Privacy Notice

JobsEye (operated by Permutohedron Technologies Private Limited) is the Data Fiduciary responsible for the personal data described here. For any privacy question, to exercise your rights, or to raise a grievance, contact our Grievance Officer at jobseye@infiniteleapai.com. We aim to respond to rights requests within a reasonable period.

JobsEye is operated from India, and this notice is written to the Digital Personal Data Protection Act, 2023. We apply the same rights and the same grievance channel to everyone who uses JobsEye, wherever you are.

You may read this notice in English or in any language specified in the Eighth Schedule to the Constitution. A Hindi version is published alongside this one. For any other Eighth Schedule language, email the Grievance Officer and we will provide it.

What you give us:

• Identity and contact: name, email, phone, postal address, profile photo (from Google Sign-In).
• Aadhaar number, only if you choose to give it: some employers' own application forms will not go through without a national identifier. If you add your Aadhaar number, we keep it encrypted, show it back to you and to our staff only as its last four digits, and type it only into the form of an employer that requires it, when you apply there. We do not use it to verify who you are, and you can remove it at any time in Settings.
• Your resume: the PDF/DOCX file you upload and the text we extract from it.
• Career profile: work experience, skills, education, salary expectations, work authorisation, notice period, social links.
• Optional diversity fields: gender, pronouns, ethnicity, veteran and disability status, only if you choose to provide them; the default is "Prefer not to say". We put them only on a form that asks for them, and you can change or clear them in Settings at any time.
• Answers to employers' screening questions, which we remember so that you do not answer the same question twice.
• Account security: if you sign up with email and password, we store a securely hashed version of your password (never the password itself).

What the service creates for you:

• An application mailbox in your name, and the employer mail it receives. This is section 4, and it is worth reading.
• Employer account credentials where an employer requires an account before you can apply. This is section 5.
• Application run records: the events of a run, the field values it filled, and screenshots of the employer page while the run is on it, so you can watch an application being prepared and see what was sent.

What we collect automatically:

• Activity: searches you run, jobs you save, skip or apply to, run history, feedback, and sign-in sessions.
• Technical and log data: IP address, browser and device information, and timestamps, used for security, rate limiting and diagnosing faults.
• Billing records: which pack you bought and when, and the identifiers our payment processor returns for the order. We never receive or store your full card or banking credentials.

• To parse your resume and generate suitable job roles.
• To search employer career pages and match real jobs to you.
• To pre-fill and submit job applications on your behalf when you use Auto-Apply.
• To create and sign in to employer accounts where an employer requires one before you can apply.
• To receive the mail employers send about your applications, so a run is not blocked waiting on a code and so replies reach you.
• To operate your account, credits, referrals and notifications.
• To take payment for the application packs you buy.
• To maintain security, prevent abuse, and diagnose faults.

We process this data on the basis of the consent you give us before use.

Many employer portals will not accept an application until you hold an account with them, and they gate that account behind a code or an activation link sent by email. So JobsEye issues you a mailbox on a domain we hold, carrying your name, and uses that address on the employer accounts it creates for you.

This is a real mailbox, and it matters that we say so. We receive the mail sent to it, store the sender, subject and body, and label each message by company and type so it appears in your Messages. Because it is real, mail sent to it can reset the password on every employer account created with it.

That is why you can set a forwarding address of your own, and why we ask you to. Messages we receive are also relayed there, so you always hold your own copy. Three kinds are not: the link that activates a new employer account, which we open ourselves, and sign-in codes and password-reset mail. These stay in your Messages, where you can read them whenever you need them, so an employer account remains recoverable by you rather than only by us. Until you set one, employer mail about your applications reaches only us.

• Everything in this mailbox is kept for 90 days. Interview invitations, recruiter replies and rejections are the reason the mailbox is worth having. Sign-in codes are kept for the same 90 days: a code stops working minutes after it is used, and deleting them earlier risked deleting a real letter mistaken for one. Each message is also kept exactly as it arrived, so that a link or attachment we failed to read can still be recovered; that copy goes after the same 90 days, and with your account.
• We read this mail only to progress your applications and to show it to you. Message bodies are never written to our logs.

You can answer an employer from this address. When an employer's letter can be answered, write your reply in your JobsEye inbox, or reply to the copy we forward to you: we send your reply to the person who wrote, from this address, in your words and with nothing added. A reply to a forwarded copy is read only to do that, and one that is not clearly meant for the employer is not sent but looked at by a person on our team. You are copied on what is sent, and we keep it for the same 90 days as the letter it answers. We do not write to an employer from this address on our own.

Deleting your account deletes these messages and stops the address resolving, so mail sent to it afterwards reaches nobody.

Where an employer requires a candidate account before you can apply, we create and use one on your behalf, using your application mailbox address and a password held for you. We also keep a record of which employers you hold such an account with.

That password is encrypted at rest and is never stored in plain text.

