Privacy Policy

1. Operator Identity & Data Fiduciary

Under the Digital Personal Data Protection Act, 2023 (DPDPA 2023) of India and applicable global regulations (including the EU General Data Protection Regulation / GDPR), the Data Fiduciary responsible for personal data processing is:

2. Personal Data We Collect

We process only data strictly necessary to provide real-time interview simulations and resume diagnostics:

• Identity & Account Credentials: Name, academic/work email address, university affiliation (e.g. IIT Bombay email domain verification), password hash (managed securely via Supabase Auth with salted bcrypt/Argon2).
• Candidate Professional Materials: PDF/DOCX resumes, CVs, bullet point drafts, work history, and target role preferences uploaded for parsing and scoring.
• Simulation & Diagnostic Telemetry: Case transcript text, spoken audio recordings (transiently transcribed and processed in memory), evaluation scorecards, and scratchpad notes.
• Billing & Transaction Metadata: Order IDs, pass purchases, subscription statuses, and invoice references. Note: Credit card, debit card, and UPI credentials are processed directly by our PCI-DSS Level 1 compliant gateway (Razorpay) and are never stored or seen by our servers.
• Technical Telemetry: IP addresses, anonymized browser user-agents, device fingerprints, and diagnostic crash reports (processed via Sentry with automated PII redaction).

3. Purpose & Legal Basis for Processing

We process personal data under lawful grounds recognized by Section 4 and Section 7 of the DPDP Act 2023 and Article 6 of the GDPR:

• Performance of Contract: Generating real-time interview questions, dynamic case evaluations, and tailored resume optimization suggestions requested by you.
• Affirmative Consent: Processing resumes and audio inputs provided explicitly during user sessions. You may withdraw consent at any time.
• Legitimate Interests: Preventing Denial-of-Wallet (DoW) abuse, rate limit enforcement, detecting fraudulent payment claims, and ensuring platform security.
• Legal Compliance: Complying with statutory financial reporting, tax (GST) mandates, and lawful government requests.

4. AI Transparency & No-Training Guarantee

5. Authorized Sub-Processors

We work with vetted cloud infrastructure sub-processors who comply with industry security standards (SOC 2 Type II, ISO 27001):

6. Your Rights Under DPDP Act 2023 & GDPR

Every registered user retains comprehensive autonomy over their personal data:

• Right to Access & Summary: Request an export of all resumes, transcripts, and account profile records held by us.
• Right to Correction & Completion: Update obsolete contact details or academic affiliations directly in your profile settings.
• Right to Erasure ("Right to be Forgotten"): Request complete deletion of your account, resumes, and session archives.
• Right to Grievance Redressal: Direct complaints to our appointed Grievance Redressal Officer.
• Right to Nominate: Designate a nominee to exercise data rights in the event of death or incapacity.

To trigger automated self-service data export or account erasure, navigate to your Dashboard Settings > Data Rights, or email our Data Compliance Desk at krishnagahlod@gmail.com.

7. Grievance Redressal Officer (GRO)

In accordance with Section 13 of the DPDP Act 2023 and Rule 3(11) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, our designated Grievance Redressal Officer is:

8. Retention & Deletion Schedule

We retain personal data only as long as your account remains active. Resumes and session transcripts can be deleted at any time by the user. If an account remains inactive for 24 continuous months, all associated resume artifacts and interview logs are queued for automated cryptographic purging.