Privacy Policy

1. Information we collect

1.1 Information you provide directly

• Account registration — name, email address, and password when you create an account.
• Job seeker profile — resume, work history, skills, preferred role types, salary expectations, and location preferences you choose to enter.
• Employer / recruiter information — company name, billing address, contact details, and job listing content when you post a role.
• Communications — messages you send to us via contact forms, email, or support chat.
• Newsletter subscription — your email address if you subscribe to our weekly job digest.

1.2 Information collected automatically

• Usage data — pages visited, search queries, job listings viewed, links clicked, and time spent on each page.
• Device and browser data — IP address, browser type and version, operating system, screen resolution, and referring URL.
• Cookies and similar technologies — session cookies for authentication, preference cookies, and analytics cookies. See Section 6 for details.

1.3 Information from third parties

• OAuth providers — if you sign in with GitHub or LinkedIn, we receive your name, email, and public profile data from that provider.
• Payment processors — for paid job postings we use Stripe. We receive a transaction confirmation and the last four digits of your card; we never store full card numbers.
• Analytics partners — aggregated, anonymised traffic data from services such as Plausible Analytics.

2. How we use your information

We use the information we collect to:

• Provide, operate, and improve the Careerraft platform and services.
• Match job seekers with relevant job listings based on their profile and search behaviour.
• Process payments for job postings and issue invoices to employers.
• Send transactional emails — account confirmations, password resets, and application notifications.
• Send our weekly job digest newsletter, if you have subscribed (you can unsubscribe at any time).
• Respond to your support requests and communications.
• Detect, prevent, and investigate fraud, abuse, and security incidents.
• Comply with applicable legal obligations.
• Produce aggregated, anonymised analytics to understand how our service is used.

We do not sell your personal data to third parties. We do not use your data for automated decision-making that produces legal or similarly significant effects without human review.

3. Legal basis for processing (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, our legal bases for processing personal data are:

• Contract performance — processing necessary to provide the services you requested.
• Legitimate interests — fraud prevention, security, improving our services, and direct marketing to existing users, where these interests are not overridden by your rights.
• Consent — sending marketing emails to non-customers, and placing non-essential cookies. You may withdraw consent at any time.
• Legal obligation — retaining records required by tax or accounting law.

4. Sharing of information

We share your information only in the following circumstances:

• With employers — if you apply to a job or make your profile visible to employers, relevant profile information is shared with the hiring company.
• Service providers — we engage trusted third-party vendors (hosting, email delivery, analytics, payment processing) under data processing agreements that prohibit them from using your data for their own purposes.
• Business transfers — if Careerraft is acquired or merges with another company, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our site.
• Legal requirements — if required by law, subpoena, or to protect the rights, property, or safety of Careerraft, our users, or the public.

5. Data retention

We retain personal data for as long as necessary to fulfil the purposes described in this policy, or as required by law. Specifically:

• Active accounts — retained for the lifetime of the account.
• Deleted accounts — personally identifiable data is deleted or anonymised within 30 days of account deletion, except where we are required by law to retain records (e.g. payment records for up to 7 years).
• Newsletter subscribers — email address retained until you unsubscribe, after which it is removed within 14 days.
• Server logs — retained for up to 90 days for security and debugging purposes.

6. Cookies

We use the following categories of cookies:

• Strictly necessary — session tokens and CSRF protection. These cannot be disabled as they are required for the site to function.
• Preference — remembering your search filters, display preferences, and timezone. Stored for 1 year.
• Analytics — privacy-friendly, cookieless analytics via Plausible. No personally identifiable data is stored.

You can control non-essential cookies through your browser settings. Disabling preference cookies may affect your experience on the site.

7. Data security

We take reasonable and industry-standard measures to protect your information, including:

• All data in transit is encrypted using TLS 1.2 or higher.
• Passwords are hashed using bcrypt and never stored in plain text.
• Access to production systems and personal data is restricted to authorised personnel only.
• We conduct regular security reviews and promptly address identified vulnerabilities.

No method of transmission over the internet is 100% secure. If you believe your account has been compromised, please contact us immediately at security@careerraft.in.

8. Your rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you.
• Correction — request correction of inaccurate or incomplete data.
• Erasure — request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests or for direct marketing.
• Restriction — request that we limit how we use your data while a dispute is resolved.
• Withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting prior processing.

To exercise any of these rights, email us at privacy@careerraft.in. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

9. International transfers

Careerraft is operated from India. If you are located in the EEA, UK, or another jurisdiction with data transfer restrictions, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses) when transferring your data to countries without an adequacy decision.

10. Children's privacy

Careerraft is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (if you have an account) and update the "Last updated" date at the top of this page. Continued use of Careerraft after the effective date constitutes acceptance of the revised policy.

12. Contact us

If you have any questions, concerns, or requests regarding this Privacy Policy, please reach out: