# Privacy Policy > What Hiremast collects, why, who it's shared with, how long it's kept, and your rights under India's Digital Personal Data Protection Act, 2023. Canonical: https://hiremast.in/privacy Last updated: 2026-11-08 A resume holds your whole working life, so we collect as little as we can and use it for one thing: making your resumes. This policy explains what we collect, why, who it's shared with, how long we keep it, and your rights under India's Digital Personal Data Protection Act, 2023 (“DPDP Act”). ## The short version - We use your data only to run Hiremast for you. We never sell it and never use it to train AI. - To write and check your resumes, your content goes to an AI provider, which may process it outside India. - Payments go through Dodo Payments. We never see your card, UPI or bank details. - No advertising or analytics trackers. The only cookies keep you signed in. - Delete your account in Settings and your vault and resumes are erased. Payment records are kept, without your name, because tax law requires it. - Questions or complaints go to our Grievance Officer, who replies within 24 hours. ## 1. Who is responsible for your data Hiremast is run by an individual based in India, who is the Data Fiduciary for your personal data under the DPDP Act. Contact us about anything in this policy at [support@hiremast.in](mailto:support@hiremast.in?subject=Privacy), or see the [Contact page](https://hiremast.in/contact) for our Grievance Officer. ## 2. What we collect **Your account** - Your email address, and your name if you give it or sign in with Google or GitHub. - Your password, if you set one. We store only a one-way hash of it, never the password itself. - Whether you're a student, a fresher or switching jobs, so we can suggest the right things. - If you sign in with Google, the Google account ID that links it to Hiremast. We don't get your Google password or access to your Gmail or Drive. - If you sign in with GitHub, your GitHub user ID, name and verified primary email. We don't get your GitHub password or access to your repositories. **Your career content** - The resume file or text you give us, and the details we read from it: contact details, education, work history, projects, skills and achievements (your “vault”). - Facts you add or edit, and your answers to our questions about your work. - Job posts you paste or link, and the resumes, cover letters, match scores and changes we make for them. - Application tracking: the stage of each application, the date you applied, and your notes. Please don't put sensitive details on your resume that employers don't need, such as ID numbers, health information, religion or caste. We don't ask for them. **Payments** - What you bought, the amount, the date, the payment status and Dodo Payments' checkout and payment IDs. - Your credit balance and its history, your pass dates, and referral codes and referrals. - We don't receive or store card numbers, UPI IDs or bank details. Dodo Payments handles those. **Technical data** - Your IP address, used briefly to limit abuse (for example, how many free ATS checks one network can run). These counters expire within a day. - Server logs of requests and errors, which help us keep Hiremast running and secure. **The free ATS check** at [/ats-check](https://hiremast.in/ats-check) doesn't need an account, and we don't store the resume or job post you check there. They're processed to show your result and then discarded. ## 3. How we use it, and why we're allowed to We process your personal data on the basis of your consent, which you give when you sign up and when you add your resume, and for the legitimate uses the DPDP Act allows. We use it to: - create your account, sign you in, and keep your account secure; - build your vault, write and score tailored resumes and cover letters, and make your PDF and Word files; - take payments, apply credits and passes, return credits when a resume fails, and keep the records tax law requires; - send you verification and password reset codes, and important messages about your account or these policies; - answer your questions, and handle refunds, grievances and disputes; - prevent fraud and abuse, and keep Hiremast working and secure; - meet our legal obligations. **We don't** sell your data, share it for advertising, use it to train AI models, or show your resumes to employers or anyone else. Hiremast only sends a resume where you send it. ## 4. How AI is used To read your resume, understand a job post and write your tailored resume, we send the relevant parts of your content to an AI model. We currently use **OpenRouter**, which routes each request to a model provider such as Google (Gemini). They process it to return the result to us. - We send only what's needed for that task, such as your vault and the job post, not your payment details. - We choose providers and settings under which your data isn't used to train their models. - Every AI-written line is checked against facts you've