Privacy Policy (India / DPDP Act, 2023)

This notice explains how Huntfolio(“Huntfolio”, “we”) processes the personal data of users in India in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”). Under the DPDP Act, Huntfolio acts as a Data Fiduciary and you are the Data Principal.

1. Personal data we process

• Account data — name, email, hashed password (or Google/GitHub sign-in identifier).
• Profile & career data — experience, education, skills, projects, achievements, certifications, and any resume/portfolio you create.
• Uploaded resumes — parsed into structured profile data.
• Job-hunt data — applications, companies, contacts, cover letters, skill gaps.
• Referral data — non-identifying search facets; a company email for referrer verification. Contact details are shared only with your explicit consent.
• Usage data — AI usage/token counts and server logs.
• Security & authentication logs — sign-in attempts (success and failure) with your IP address and browser/device, used to protect your account. Passwords are never logged.

2. Purpose & your consent

We process your personal data for the specific, lawful purpose of providing Huntfolio’s features to you. By creating an account you provide consent under Section 6 of the DPDP Act for the processing described here. Your consent is free, specific, informed, and revocable— you may withdraw it at any time (see “Your rights” below), after which we will stop the corresponding processing.

3. Where your data is stored & sharing

Data is stored in a PostgreSQL database hosted on Railway and shared, only as necessary, with the following processors (Data Processors engaged by us). Some processing occurs outside India; we take reasonable measures to protect your data during such transfers.

• Railway — Application hosting + PostgreSQL database (all core account, profile, resume, portfolio, referral, and usage data) (United States / EU regions).
• Google (Gemini API) — AI features: resume parsing, tailoring, ATS checks, summaries, cover letters, skill suggestions (United States).
• Cloudinary — Optional image uploads (profile photos, portfolio media) (United States / EU).
• Resend — Transactional email (password reset, referral verification) (United States).
• GitHub / Vercel / Netlify — Optional portfolio publishing to the destination you choose (United States).

We do not sell your personal data.

4. Retention

We retain your data while your account is active and delete it upon account deletion, except where retention is required to comply with law or resolve disputes. This aligns with the DPDP Act’s data-minimisation and storage-limitation expectations.

Operational logs are pruned on a schedule: authentication/security logs (including IP and device) after about 90 days, AI-usage and analytics logs after about 180 days, and error logs after about 30 days. Purchase and credit records are kept as long as needed for accounting and disputes.

5. Your rights as a Data Principal

• Right to access — obtain a summary of the personal data we process and how (in-app export).
• Right to correction & erasure — correct inaccurate data (edit your profile) or delete it (delete your account).
• Right to withdraw consent — as easily as it was given.
• Right to grievance redressal — raise a complaint with us using the contact below.
• Right to nominate — nominate another individual to exercise your rights in the event of death or incapacity (contact us to record a nomination).

6. Grievance Officer

In accordance with the DPDP Act, you may contact our Grievance Officer for any concern about your personal data at privacy@huntfolio.app. We will respond within the timelines prescribed under applicable law.

7. Children’s data

Huntfolio is intended for adults. We require every user to confirm they are at least 18 years old at sign-up, and we record that confirmation. We do not knowingly process the personal data of children (under 18) without verifiable parental consent, and we do not undertake tracking, behavioural monitoring, or targeted advertising directed at children, consistent with Section 9 of the DPDP Act. If a minor’s account comes to our notice, we will delete it.

8. Security safeguards

We apply reasonable security safeguards: hashed passwords and reset tokens, account-scoped access, and locked-down AI/PDF rendering. In the event of a personal data breach, we will notify the Data Protection Board and affected users as required.

9. Changes & contact

Material changes bump the version above and may require renewed consent. Contact: privacy@huntfolio.app.