Privacy Policy

CareerMatch AI (“CareerMatch”, “we”, “us”) is a job-search service operated by CareerMatch AI. It reads your résumé, builds a profile, ranks job listings against it and helps you prepare applications.

For the personal data you give us, we are the Data Fiduciary under section 2(i) of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), and a body corporate handling information under section 43A of the Information Technology Act, 2000. You are the Data Principal.

We operate in India and wrote this policy to meet:

• the DPDP Act, 2023 and the DPDP Rules, 2025. Most of the Rules’ obligations take effect on 13 May 2027 (rule 1(4)); we already follow them where we can;
• the IT Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, which continue to apply until the DPDP Act’s provisions replace them;
• the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, for the profiles you choose to publish;
• the CERT-In Directions of 28 April 2022 on reporting cyber-security incidents; and
• the Consumer Protection Act, 2019 and Consumer Protection (E-Commerce) Rules, 2020, for paid plans.

We collect only what the service needs. Each item below shows its source.

Sensitive personal data. We do not ask for passwords to other services, financial account or card details, health, biometric, caste, religion or government ID numbers (such as Aadhaar or PAN). Please leave these out of the résumé you upload. If your résumé contains them, they are stored encrypted with the rest of it.

To find and explain jobs, we use information that is not about you:

• Job listings come only from official APIs and public employer feeds: Adzuna, Jooble, Arbeitnow and the remote-job boards We Work Remotely, Remote OK, Himalayas, Jobicy, Remotive, Working Nomads, Findwork and Real Work From Anywhere, plus employers’ career sites on Greenhouse, Lever, Ashby, SmartRecruiters, Workable, SAP SuccessFactors and Oracle Recruiting Cloud. Each listing shows its source and when it was last seen. We do not scrape sites that need a login, bypass CAPTCHAs, or ignore robots.txt.
• Original postings. When you open a job, we search the web for the employer’s own posting, using Google Search through Google’s Gemini API and the Tavily search API. We open the employer’s page only where its robots.txt allows. These searches contain the job’s title, company and location, never your personal data.
• Market salaries are figures that sites such as AmbitionBox, Glassdoor, 6figr, PayScale and Indeed publish, as they appear in search results. We link to each source and do not scrape those sites.
• Links to LinkedIn, Naukri and other boards are found the same way. We only link to them; we never read or copy those pages.

Job listings may name a recruiter or hiring manager. That information was published by the employer or job board, and we show it only as part of the listing.

We process your personal data with your consent (DPDP Act, section 6), which you give when you create an account and upload your résumé, and for the specified purpose you provide it for (section 7(a)). We use it to:

• create your account, keep you signed in and secure it (including rate limiting by IP address);
• read your résumé into a profile, score and explain job matches, and find original postings;
• generate tailored résumés, cover letters, interview practice and match analyses when you ask;
• publish your profile page, only if you turn publishing on, and only the sections you choose;
• send account emails and the job alerts you set up;
• process payments for Pro passes and keep records required by tax and consumer law;
• meet legal obligations, such as responding to lawful requests and reporting security incidents.

We do not sell your data, use it for advertising, or build profiles of you for anyone else.

• To read résumés and job postings and to write documents, we send the relevant text to one AI provider per request. We use several so the service keeps working when one reaches its daily limit: Google (Gemini API), Groq, Cerebras, NVIDIA, OpenRouter and Mistral, and Anthropic (Claude) if enabled — only those we have switched on, tried in that order. If AI search ranking is enabled, Voyage AI turns text into number vectors.
• These providers process the text to return a result under their API terms. We use their free tiers: Google’s and Mistral’s free-tier terms allow them to use submitted content to improve their products, and models reached through OpenRouter follow each model host’s policy. Groq, Cerebras and NVIDIA state they don’t train on API content. We never use your data to train any model ourselves.
• Match scores are produced by our own rules from your profile and the listing. Every point is explained on screen. They are guidance for you only; no decision about you is made automatically, and we do not share scores with employers.
• AI output can be wrong. Review everything before you use it. Generated documents only rephrase facts from your own profile.

We use the following Data Processors (DPDP Act, section 8(2)), each under contract, to run the service. They may process your data only to provide their service to us.

We also share data when you ask us to (for example, by publishing your profile or clicking an apply link), and when Indian law requires it, such as a court order or a lawful request from a government agency under section 69 or 79 of the IT Act. If the service is ever sold or merged, your data would move only under this policy, and we would tell you first.

Our database and servers are in Singapore, and some processors are in the USA. Section 16 of the DPDP Act allows transfers outside India except to countries the Central Government restricts by notification; none of these countries is restricted. Each provider protects the data with encryption and contractual safeguards.

• Your résumé text, profile and generated documents are encrypted in the database with AES-256-GCM.
• All traffic uses HTTPS (TLS). Passwords are stored only as bcrypt hashes, and session tokens are stored hashed.
• Sign-in cookies are HTTP-only and secure, and requests are rate-limited to stop abuse.
• Only the operator can access production systems, and access is limited to what is needed.

These are the “reasonable security practices” required by section 43A of the IT Act and rule 8 of the SPDI Rules, and the safeguards in section 8(5) of the DPDP Act and rule 6 of the DPDP Rules. If a breach affects your data, we will tell you and the Data Protection Board of India without delay (section 8(6) and rule 7). We will report the incident to CERT-In within 6 hours, as its Directions require.

Under Chapter III of the DPDP Act you can:

• Access a summary of your data and how we process it (section 11): use Settings → Download all my data for a full copy;
• Correct, complete or update it (section 12): edit your profile at any time;
• Erase it (section 12): delete documents, résumé versions or your whole account in Settings;
• Withdraw consent at any time (section 6(4)), as easily as you gave it. We will stop processing, though anything we already did stays lawful;
• Nominate someone to exercise these rights if you die or cannot act (section 14);
• Raise a grievance with us (section 13), and if it isn’t resolved, complain to the Data Protection Board of India.

For anything you can’t do in Settings, email the Grievance Officer below. We acknowledge within 24 hours and resolve within 15 days, as rule 3(2) of the IT Rules 2021 requires. Under the DPDP Rules the maximum is 90 days.

Section 15 of the DPDP Act asks you to give accurate information, not impersonate anyone, and not file false complaints. Only upload a résumé that is your own, and add other people’s details (for example, a recruiter’s email) only for your own job search.

CareerMatch is for people aged 18 and over. Section 9 of the DPDP Act requires verifiable parental consent for anyone under 18, which we do not collect, so we do not knowingly allow children to use the service. If you believe a child has signed up, contact us and we will delete the account.

We use no advertising, tracking or third-party analytics cookies.

If we make a material change, we will update the date at the top and tell signed-in users by email or in the app before it takes effect. If the change needs fresh consent, we will ask for it.

Questions, requests or complaints about your data:

Operator

CareerMatch AI

Grievance Officer

Faraz Ahmad

Email

faraz2402@yahoo.com

You can also use the same contact for anything under our Terms of Service.