CareerPassport Privacy Policy and Notice
Version 2026-10-18-v2 · effective 18 October 2026
1. About this notice
1.1 This notice explains what personal data Provantic Technologies Private Limited (CIN U47912KA2023PTC173443, registered office No 1890, 8th Cross, New Thippasandra, Bangalore 560075) ("CareerPassport", "we") collects, why, and what your rights are.
1.2 We are the Data Fiduciary for the data described here, under the Digital Personal Data Protection Act, 2023 ("DPDP Act").
1.3 Which law applies now. The DPDP Act and the DPDP Rules, 2025 (G.S.R. 846(E), dated 13 November 2025) are being brought into force in phases. Most duties to Data Fiduciaries (notice, consent, rights, breach notice, retention) start on 13 May 2027. Until then, section 43A of the Information Technology Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules") also apply. We have written this notice to meet both now, so nothing changes for you on the switch-over date.
1.4 Language. You may ask to receive this notice in English or in any language in the Eighth Schedule to the Constitution (DPDP Act, s.5(3)). Write to grievance@careerpassport.app. This notice is available in English.
1.5 This notice is shown separately from our Terms, so you can read it on its own (DPDP Rules, rule 3).
2. Summary
- We collect what you give us to build your Career Passport and apply to jobs.
- You decide what each employer sees, per application. You can withdraw it.
- Every employer view of your Passport, and every reveal of your email or phone, is logged and shown to you.
- We do not sell your data. We do not show third-party advertising.
- Our analytics (Umami, self-hosted) use no cookies and no personal data.
- Optional AI features send the minimum needed to AI providers, possibly outside India. We do not store your prompts or the AI's answers.
- You can access, correct, export and delete your data, withdraw consent, nominate someone, and complain.
3. What we collect, why, and for how long (itemised notice)
3.1 Waitlist (pre-launch)
| Data | Why we use it | Basis | How long we keep it |
|---|---|---|---|
| Name, email, phone, city | Add you to the waitlist; tell you about launch; contact you about a referral contest if one opens (there is no active contest) | Consent | Until 12 months after public launch, or until you ask us to delete it, whichever is earlier — unless you create an account |
| Career stage, education, experience (years), preferred job categories | Plan launch and the REJ Expo; show you relevant updates | Consent | Same as above |
| Referral code used, your referral link, referrals you made | Record who invited whom. No rewards are counted and there is no active referral contest | Consent | Same as waitlist data |
| UTM source (which link brought you) | Understand which channels work | Consent | Same as waitlist data |
| Sign-up IP address (we store only a keyed hash, never the raw IP address, in our database) | Stop abuse and fake sign-ups (we limit sign-ups to 5 per hour per IP) | Consent; and security of the Service | Up to 2 years if linked to a fraud or abuse record; otherwise 12 months |
| Consent time and Terms/notice version you accepted | Prove what you agreed to (DPDP Act, s.6(10)) | Legal requirement | For as long as we hold your data + 3 years |
3.2 Candidate account and Career Passport
| Data | Why we use it | Basis | How long we keep it |
|---|---|---|---|
| Account details: name, email, phone, password (stored hashed), login records | Create and secure your account | Consent | While your account is open. After deletion, basic registration details are kept for 180 days (IT Rules, 2021, rule 3(1)) |
| Passport content: education, experience, skills and evidence labels, projects, certifications, documents you attach | Build your Passport; show it to employers you choose | Consent | While your account is open, until you delete an item |
| Résumés (each version) | Store your résumés; share a specific version with a specific application | Consent | Until you delete the version or the account |
| Readiness assessment answers and results | Give you a readiness score and feedback; share results only if you choose | Consent | While your account is open |
| Applications, per-application sharing choices, interview, offer and joining records | Run your applications; show you their status | Consent | While your account is open |
| Chat messages with employers | Let you and employers communicate | Consent | While your account is open. Messages you sent are also held by the employer (see 5.2) |
| Employer view logs and contact-reveal logs | Show you who viewed your Passport and who saw your contact details; detect misuse | Consent; security | 1 year minimum (DPDP Rules, rules 6 and 8), longer if needed for an open complaint |
| Membership and payment records (plan, amount, date, GST invoice, Razorpay payment ID — not your card or bank details) | Sell the membership, issue invoices, process refunds | Contract; legal requirement (tax and company law) | 8 years (Companies Act, 2013, s.128(5); CGST Act, 2017, s.36) |
| Support requests and grievances | Answer you; meet our grievance duties | Consent; legal requirement | 3 years after closure |
| Device and app information (app version, OS, crash data) | Fix bugs and keep the app secure | Consent | 90 days |
| Security and access logs | Detect and investigate security incidents | Legal requirement (CERT-In Directions, 28 April 2022; DPDP Rules, rule 6) | 180 days, kept in India; up to 1 year where needed for a security investigation |
3.3 AI features (optional)
| Data | Why | Basis | How long |
|---|---|---|---|
| The minimum context needed for the task (for example, the résumé section you ask us to review) | Produce the AI answer you requested | Consent (you start each AI task) | Not stored by us after the answer is returned |
| Metadata: task type, model used, tokens, cost, response time | Billing, cost control, quality, abuse prevention | Consent; security | 12 months |
AI is never used to decide whether you are shortlisted, rejected or hired, and never uses protected characteristics (such as caste, religion, gender, disability, or similar).
