Privacy Policy

Kirnova is operated by Kirnova Systems, Nashik, Maharashtra 422222, India. For the purposes of the Digital Personal Data Protection Act, 2023 we are the Data Fiduciary — the entity that decides why and how your personal data is processed. You are the Data Principal.

This notice applies to everyone whose personal data we handle: people who take an assessment, people who hold an account, and people whose details reach us through an organisation that embeds our assessment in its own product.

If an employer, recruiter or other organisation asked you to take an assessment, that organisation decides its own purposes for your data and is a Data Fiduciary in its own right. We can answer for our handling, not theirs.

Account details

Your name and email address. Optionally a phone number, job title or focus, and the school or organisation you give us. If you sign in with Google we receive your name, email address and profile image from Google.

Your assessment answers

The response you gave to each individual question, together with the question set and the identifier that lets a sitting be reconstructed exactly. We keep the raw answers, not only the scores, because scores are lossy — reliability and fairness analysis is impossible without the underlying responses.

Assessment results

The readings we produce from your answers. Which ones we hold depends on the assessment you took, and they can include: your behavioural style read in a natural and an adaptive framing, and the gap between the two; your personality factor and facet readings; the order your work interests came out in, and the occupations that order points at; and your five TIGER readings. On TIGER Student we also hold a note, in our own words, about how the working style recorded for a suggested occupation relates to your own readings. Alongside those we hold the band labels, the written profile, role-fit guidance, and data-quality flags such as an unusually fast completion or a low-variation response pattern.

Results from an earlier version

If you sat one of our assessments before August 2026 you may hold a result from an earlier version of it, which reported a different set of readings — including Big Five indicators. We keep those results exactly as they were produced rather than recalculating them, so what we hold is what you were shown at the time. The same rights in section 7 apply to them.

How you used the assessment

When you started and completed it, and how long it took. Completion time is used as a data-quality signal, not as a performance measure.

Security and audit records

Your IP address and browser or device information at sign-in and at other security-relevant actions, plus a record of administrative actions taken on your account. We keep these to detect misuse and to be able to answer 'who accessed this, and when'.

Data from a partner organisation

If you took the assessment inside another organisation's product, that organisation supplies us with the identifying details it holds for you — typically a name, an email address, or its own reference for you.

The assessment is not a clinical or diagnostic instrument and must not be treated as one. We do not seek health data, and you should not put information of that kind into free-text fields.

We process your personal data on the basis of the consent you give when you create an account and take an assessment, and — where the DPDP Act permits it — for the legitimate uses it specifies, such as data you voluntarily provide to us for a purpose you have not indicated you object to.

• Producing your assessment result and showing it to you.
• Combining readings from your assessments with each other — for example, describing how the working style recorded for a suggested occupation relates to your own readings — so the result says more together than the parts do separately.
• Showing your result to an organisation you were introduced through, or that you have granted access to — see section 4.
• Running your account: signing you in, sending one-time codes and sign-in links, and letting you edit your profile.
• Keeping the service working and secure — diagnosing faults, investigating misuse, and maintaining an audit trail of administrative access.
• Improving the instrument itself: reliability, fairness and validity analysis on assessment responses.
• Complying with law, and establishing or defending a legal claim where we have to.

We do not sell personal data, and we do not use your assessment answers or results to advertise to you.

We do not feed employment outcomes back into how anyone is scored. If we ever hold data about what happened after an assessment — whether someone was hired, or how they performed — it is kept strictly separate from the scoring system and cannot influence any score. This is enforced by an automated check in our codebase, not only by policy, because a scoring model that learns from its own past decisions produces numbers that look credible and are not.

This is the part most worth reading closely, because an assessment result is only useful if someone other than you can see it — and you should know exactly who that is.

You

Always. Your own dashboard shows your full result, including every caveat attached to it.

The organisation that introduced you

If you reached us through a recruiter's or employer's referral link, that organisation can see your result. Where more than one organisation is involved, the first one recorded before your result was finalised is the primary; later ones get access only if you or the primary allow it.

An organisation you grant access to

Access granted this way is time-limited and can be withdrawn by you from your dashboard.

A partner whose product you used

If you took the assessment inside another organisation's product, that organisation receives your result — that is the purpose of the arrangement. It is delivered to them through our API, a webhook, or directly into the page you were using.

Our staff

Only where needed to run or support the service, and administrative access to an individual's record is logged.

Combining your result with someone else's

We will not combine your result with another person's for a joint analysis without a recorded basis for doing so. Where you and the other person are not employees of the same requesting organisation, that means your explicit consent.

We may also disclose personal data where the law requires it, or to establish, exercise or defend a legal claim.

