI features is based on performance of a contract — these features are only available to paid-tier subscribers, and processing is necessary to deliver the subscription service you have paid for.
AI features are entirely optional and gated behind paid plans. If you do not wish your data to be sent to Anthropic, do not use the AI tools and do not activate AI-powered features within job listings or applications. Staying on the free tier means no data is sent to Anthropic.
| Processor | Service | Country | Safeguard |
|---|---|---|---|
| Anthropic, PBC | AI model inference | USA | Data Processing Agreement |
Seekers control who can see their profile via the privacy settings in their account:
Your name and basic details are always visible to Employers who have received your application, regardless of visibility setting.
With Employers. When you apply for a job, your profile, CV, cover letter, and screening answers are shared with the relevant Employer.
With Seekers. Employer company profiles and contact information are visible to Seekers as part of the Platform's normal operation.
Service providers. We share data with trusted processors acting on our instructions, including:
Legal disclosure. We may disclose data to government authorities, courts, or regulators where required by Sri Lankan law or a valid legal process.
Business transfers. In the event of a merger, acquisition, or sale of all or substantially all of our assets, personal data may be transferred to the successor entity. We will notify you before data is transferred and becomes subject to a different privacy policy.
We do not sell personal data. We do not share personal data with third parties for their own marketing purposes.
| Data type | Retention period |
|---|---|
| Seeker account and profile | For the life of the account, plus 2 years after deletion request |
| CVs and uploaded files | For the life of the account, plus 90 days after deletion |
| Application records | 3 years from the date of application |
| Employer account and listings | For the life of the account, plus 2 years after deletion request |
| Messages | 2 years from the date of the last message in a conversation |
| Usage and analytics logs | 13 months (rolling) |
| Billing records | 7 years (as required by Sri Lankan financial regulations) |
When the retention period expires, we securely delete or anonymise the data. We may retain data longer where required by law or to defend legal claims.
We implement technical and organisational measures appropriate to the risk, including:
No system is completely secure. If you believe your account has been compromised, contact us immediately at privacy@hyrnote.com.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Data Protection Authority of Sri Lanka within 72 hours of becoming aware, as required by the PDPA.
Under the Personal Data Protection Act No. 9 of 2022, you have the following rights:
| Right | What it means |
|---|---|
| Right of access | Obtain confirmation of whether we process your data and receive a copy |
| Right to rectification | Have inaccurate data corrected or incomplete data completed |
| Right to erasure | Request deletion of your data where it is no longer necessary or processing was unlawful |
| Right to restrict processing | Ask us to pause processing while a dispute about accuracy is resolved |
| Right to data portability | Receive your data in a structured, commonly used format |
| Right to object | Object to processing based on legitimate interests, including profiling |
| Right to withdraw consent | Where processing is based on consent, withdraw it at any time without affecting prior processing |
To exercise any of these rights, email privacy@hyrnote.com with your name, registered email address, and a description of your request. We will respond within 30 days.
You also have the right to lodge a complaint with the Data Protection Authority of Sri Lanka established under the PDPA.
Our core infrastructure providers are based in the United States. By using the Platform, you acknowledge that your personal data may be transferred to and processed in countries outside Sri Lanka, including the USA.
We ensure such transfers are subject to appropriate safeguards, including contractual clauses that require recipients to protect data to standards equivalent to the PDPA. Our current infrastructure providers maintain applicable data processing agreements:
We are also expanding to the Middle East. Where we process data of users located in or applying to jobs in those countries, we comply with applicable local data protection laws in addition to the PDPA.
We use only essential cookies required for the Platform to function (session management, authentication tokens). We do not use advertising cookies or third-party tracking pixels.
You can disable cookies in your browser settings, but this may prevent the Platform from functioning correctly.
The Platform is intended for users aged 18 and above. We do not knowingly collect personal data from anyone under 18. If you believe a minor has created an account, contact us at privacy@hyrnote.com and we will delete the account promptly.
We may update this Privacy Policy from time to time. We will notify you of material changes by email and by posting a notice on the Platform at least 14 days before the change takes effect. Continued use of the Platform after the effective date constitutes acceptance of the updated policy.
Data Protection Officer
Hyrnote (Private) Limited
Sri Lanka
Email: privacy@hyrnote.com