What Kriteia does with an application, and what it will not do.

Kriteia is the product. Raitakarya Technologies Pvt Ltd operates it, and is the data fiduciary for the processing described here.

The organisation running the program you applied to decides who is selected. Raitakarya Technologies Pvt Ltd runs the platform they decide on, and holds your submission on their behalf, inside their own isolated tenancy.

The registered address, PAN and GSTIN are not printed yet. They are printed here when they exist. This page prints no placeholder in their place, because an applicant reading a fiduciary’s address is entitled to a real one or to none.

This is the purpose statement a Kriteia form shows above its consent checkbox. A form keeps the wording it was published with, so a form published before this version may show an earlier one.

Raitakarya Technologies Pvt Ltd processes what you submit for the sole purpose of assessing this application: normalising it, generating an evidence-cited assessment for human reviewers, and writing you a reason for the outcome. It is never sold. You can ask the organisation running this program for your data at any time, or for it to be erased. Erasure is not built into Kriteia yet.

Consent is captured at the form and checked in the database rather than in the page. A program that has not published a purpose statement cannot collect a submission through a Kriteia form. Applications an organiser imports from a CSV file, Typeform or Airtable did not pass through this notice.

AI assists reviewers; people decide. Kriteia produces an evidence-cited first pass and a ranking. Every advance, waitlist and rejection is decided by a person at the organisation running this program, never by the AI, and any reason you are sent is released by a person at that organisation.

No decision about you can be recorded without the identity of a signed-in person, and that identity is never a parameter any caller can supply. It is enforced by revoked database grants, a fail-closed trigger and table ownership. A program’s last advancing stage must be a human review stage, checked by the database rather than by convention. Your letter is released only by a signed-in owner or admin of that organisation, and your applicant page shows no outcome until it is released.

How the assessment is produced, what is measured about it, and what is not yet proven about it are all on the methodology page.

Application data is stored in Postgres in Mumbai. Every table has row-level security, scoped to the organisation, so one organisation’s applications cannot be reached from another’s session. No service-role key exists anywhere in the request path.

To be read, your application text is sent to the AI providers that read it (Anthropic, OpenAI and Google), and the audio of a linked video to Deepgram for a transcript. Emails are sent through Resend.

Before either AI reader sees the text, identity is taken out of what it is shown: your name, your teammates’ names, your organisation or institution, the program’s configured gender terms, and your email, phone and URL handles. The stored record is never masked — the database keeps what you wrote, and only the AI’s copy is redacted — so the organiser and the human judges see what you wrote, your name included. The organiser’s view marks each part the AI was not shown.

Applications are never sold.

A feedback letter carries narrative only: no score, no rank, and no comparison to another applicant, ever. If an organiser turns band reveal on, the letter and your own page show the same per-criterion word — weak, developing or strong — with boundaries fixed platform-wide and not configurable by the organiser. The setting is off by default.

Kriteia has no erasure tool and no automatic retention period yet, so an erasure request cannot yet be carried out inside the product.

You can still ask the organisation running the program you applied to for your data, or ask for it to be erased. Your submission sits inside their tenancy, and Raitakarya Technologies Pvt Ltd acts on their instruction.

Every decision, cut-line move, published rubric version, AI assessment and letter release is added to a SHA-256 hash chain through a single writer. Nothing on that record is updated or deleted. A record that was altered, or an event quietly removed from the middle, fails verification.

It records what happened to your application, and when. The reason in your letter has to point to what you submitted, and that check runs before any person can release it. The format is described on the methodology page.

No privacy policy, terms or data-processing agreement reviewed and signed by a lawyer. This page and the terms are drafts, and a draft data-processing agreement is published too, not yet reviewed by a lawyer.

No erasure tool and no automatic retention period yet.

No SOC 2 report and no ISO certification. Neither is claimed anywhere on this site, and neither is in progress.