These accounts are yours. Deleting your JobsEye account removes the stored password and the record of which employers you have accounts with. It does not delete the account you now hold with the employer, which lives in that employer's system under that employer's own privacy policy. That is the other reason to set a forwarding address in section 4 while your account is live.

We send your resume text, the job description, and the employer's question to a generative AI provider under contract, so we can extract suitable roles, judge whether a job fits, and draft answers in your voice.

We do not sell your personal data, and we do not use it to train AI models.

We remember your answers so you do not answer the same question twice. Two kinds of answer are never remembered and never replayed:

• Self-certifications: an attestation only you can make, and only for the application in front of you.
• Consent and terms checkboxes: a legal act, performed once per application.

What we learn from your applications, so that later applications work better, is about the employer's form and never about you. Nothing personal to you is carried out of your applications into anyone else's.

We do not sell your personal data. To run the service it is shared only with:

• Employers and their applicant tracking systems: when you use Auto-Apply, your details, resume and the answers you confirm are entered into the employer's own application system and submitted to that employer, where they fall under the employer's own privacy policy. You choose the roles, and by default we submit the completed application on your behalf; you can turn automatic submission off, in which case each application is presented to you and you submit it yourself.
• Google, for sign-in if you choose it, for the cloud infrastructure your data is stored on, for the generative AI described in section 6, and for finding job listings.
• Razorpay, our payment processor, when you buy an application pack. They receive what is needed to take the payment and handle your card or banking details directly, under their own terms; we do not receive or store them. The payment is collected on our behalf by Exquisite Archangels Management Consultants Private Limited, which receives the order and whether it was paid, never your card or banking details.
• Other service providers under contract, who process your data only on our instructions to operate JobsEye: storing your files, sending account email, and error monitoring that is configured not to send personal data.
• Where the law requires it, or to establish or defend a legal claim.

A current list of the providers we use is available from the Grievance Officer on request.

Your data is held on Google Cloud, in access-controlled managed databases and file storage. Some of the providers described in section 7 process data outside India in the course of delivering their service. The DPDP Act permits such transfers except to countries the Government restricts, and we do not transfer your personal data to any restricted country.

We keep your personal data while your account is active and for as long as needed for the purposes above. Your mailbox runs on its own shorter clock, described in section 4: everything in it, sign-in codes included, is deleted after 90 days.

A resume you upload before signing up. To show you matching roles before you have an account, we read the resume once and keep what we read from it (your details, work history and a short summary used for matching) for 24 hours, so it can carry into your account if you sign up. We do not store the file itself. If you do not sign up within 24 hours, what we read is deleted.

When you withdraw consent or delete your account, we erase your personal data from our systems. That covers your account record, profile, resume files, parsed text, search results, saved and applied jobs, run history, stored employer credentials, and your mailbox and its messages. A minimal, non-identifying erasure log is retained only to demonstrate compliance, along with any record the law requires us to keep, such as those relating to a payment.

When you delete your account we ask why you are leaving. Answering is optional and nothing about it affects the deletion. If you do answer, we keep what you tell us without your name, your email or anything else that identifies you, so it survives the erasure as a comment about the product rather than as a record about you.

• Access: download a copy of your account, profile, resume and application data at any time (Account, Privacy and Data, "Export my data"). Some of what we hold is not part of that download, including your mailbox messages, your saved jobs and your run history. Ask the Grievance Officer for those and we will send them to you.
• Correction and updating: edit your profile and resume details at any time from your Account page.
• Erasure: permanently delete your account and all personal data (Account, Privacy and Data, "Delete my account").
• Withdraw consent: as easy as giving it (Account, Privacy and Data, "Withdraw consent").
• Grievance redressal: contact our Grievance Officer above. If unsatisfied, you may complain to the Data Protection Board of India.
• Nominate: you may nominate another individual to exercise your rights in the event of death or incapacity. Email the Grievance Officer to register a nominee.

We use access-controlled cloud infrastructure, and access to your data is scoped to your own account. Passwords, when used, are stored only as a strong one-way hash, and the employer credentials described in section 5 are encrypted at rest.

No system is perfectly secure, but we take reasonable safeguards to protect your personal data and will notify you and the Board of a breach as required by law. If you believe you have found a security issue in JobsEye, please report it to jobseye@infiniteleapai.com and give us a reasonable opportunity to fix it before disclosing it publicly.

We do not use advertising cookies, and JobsEye takes no part in cross-site behavioural advertising.

• Staying signed in: your browser stores a sign-in token so you are not asked to log in on every visit. Clearing your browser's storage for this site signs you out.
• Strictly necessary: our infrastructure may set cookies needed to route and secure requests. These cannot be turned off without breaking the site.
• Error monitoring: a short-lived identifier may be attached to a client error so we can match it to our own logs. It is configured not to send personal data.

JobsEye is intended for users who are 18 or older and able to enter the workforce. We do not knowingly process the personal data of children without verifiable parental consent.

We revise this notice when the way we handle your data changes, and show the revision date at the top. Where a change introduces a new purpose rather than describing more clearly what we already do, we will raise the notice's version and ask for your consent again before continuing.