We engage a small number of third-party providers as Data Processors. They act only on our instructions, under contract, and are not permitted to use your data for their own purposes.

Vercel

Application hosting and content delivery.

Prisma Postgres

The database where accounts and results are stored.

Resend and Brevo

Sending sign-in codes, sign-in links and service email.

Google

Sign-in with Google — only if you choose that option.

Microsoft Clarity

Product analytics: which pages are used and where people get stuck.

Some of these providers store or process data outside India. Under section 16 of the DPDP Act such transfers are permitted except to countries the Central Government restricts by notification, and we do not transfer data to any restricted country. We remain accountable to you for data handled by a processor on our behalf.

We erase personal data when the purpose it was collected for is no longer being served and retention is not required by law — and when you withdraw consent, on the terms in section 7.

TIGER assessment results

Marked expired 90 days after completion. An expired result is no longer presented as a current read on you. The record itself is retained until deletion.

Kirnova DISC results

Currently have no expiry date and are retained until deletion.

Superseded results

If you retake an assessment, the earlier result is kept and marked superseded rather than overwritten, so the history of what was reported about you stays intact.

Account data

Kept while your account exists.

Security and audit records

Kept for as long as needed for security and accountability purposes, which may be longer than the account itself.

Under the DPDP Act you have the right to:

Access (section 11)

Obtain a summary of the personal data we process about you, the processing activities we undertake, and the identities of any other Data Fiduciaries and Processors with whom it has been shared.

Correction and erasure (section 12)

Have inaccurate or misleading data corrected, incomplete data completed, data updated, and data erased. You can edit most of your profile yourself from your account.

Grievance redressal (section 13)

Raise a grievance with us about how we have handled your data or responded to a request. See section 11 of this notice for how, and what happens next.

Nomination (section 14)

Nominate another individual to exercise these rights on your behalf if you die or become incapable of doing so. Email us to register a nomination.

Withdraw consent

Withdraw your consent at any time, as easily as you gave it. Withdrawal does not affect processing that already happened lawfully, and we will stop processing and erase your data unless retention is required by law.

Erasure is real erasure. When we action a deletion request we remove your account together with the records linked to it — your assessment results, your raw answers, your sessions and your profile. It is not reversible, and we cannot restore a deleted result afterwards.

Two limits worth being straight about. First, where an organisation has already downloaded or exported a report about you, we cannot reach into their systems to delete their copy — ask them directly. Second, we may retain a minimal record where the law requires it, or where it is necessary to defend a legal claim.

To exercise any right, email team@kirnova.com. We may need to verify your identity first. There is no charge.

The DPDP Act also places duties on you as a Data Principal. In plain terms: give us accurate information, do not impersonate anyone else when providing personal data, and do not raise a grievance or a complaint that you know to be false or frivolous. Suppressing material information when providing your details, or answering the assessment as someone other than yourself, undermines the result and may breach these duties.

Traffic to and from the platform is encrypted in transit. Passwords are stored hashed, never in a readable form, and one-time sign-in codes are stored hashed as well. Partner API keys are stored as hashes rather than as usable keys. Access to partner data is isolated at the database level so one organisation’s records cannot be read through another’s. Administrative access to an individual’s record is logged. Our security overview sets this out in more detail.

No system is perfectly secure. If a personal data breach occurs we will notify each affected Data Principal and the Data Protection Board of India, as the DPDP Act requires.

Under the DPDP Act a child is anyone under 18. Processing a child’s personal data requires verifiable consent from a parent or lawful guardian, and tracking, behavioural monitoring and targeted advertising directed at children are prohibited.

We do not operate a parental-consent mechanism, so you must be at least 18 to hold an account or take an assessment. We say this plainly rather than claiming a consent flow we do not have. If you believe someone under 18 has given us personal data, contact us and we will erase it.

If you think we have mishandled your personal data, or you are unhappy with how we answered a request, raise it with us first. Email our Grievance Officer, Kirnova, at team@kirnova.com with the details, or write to Kirnova Systems, Nashik, Maharashtra 422222, India. That address reaches the person responsible for answering questions about our processing.

We will acknowledge within 5 business days and give you a substantive response within 30 days.

If you remain dissatisfied after exhausting our grievance process, you may complain to the Data Protection Board of India. The DPDP Act requires you to exhaust our process before approaching the Board, which is why we have given firm timelines above rather than vague ones.

We will update this page when our practices change, and the date at the top will change with it. If a change materially affects how we handle data we already hold about you, we will tell you rather than relying on you noticing.

Our Terms of Service set out the rules for using the platform, including what an assessment result may and may not be used for.