Privacy Policy

This Privacy Policy ("Policy") is issued by [Tejasya's registered legal entity name], a [private limited company / LLP / proprietorship, as applicable] incorporated under the laws of India (CIN/registration number [Corporate Identification Number / registration number, if applicable]), having its registered office at [registered office address] ("Tejasya", "Company", "we", "us" or "our").

This Policy is framed in accordance with, and is intended to satisfy the disclosure requirements of, the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 ("IT Act"), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules") to the extent they remain applicable, and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 ("IT Rules, 2021"), each as amended, and any rules notified under the DPDP Act from time to time (together, "Applicable Data Protection Law").

By accessing or using the Platform, you acknowledge that you have read, understood and consented to the practices described in this Policy. If you do not agree, you must not use the Platform.

• "Platform" means the Tejasya website, web application, and any related services, however accessed.
• "User", "you" or "your" means any natural person who accesses or uses the Platform, whether as a registered account holder or otherwise.
• "Personal Data" has the meaning given to it under Section 2(t) of the DPDP Act: data about an individual who is identifiable by or in relation to such data.
• "Sensitive Personal Data or Information" ("SPDI") has the meaning given under Rule 3 of the SPDI Rules, and in relation to the Platform includes, without limitation, financial information (to the limited extent described in this Policy), passwords, and information received for processing under a lawful contract.
• "Processing" means any operation performed on Personal Data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, transmission, combination, restriction, erasure or destruction.
• "Data Fiduciary" means Tejasya, being the entity that determines the purpose and means of Processing of Personal Data under this Policy, as defined in Section 2(i) of the DPDP Act.
• "Data Principal" means the individual to whom the Personal Data relates, as defined in Section 2(j) of the DPDP Act — in most cases, you.
• "Content" means any resume, profile information, text, interview response, or other material a User submits to, or generates through, the Platform.
• "Services" means the resume analysis, upgrading, benchmarking, roadmap, job-matching, interview-practice and related features made available on the Platform.

This Policy applies to all Personal Data collected by Tejasya through the Platform, whether from Users located in India or elsewhere. Where a User is located outside India, this Policy operates in addition to, and does not exclude, any data protection law of that User's jurisdiction that may separately apply to Tejasya's processing of their Personal Data (for example, the General Data Protection Regulation, where applicable).

This Policy does not apply to information that is anonymised or aggregated such that it no longer identifies, and cannot reasonably be used to identify, an individual.

3.1 Provided directly by you.

• Identity and contact information: full name, email address, mobile number, date of birth, and a profile photograph, where you choose to add one.
• Professional and profile information: employment history, education, skills, certifications, achievements, professional links, compensation details, notice period and availability, and your resume.
• Content and activity: resume scores and their history, resumes generated or upgraded through the Platform (including downloaded PDF and Word files), benchmarking and roadmap results, job-match results, and interview attempts with their transcripts, scores and feedback.
• Communications: any information you provide when you contact us, including through the Contact page.

3.2 Collected automatically.

• Technical data: IP address, browser type and version, device identifiers, operating system, and request and access logs.
• Interview integrity signals: during an interview session, whether the browser tab lost focus, and whether copy or paste was used. We do not record audio or video during an interview unless a specific feature discloses otherwise at the time.
• Cookies strictly necessary to authenticate and maintain your session. We do not, as of the date of this Policy, use third-party advertising or behavioural-tracking cookies; Section 15 below explains how you will be told if that changes.
• Crash and performance diagnostics: when the Platform or the services behind it encounter an unexpected error, a diagnostic report (the error type and message, the stack trace, and the device, browser and application version involved) is sent to our error-monitoring provider. For the web application only, this provider also records a replay of on-screen interactions (clicks, scrolling and navigation) for a sample of your sessions (currently around 10%) and for every session in which an error occurs, to help us reproduce and fix the issue; by default, every text field you type into and any image or video on screen during that replay is masked and not captured. This diagnostic data does not include your resume, interview content, or other Content, and is not linked to your identity beyond what the error report itself happens to touch (for example, the page you were on).

3.3 Payment-related information. When you purchase credits, our payment processor collects your card, UPI, net-banking or wallet details directly, in accordance with Reserve Bank of India regulations applicable to Payment Aggregators. Tejasya receives only the transaction outcome, amount, and a payment reference — we do not collect, transmit or store your full card number, CVV, or bank account credentials on our own systems at any point.

