Privacy Policy

1. Information we collect

1.1 Information you provide

Account data. Name, email address, and password when you register. Passwords are stored only as a cryptographic hash (argon2id); we cannot read them.

Career log data. The core of PurpleHunt is a private log of your career: roles, companies, dates, projects, achievements, skills, education, certifications, and the stories and details you record about them, organized into chapters and tags. This may include anything you choose to write about your working life. You may mark parts of an entry confidential; confidential content receives the additional protections in Section 4.4.

Documents and imports. Files you upload, such as resumes, and the text extracted from them.

Job data. Job descriptions you paste, jobs you save, applications you track, and notes you attach to them.

Voice data. If you use voice input, your audio is sent to our AI provider for transcription. We keep the transcribed text in your log; the audio itself is not retained by PurpleHunt after transcription completes.

Payment data. If you buy credits, payment is handled by Razorpay, our payment processor. We receive confirmation of payment, the amount, and a masked reference; we never receive or store your full card number.

Communications. Messages you send to [email protected] and your correspondence with us.

1.2 Information collected automatically

Usage data. Actions taken in the app (features used, generations requested, credits consumed), timestamps, and error events — used to operate, secure, and improve the Services.

Device and connection data. IP address, browser type and version, operating system, device type, screen size, language, and referring pages.

Cookies and similar technologies. We use strictly necessary cookies for sign-in and session security. If we use analytics cookies, they are disclosed and controllable in your cookie settings, and we honor rejection with the same ease as acceptance. We do not use advertising cookies or cross-site tracking.

Visitors without accounts. If you browse our public pages without an account, we collect only the device/connection data and strictly necessary cookies described above, plus anything you actively submit (e.g., an email to our waitlist or support). Public profiles you view were published by their owners.

1.3 Information we generate about you

When you use AI features, the Services produce derived content tied to your account: generated resumes and cover letters, match and fit scores, gap analyses, interview questions and feedback, and the trace records that link generated claims back to your own entries. This content exists for you; it is treated as your personal data with the same protections.

1.4 Information from other sources

Public job postings. We collect publicly available job listings from the web so we can show and match them to you. These are data about jobs and employers, not about you.

We do not purchase data about you from data brokers, enrich your profile from third parties, or collect data about you from social networks.

1.5 Information we ask you not to submit

The Services do not need, and we ask you not to enter: government identification numbers (PAN, Aadhaar, SSN, passport numbers), financial account numbers, health records, biometric data, or other people’s confidential information. If you include such information inside free-text entries, it is stored as part of your entry under the same protections, but we do not seek it, index it specially, or use it.

2. How we use your information

We use personal data only for the purposes below. Where GDPR applies, the legal basis is noted.

1. Providing the Services — maintaining your career log, storing your documents, tracking applications, rendering your dashboard. (Contract)
2. Generating content you request — when you ask for a resume, cover letter, score, or coaching, the relevant parts of your career log and the job description are processed by AI to produce it. AI features run only when you invoke them. (Contract)
3. Grounding and honesty checks on AI output— every generated claim about you is traced against your own entries; untraced lines are flagged to you for review. This is a check on our AI’s output, never on the truth of your record. (Contract / legitimate interest in accurate output)
4. Accounts, credits, and billing. (Contract)
5. Support — responding when you contact us. (Contract / legitimate interest)
6. Security and abuse prevention — authentication, rate limiting, fraud and abuse detection, audit logs. (Legitimate interest / legal obligation)
7. Service improvement — analyzing aggregated, de-identified usage patterns to fix bugs and improve features. We do not use the content of your career log for this. (Legitimate interest)
8. Communications — transactional notices (receipts, security notices, material changes), sent by email or in-app notice. Marketing email only with your consent, and every marketing email contains a working unsubscribe. (Contract; consent for marketing)
9. Legal compliance — responding to lawful requests and meeting record-keeping obligations. (Legal obligation)

We do not use your data to:train or fine-tune AI models (ours or anyone’s); build advertising profiles; sell or rent to anyone; or evaluate you on behalf of any employer.

