Privacy Policy

1. Data Controller

The data controller for personal data processed through CareerCraft AI Jobs is:

2. What Data We Collect

2.1 Account Information

When you register for an account, we collect:

• Full name and designation
• Email address and phone number
• Company name, GSTIN, and business address (for Company Accounts)
• Login credentials (passwords are hashed and never stored in plaintext)
• Profile photo (optional)

2.2 Billing Information

• Subscription plan and billing cycle details
• Payment transaction records and invoice data
• GST-related information for tax compliance

Note: We do not store credit card numbers, CVV codes, or bank account details. All payment information is processed and stored securely by our payment processor, Razorpay.

2.3 Usage Data

• Job postings created, edited, and published
• CV Bank search queries and profile views
• Application management activities
• Feature usage patterns and interaction logs
• Login timestamps, IP addresses, and session data

2.4 Cookies & Device Data

• Browser type, version, and language preferences
• Device type, operating system, and screen resolution
• Referral source and landing pages
• Cookies and local storage for session management and preferences (see Section 8)

3. How We Use Your Data

3.1 Service Delivery

We use your data to:

• Create and manage your account
• Process subscriptions, payments, and generate invoices
• Provide access to job posting, candidate search, and CV Bank features
• Send transactional communications (account confirmations, payment receipts, subscription reminders)
• Provide customer support

3.2 AI Processing

Our AI features process your data to:

• Generate and enhance job descriptions based on your inputs
• Match candidates to your job postings using skill, experience, and preference analysis
• Parse and analyse CVs for searchability and ranking
• Provide screening recommendations and shortlisting suggestions

3.3 Analytics & Improvement

We use aggregated, anonymised usage data to analyse platform performance, improve features, identify trends, and enhance the overall user experience. Individual users are never personally identified in analytics reporting.

4. CV Bank Data Handling

4.1 Anonymised Previews

Candidate profiles in CV Bank search results are displayed with anonymised previews. Personal identifying information (name, email, phone number) is redacted until a recruiter uses a CV view credit to access the full profile. This ensures that candidate privacy is preserved until intentional, credit-based access is granted.

4.2 Recruiter Obligations

When you access candidate data through the CV Bank, you become a data controller for that data. You are responsible for processing candidate data lawfully, respecting candidate opt-out requests, and ensuring that data is used solely for recruitment purposes. See our Terms of Service for detailed obligations.

5. AI Data Processing

AI processing is performed using secure, industry-standard infrastructure. Data submitted for AI features is processed in real time and is not retained beyond the immediate processing context unless it forms part of your account data (e.g., a generated job description that you choose to save).

6. Data Sharing

We do not sell, rent, or trade your personal data. We share data only with the following categories of recipients, strictly as necessary:

Recipient	Purpose	Data Shared
Razorpay	Payment processing	Billing name, email, transaction amount, payment method
Google	OAuth authentication	Email, name, profile photo (when using Google Sign-In)
Cloud Infrastructure	Platform hosting and storage	All platform data (encrypted at rest and in transit)
Analytics Providers	Usage analytics	Anonymised, aggregated usage data only

We will not disclose your personal data to any other third party unless required by law, court order, or regulatory authority, or with your explicit prior consent.

7. Data Retention

Data Category	Retention Period
Account information	Duration of account + 90 days after deletion
Billing and invoice data	7 years (as required by Indian tax law)
Job postings	Duration of account + 6 months after deletion
Usage logs and analytics	24 months (anonymised after 12 months)
Support tickets	3 years after resolution
Cookies and session data	Session cookies: until browser close; persistent cookies: up to 12 months

After the applicable retention period, data is securely deleted or irreversibly anonymised.

8. Cookies & Tracking

8.1 Essential Cookies

We use essential cookies for authentication, session management, and theme preferences (dark/light mode). These cookies are strictly necessary for the Platform to function and cannot be disabled.

8.2 Analytics Cookies

We use analytics cookies to understand how users interact with the Platform. These cookies collect anonymised data such as pages visited, time on site, and click patterns. You can opt out of analytics cookies through your browser settings.

8.3 Local Storage

We use browser local storage to store your authentication token and theme preference for a seamless user experience.

9. Your Rights (GDPR & DPDPA)

If you are located in the European Economic Area or are an Indian resident, you have the following rights with respect to your personal data:

• Right of Access: Request a copy of all personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data, subject to legal retention obligations.
• Right to Data Portability: Receive your data in a structured, commonly used, machine-readable format.
• Right to Restrict Processing: Request that we limit the processing of your data under certain circumstances.
• Right to Object: Object to the processing of your data for direct marketing or on grounds relating to your particular situation.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at support@careercraft.cc. We will respond to your request within 30 days.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256).
• Access Control: Role-based access controls ensure that only authorised personnel can access personal data, on a need-to-know basis.
• Infrastructure: Our platform is hosted on enterprise-grade cloud infrastructure with SOC 2 compliance, automated backups, and disaster recovery.
• Monitoring: Continuous security monitoring, intrusion detection, and regular vulnerability assessments.
• Password Security: All passwords are hashed using bcrypt with salt. We never store plaintext passwords.

While we strive to protect your data using commercially reasonable measures, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

11. Data Protection Officer

For any privacy-related queries, concerns, or to exercise your data protection rights, please contact our Data Protection Officer:

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email and/or a prominent notice on the Platform at least 15 days before taking effect. The "Last updated" date at the top of this page indicates the most recent revision.