3.4 Data we do not collect
We do not ask for caste, religion, health information, Aadhaar number, or bank/card details. Please do not put such details in your Passport or résumé.
3.5 Analytics
We use Umami, hosted on our own server. It does not use cookies and does not collect personal data. We use it only for aggregated counts (for example, page visits).
4. Consent and how to withdraw it
4.1 We ask for consent through a clear, unticked checkbox or button. Consent is free, specific and informed. We ask only for data needed for the stated purpose (DPDP Act, s.6(1)).
4.2 Withdrawing consent is as easy as giving it (DPDP Act, s.6(4)). You can:
- withdraw sharing with an employer from the application screen;
- turn off marketing emails using the link in each email or in Settings;
- leave the waitlist using the link in our emails;
- delete your account in the app (Settings → Delete account) or as explained on our Account Deletion page.
4.3 After you withdraw, we stop processing that data within a reasonable time and delete it, unless the law requires us to keep it (s.6(6), s.8(7)). Processing done before withdrawal stays lawful. Some features may stop working.
4.4 Consent Managers. From 13 November 2026, you may also give, manage and withdraw consent through a Consent Manager registered with the Data Protection Board of India (s.6(7)–(9); DPDP Rules, rule 4), once we integrate with one.
5. Who we share data with
5.1 Employers — only what you choose
An employer sees your data only when you apply to its job, and only the items you chose for that application. Employers can request a résumé; you decide. An employer that receives your data is a separate Data Fiduciary for its own recruitment and must follow our Employer Terms and the law.
5.2 Withdrawal and employers
If you withdraw sharing, the employer loses access through CareerPassport. It may already have seen or recorded the data. Our Employer Terms require employers to delete candidate data when it is no longer needed for that recruitment.
5.3 Our service providers (Data Processors)
They process data only on our instructions and under contract (DPDP Act, s.8(2)).
| Provider | What they do | Where data is processed |
|---|---|---|
| Supabase, Inc. | Database, login and file storage | AWS ap-south-1 (Mumbai, India). Provider support access may occur from outside India |
| Hostinger | Server (VPS) hosting for our websites and backend | India (Mumbai) |
| OpenRouter, Inc. and the AI model providers it routes to (only zero-data-retention endpoints at Google Vertex AI and Amazon Bedrock; your data is not used for training; AI features are not live yet) | Optional AI features | Outside India (OpenRouter in the USA; model endpoints in EU, US or global regions) |
| Razorpay Software Private Limited | Payments and refunds (not live yet — test mode only) | India. Razorpay also acts as an independent regulated entity for payment data |
| Zoho Corporation (Zoho Mail) | Sending and receiving emails | India (Zoho India data centre) |
| Functional Software, Inc. (Sentry) | Error monitoring for our websites and apps: error reports only, no session replay or performance tracing; personal data is removed before sending | EU (Germany — Sentry EU data region) |
| Umami (self-hosted by us) | Website analytics: cookieless, no personal data | India (Mumbai), on our own server |
We will update this list before adding a new provider that processes personal data. We also use GoDaddy (domain name / DNS) and Let's Encrypt (security certificates); they do not receive your personal data.
5.4 Others
We may disclose data:
- when the law, a court or an authorised government agency requires it (for example, under the IT Act, 2000 or the IT Rules, 2021);
- to protect users from fraud or harm;
- to a successor if our business or this Service is transferred, under the same protections and with notice to you.
We do not sell personal data.
6. Transfers outside India
6.1 Most data is stored in India (Mumbai). Some processing happens outside India: AI features, and possibly support access by some providers and email or crash-reporting services.