confirmed, and you review every change before using it. ## 5. Who we share it with We share personal data only with service providers who process it for us under contract, and only what each needs: - **OpenRouter, and the AI model providers it routes to (such as Google):** parsing resumes and writing and scoring tailored resumes. - **Dodo Payments:** taking payments and refunds. - **Google:** “Sign in with Google”, if you choose it. - **GitHub:** “Continue with GitHub”, if you choose it. - **Our email provider:** sending verification codes, password reset codes and account messages. - **Our hosting provider:** the servers where Hiremast and its database run. We may also disclose data where the law requires it, such as a valid order from a court or government authority, or to protect the rights, safety or property of our users or Hiremast. If Hiremast is transferred to a company, as explained in the [Terms](https://hiremast.in/terms#who), your data moves with it under this policy, and we'll tell you first. ## 6. Data outside India Some of our providers, including AI model providers, may process data on servers outside India. The DPDP Act allows this except to countries the Government of India restricts, and we don't use providers in restricted countries. Our providers protect data under their own security and privacy commitments. ## 7. How long we keep it - **While you have an account:** we keep your vault, resumes and tracking data so you can use them. - **When you delete your account** (Settings, then Delete account): your account, vault, uploaded file, resumes, cover letters, notes, credits and referral details are erased from our live systems. - **Payment records** (amount, plan, date, Dodo Payments IDs) are kept for as long as Indian tax and accounting law requires, with your name and account removed. - **Backups and logs:** copies in backups or server logs are overwritten within 30 days. - **Abuse counters** tied to an IP address expire within 24 hours. If an account stays unused for 3 years, we may delete it, after emailing you first. ## 8. Cookies and local storage We don't use advertising, analytics or tracking cookies. We use only what Hiremast needs to work: - **Sign-in cookie** (`margin_session`): keeps you signed in for up to 30 days. It can't be read by scripts on the page. - **Google and GitHub sign-in cookies:** short-lived (10 minutes), used only to finish signing in safely, and to remember a referral code during sign-up. - **Your browser's local storage:** preferences such as light or dark theme, whether the sidebar is open, and board or list view, plus a referral code you arrived with until you sign up. They stay on your device. Because these are strictly necessary, we don't ask for a cookie banner. Blocking them will sign you out. ## 9. How we protect it - Data travels over encrypted HTTPS connections. - Sessions are signed, and the sign-in cookie can't be read by page scripts. - Only our public gateway is reachable from the internet. The services and database behind it aren't. - Staff access is limited. Our admin tools show account and payment details, not the contents of your vault or resumes, and every admin action is recorded. No system is perfectly secure. If a personal data breach affects you, we'll tell you and the Data Protection Board of India as the DPDP Act requires, with what happened and what you can do. ## 10. Your rights Under the DPDP Act you have the right to: - **Get information** about the personal data we hold about you and how it's used, and who it's been shared with. - **Correct or update** it. You can edit most of it yourself in your vault and Settings. - **Erase** it. Delete your account in Settings, or ask us to. - **Withdraw consent** at any time. This stops further processing, which means we can no longer make resumes for you. It doesn't affect what was done before. - **Nominate** someone to exercise these rights for you if you die or become unable to. - **Raise a grievance** with us, and if you're not satisfied, complain to the Data Protection Board of India. Email [support@hiremast.in](mailto:support@hiremast.in?subject=Privacy%20request) from the address on your account. We acknowledge requests within 24 hours and respond within 15 days. We may need to confirm it's really you first. ## 11. Children Hiremast is for people aged 18 and over. We don't knowingly collect personal data from anyone under 18. If you believe someone under 18 has an account, tell us and we'll delete it. ## 12. Colleges and placement cells If your college gives you Hiremast, your vault and resumes are still private to you. Your college sees only what you choose to share, or what a separate written agreement with it says. We'll tell you what that is before you sign up through them. ## 13. Changes to this policy If we change this policy in a way that matters, we'll tell you by email or in the app before it applies, and ask for your consent again where the law requires it. The date at the top shows the latest version.