3.4 Sensitive Personal Data or Information. Of the above, the categories that constitute SPDI under Rule 3 of the SPDI Rules are your password, and any financial information described in Section 3.3. We apply the enhanced safeguards described in Section 12 to this data specifically.

Consistent with Section 6 of the DPDP Act, we Process Personal Data only for the purpose for which you gave your consent, or for a purpose reasonably connected with it. The purposes are:

• To create and administer your account, and to authenticate you at sign-in.
• To provide the Services you request: resume analysis and upgrading, benchmarking, roadmap generation, job matching, and interview practice.
• To process payments for credits and to maintain records of those transactions as required by applicable law.
• To operate the Candidates search made available to Users who opt in to being visible to recruiters, as described in Section 8.
• To maintain the security and integrity of the Platform, including detecting and preventing abuse, fraud, and unauthorised access.
• To respond to your communications and requests.
• To comply with a legal obligation, including one arising under tax, payments, or record-retention law.

Your consent is obtained at the point you create an account and at the point you use a feature that requires additional data (for example, enabling visibility to recruiters). You may withdraw consent at any time as described in Section 13; withdrawal does not affect the lawfulness of Processing carried out before withdrawal, and may mean a feature that depends on that consent becomes unavailable to you.

Content you submit for an AI-driven feature — including your resume, a job description you paste in, or your interview answers — is transmitted to a third-party artificial intelligence service provider so that provider can generate the output you requested. The specific provider is a configuration we control and may, as of the date of this Policy, be Anthropic, OpenAI or Google, or another provider if we change our configuration; in every case, the provider Processes the Content solely to return a result to us, under its own data-processing terms, and not to build a profile of you for its own independent purposes, and not to train its models on your Content.

Because such providers may Process data outside India, this can result in the cross-border transfer of your Personal Data, addressed in Section 7. No output generated by these features (a score, a benchmark, a recommendation, or interview feedback) is used by us to make a decision that produces a legal effect on you or otherwise significantly affects you without an opportunity for human involvement; these outputs are provided to you as information for your own use and judgment.

Where you use the interview-practice feature, the Platform records, for that session only, whether the browser tab lost focus and whether copy or paste was used, for the sole purpose of scoring the integrity of that specific attempt. This signal is associated with the interview attempt it relates to, is not used for any purpose beyond that scoring, and is deleted along with your account on account deletion. By starting an interview session you consent to this monitoring for the duration of that session.

Voice input and read-aloud (the disclosure referred to in Section 3.2). If you choose to speak your answers instead of typing them, we use your browser's own built-in speech-to-text (for example, the browser vendor's Web Speech API) to convert your speech to text. Your microphone audio is processed by your browser and its vendor for that purpose, under the vendor's own terms, not stored or processed by Tejasya's own systems, and never reaches us — only the resulting text transcript is sent to the Platform as your interview answer, in the same way as if you had typed it. Read-aloud of the interviewer's questions uses your browser's built-in speech synthesis, which runs on your device and sends nothing to us or to any third party. Both are opt-in: nothing is listened to or read aloud unless you turn the microphone or read-aloud control on for that session.

We disclose Personal Data only to the following categories of recipients, each engaged under contractual terms that restrict their use of the data to the purpose for which it was shared:

• AI service providers, for the AI-driven features described in Section 5.
• Our payment aggregator, to process payments for credits, in accordance with applicable Reserve Bank of India directions.
• Our cloud hosting and storage providers, to operate the Platform and store your files. Resumes and photographs are held in private object storage; every read of them is served through a fresh, short-lived signed link rather than a permanent public URL.
• Our error-monitoring provider, to diagnose and fix defects in the Platform, as described in Section 3.2.
• Other Users who are Recruiters, limited strictly to the fields described in Section 8, and only where you have affirmatively opted in to being visible to recruiters.
• A court, tribunal, law enforcement or government authority, where disclosure is required or permitted by Applicable Data Protection Law, or by any other law in force in India.
• A successor entity, in the event of a merger, acquisition, reorganisation, or sale of all or substantially all of our assets, subject to that successor being bound by this Policy or a materially equivalent one.

We do not, and will not, sell, rent or trade your Personal Data to any third party for that third party's own marketing purposes.

If, and only if, you affirmatively enable the "visible to recruiters" setting on your profile, the following fields become visible to Users who have registered in a hiring capacity, through the Candidates search: your name, location, profile photograph, headline, skills, years of experience, compensation details, and notice-period and availability details. Your mobile number, date of birth, resume file, and any information not listed above are never disclosed through this feature. You may disable this setting at any time, with immediate effect on future searches.

