Privacy Policy

1. Who is responsible for your data

[URUV legal entity name] is the Data Fiduciary for personal data processed through ReadyX. For workspace learners, the Workspace Owner (your college, employer or partner) also decides how your workspace data is used and is responsible for its own use of it.

2. Personal data we collect

We collect only what we need to run the Service:

• Account data: name, email, phone (optional), password hash, role, workspace membership.
• Profile and career data: education, target roles, skills, experience, location (city level), resume files and the text we extract from them.
• Interview data: questions, your spoken answers (audio, processed for transcription), transcripts, scores, feedback, proctoring snapshots (periodic still images) and focus/fullscreen events.
• Payment data: plan, amount, GST billing details and payment status. Card, UPI and bank details are entered on Razorpay and never stored by ReadyX.
• Usage and device data: pages used, feature events, IP address (stored hashed for security logs), browser type, and error logs.
• Communications: support tickets, enquiries and Career Buddy chat messages.

3. Why we use it (purposes and legal basis)

We process personal data on the basis of your consent and for legitimate uses permitted by law, for these purposes:

• Providing interviews, scoring, reports, readiness, resume analysis, learning plans and job matching;
• Sharing results with your workspace admins when you belong to a workspace;
• Billing, GST invoicing, fraud prevention and refunds;
• Security, abuse prevention, rate limiting and integrity of proctored assessments;
• Service emails (activation, receipts, reports). Marketing emails only with separate consent you can withdraw at any time;
• Improving ReadyX using aggregated or de-identified statistics. We do not sell personal data.

4. Personal data and AI processing

Before your text is sent to an AI model, ReadyX automatically masks personal identifiers — email addresses, phone numbers, Aadhaar, PAN, card, UPI and bank details — and replaces them with placeholders; the real values are restored only inside ReadyX. AI providers process data under contracts that prohibit using it to train their models, and we request zero-retention processing where available. See the AI Usage Policy for details.

5. Who we share it with

We share personal data only with:

• Your workspace admins (for workspace learners) and hiring teams you interview with (for candidate interviews);
• Processors acting on our instructions: Supabase (database, authentication and file storage), OpenAI (AI processing with PII masking), Razorpay (payments), Resend (email), and our hosting provider;
• Authorities when required by law, or to protect users and the Service from fraud or harm.

6. Where data is stored

Data is stored with our cloud providers and may be processed outside India by AI and email processors, subject to contractual safeguards and any restrictions notified by the Government of India.

7. How long we keep it

• Account and profile data: while your account is active, deleted within 30 days of account closure.
• Interview audio, transcripts and proctoring snapshots: as set by your workspace (default 365 days), then deleted.
• Payment and invoice records: 8 years, as required by tax law.
• Security logs: 180 days.

8. Your rights

Under the DPDP Act you can: access a summary of your data and export it; correct or update it; request erasure; withdraw consent; nominate another person to exercise your rights; and raise a grievance. Use Settings → Privacy in the app, or email us. We respond within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

9. How we protect your data

Encryption in transit (HTTPS/HSTS) and at rest; row-level access controls so each user and workspace sees only its own data; least-privilege admin access; strict security headers and content security policy; rate limiting and cross-site request protection; masked PII in AI requests and logs; payment data handled by a PCI-DSS compliant provider; regular dependency and access reviews. Report vulnerabilities to security@readyx.in.

10. Children

ReadyX is designed for adults and university students. We do not knowingly process the personal data of children (under 18) without verifiable parental consent, and we do not track or target advertising at children.

11. Cookies

We use essential cookies for sign-in sessions and security, and local storage for preferences such as theme. We do not use third-party advertising cookies.

12. Contact

Privacy questions: privacy@readyx.in. Grievance Officer: [Grievance Officer name], grievance@readyx.in, [Registered office address], Chennai, Tamil Nadu, India.