6.2 The DPDP Act (s.16) allows transfers outside India except to countries the Central Government restricts by notification. As of this version, we are not aware of any such notification. Until the DPDP regime fully commences, SPDI Rule 7 also applies: we transfer only where needed to provide the service you asked for or with your consent, and only to providers that keep a comparable level of protection.
6.3 For AI features, we send only the minimum necessary data and do not send your contact details.
7. Security
We use reasonable security measures, including encryption in transit, access controls, encrypted backups, logging and monitoring, and contracts with processors (DPDP Act, s.8(5); DPDP Rules, rule 6; SPDI Rules, rule 8). Our security practices and procedures are reasonable and aligned with ISO/IEC 27001. We do not claim to be certified under that standard. Server security logs (which can contain IP addresses) are kept for 180 days, and for up to 1 year where we need them for a security investigation (CERT-In Directions, 28 April 2022). No system is perfectly secure.
8. Personal data breach
If a breach affects your data, we will:
- tell you without delay through the app or your registered email/phone — what happened, likely impact, what we are doing, what you can do, and who to contact (DPDP Rules, rule 7(1));
- inform the Data Protection Board of India, with a detailed report within 72 hours of becoming aware (rule 7(2)); and
- report cyber security incidents to CERT-In within 6 hours as required by the CERT-In Directions of 28 April 2022.
9. Children
The Service is only for people aged 18 or older. We do not knowingly collect data of anyone under 18. If we find we have, we will delete it.
10. Your rights
| Right | What it means | How |
|---|---|---|
| Access (s.11) | Get a summary of your data, what we do with it, and the names of other Data Fiduciaries and Processors we shared it with | Settings → Download my data, or email us |
| Correction, completion, updating (s.12) | Fix or complete your data | Edit in the app, or email us |
| Erasure (s.12) | Ask us to delete data we no longer need or for which you withdraw consent | Settings → Delete account, or email us |
| Withdraw consent (s.6(4)) | See section 4 | In app or email |
| Grievance redressal (s.13) | Complain to us first; we respond within the time below | See section 12 |
| Nominate (s.14) | Name someone to exercise your rights if you die or become unable to | Email us with the nominee's name and contact details |
We may need to confirm your identity first. We respond to rights requests and grievances as soon as possible and within 30 days, and in any case within the 90-day outer limit in DPDP Rules, rule 14.
Your duties (s.15). Please give accurate information, do not impersonate anyone, and do not file false or frivolous complaints. The law provides a penalty of up to ₹10,000 for breach of these duties.
11. Retention and deletion
11.1 We keep data only as long as needed for the purpose in section 3, or as the law requires (DPDP Act, s.8(7)).
11.2 Inactive accounts. If you do not log in or use the Service for 3 years, we will delete your account. We will warn you at least 48 hours before (DPDP Rules, rule 8(2)) — in practice, we will warn you 30 days before.
11.3 When you delete your account, we delete or anonymise your data within 30 days, except:
- payment, invoice and tax records (8 years);
- contest winner and TDS records (8 years), only if a contest is ever run;
- basic registration details (180 days, IT Rules, 2021);
- security and access logs (180 days, up to 1 year for a security investigation);
- employer view and contact-reveal logs (1 year);
- fraud and abuse records about fake accounts or referrals (up to 2 years);
- data we must keep for a legal claim, investigation or court order, until it is resolved.
11.4 Backups are overwritten on a rolling cycle: database backups after 7 days, our server backups after 14 days.
12. Contact, grievances and the Data Protection Board
Grievance Officer and person answering data-protection questions (DPDP Act s.8(9) and s.8(10); IT Rules, 2021 rule 3(2); SPDI Rules rule 5(9)):
Adv. Manjunath, Grievance Officer (based in India). The Grievance Officer is also our contact for data protection. Provantic Technologies Private Limited, No 1890, 8th Cross, New Thippasandra, Bangalore 560075 Email: grievance@careerpassport.app · Available: Monday to Friday, 10 am to 6 pm IST
General contact: hello@careerpassport.app.
See our Grievance Redressal page for timelines. If you are not satisfied with our response, you may complain to the Data Protection Board of India under s.13(3) and s.27 of the DPDP Act, once that procedure is available, after using our grievance process first.
13. Changes to this notice
We will show the version and date at the top. For material changes — especially a new purpose — we will tell you in advance and, where needed, ask for fresh consent.