As described in Section 5, AI Processing of your Content may occur on servers located outside India. Section 16 of the DPDP Act permits the transfer of Personal Data outside India except to countries restricted by the Central Government by notification; as of the date of this Policy, no such restriction affects the providers we use. Where we transfer Personal Data outside India, we do so only to service providers who are contractually bound to protect it to a standard consistent with this Policy and Applicable Data Protection Law.

We retain Personal Data for as long as your account remains active and as necessary to provide the Services. On a verified request to delete your account, we delete or irreversibly anonymise your Personal Data, including profile content, resumes, generated results, and interview transcripts, within a reasonable period, save that we may retain information we are required by law to keep for longer — payment and transaction records are the most common example, ordinarily retained for the period mandated under applicable tax and financial record-keeping law.

In accordance with Rule 8 of the SPDI Rules and Section 8(5) of the DPDP Act, we have implemented reasonable security practices and procedures appropriate to the sensitivity of the Personal Data we hold, including: encryption of data in transit; private, access-controlled cloud storage for resumes and photographs, served only through short-lived signed links; one-time-password authentication in place of a stored password for sign-in; and restriction of internal access to Personal Data to personnel who need it to operate the Service.

No method of electronic transmission or storage is completely secure, and while we take these measures seriously, we cannot guarantee absolute security.

In the event of a Personal Data breach, we will take prompt remedial action and, without undue delay, notify affected Users of the breach and the measures taken in response. Where required under the DPDP Act or any rules made under it, we will also notify the Data Protection Board of India in the manner and within the timeframe prescribed.

Chapter III of the DPDP Act grants you the following rights in relation to your Personal Data, which we give effect to as follows:

• Right to access information (Section 11): a summary of the Personal Data we hold about you and the Processing activities we have undertaken, on request.
• Right to correction and erasure (Section 12): you can correct inaccurate or incomplete Personal Data directly from your profile at any time, or by contacting us; you can request erasure of your account and associated Personal Data as described in Section 10.
• Right to grievance redressal (Section 13): you may lodge a grievance with our Grievance Officer as described in Section 14, and escalate to the Data Protection Board of India if unsatisfied with our response.
• Right to nominate (Section 14): you may nominate another individual to exercise your rights under the DPDP Act in the event of your death or incapacity, by writing to us.
• Right to withdraw consent (Section 6(4)): you may withdraw consent for a specific Processing purpose at any time, with the consequences described in Section 4.

In accordance with Section 13 of the DPDP Act and Rule 3(2) of the IT Rules, 2021, we have appointed a Grievance Officer to address any question, complaint or grievance regarding the Processing of your Personal Data:

Grievance Officer: [Grievance Officer name and designation]
Email: [support email]
Address: [registered office address]

We will acknowledge a grievance within twenty-four (24) hours of receipt and endeavour to dispose of it within fifteen (15) days of receipt, consistent with the timelines prescribed under the IT Rules, 2021. If you are not satisfied with our response, you may approach the Data Protection Board of India constituted under the DPDP Act.

We use only those cookies strictly necessary to keep you signed in and to maintain the security of your session. We do not currently deploy third-party advertising, analytics, or behavioural-tracking cookies. If this changes, we will update this Policy before the change takes effect and, where required by Applicable Data Protection Law, seek your consent.

The Platform is not directed at, and is not intended for use by, any individual under the age of 18. We do not knowingly collect Personal Data from anyone under 18. If we become aware that we have done so, we will delete it without delay.

The Platform may contain links to third-party websites or rely on third-party services (including our payment aggregator and AI providers) that are governed by their own privacy policies. We are not responsible for the privacy practices of any third party, and we encourage you to review their policies independently.

We may revise this Policy from time to time to reflect changes in our practices or in Applicable Data Protection Law. Where a change is material, we will notify you by email or by a prominent notice on the Platform before the change takes effect. The "Last updated" date above indicates when this Policy was last revised. Your continued use of the Platform after a revision takes effect constitutes your acceptance of the revised Policy.

This Policy is governed by the laws of India. Any dispute arising out of or in connection with this Policy that is not resolved through the grievance mechanism above is subject to the dispute-resolution provisions of our Terms & Conditions.

For any question about this Policy or our data practices, write to us through the Contact page, or contact our Grievance Officer directly using the details in Section 14.