3. AI processing — full disclosure

Because AI is central to PurpleHunt, here is exactly how it works:

• What is sent.When you invoke an AI feature, the inputs needed for that feature — relevant career log entries, the job description, your instructions — are transmitted to our AI provider’s API for processing. Nothing is sent when you are not using an AI feature.
• Who processes it. Our current AI provider is OpenAI, L.L.C. (United States), under API terms which provide that API inputs and outputs are not used to train their models. If we change or add providers, we will update the sub-processor list in Section 4.3 before the change takes effect.
• What comes back. Generated text and scores, which are stored in your account as yours.
• Grounding. Generated claims about you are traced to your entries. Lines that cannot be traced are visibly flagged and are never silently accepted into your documents.
• Human decisions stay human. PurpleHunt does not make automated decisions about you that produce legal or similarly significant effects. Match scores and analyses are estimates presented to you, for you to act on; no employer, recruiter, or third party receives them, and no application is filtered, ranked, or rejected by us. You always review generated documents before using them.
• Confidential content. Content you marked confidential in an entry is never included in publishable output — de-identified or otherwise (see 4.4).

4. How your information is shared

4.1 With no one, by default

Your career log, documents, applications, and generated content are private to your account. There is no discovery, no search of members, and no employer-side access to your data.

4.2 When you choose to share

• Public profile. If you publish a shareable profile, the content you selected for it is visible to anyone with the link, and may be indexed by search engines, until you unpublish it. People you share the link with may share it onward, and viewers may copy or save what they see — as with anything public, we cannot control redistribution by others. Unpublishing removes it from the Services immediately; third-party caches (e.g., search engines) are outside our control.
• Documents you export. A resume or letter you download and send is shared by you, not by us.

4.3 Service providers (sub-processors)

We share data with vendors who process it only on our instructions, under contracts restricting use to providing their service to us:

Our database is self-hosted on our own AWS infrastructure, not a managed third-party database service — so the number of companies that can reach your career log is the number in this table, and no larger.

We do not currently use a transactional email provider. When one is added it will appear in this table before it processes any of your data, on the same commitment as every other addition.

The live, named list is maintained at this page and updated before any addition.

4.4 What we never share

• Content you marked confidential in an entry is never included in publishable or shareable output, whether or not it is de-identified.
• We do not sell personal data, and we do not share it for cross-context behavioral advertising (in CCPA terms: no “sale” and no “sharing”).
• We do not give employers, recruiters, or partners access to your data. If we ever build features involving employers, they will be strictly opt-in, separately disclosed, and this policy will be updated first.

4.5 Legal and structural

We may disclose data if required by law, court order, or governmental authority, or where necessary to protect the rights, safety, or property of our users or the Services — and only to the extent required. If PurpleHunt is involved in a merger, acquisition, or asset sale, your data may transfer as part of it; we will notify you before your data becomes subject to a different privacy policy, and you will be able to delete your account first.

5. Data retention

• Account and career log data: retained while your account is active.
• Account deletion: deleting your account permanently deletes your career log, documents, applications, and generated content within 30 days, except records we must keep by law.
• Backups: deleted data may persist in encrypted backups for up to 35 further days before backup rotation removes it; backups are not used to restore deleted accounts.
• Payment and tax records: retained 8 years as required by Indian law.
• Support correspondence: retained 24 months after the ticket closes.
• Server and security logs: retained 90 days, then deleted or de-identified.
• Voice audio: not retained after transcription (Section 1.1).

6. Security

We protect your data with, among other measures: encryption in transit (TLS) for all connections; encryption at rest for databases and backups; argon2id password hashing; role-restricted access to production systems limited to personnel who need it; separated environments; and logging of administrative access. No internet service can promise perfect security, but if a breach affects your personal data, we will notify you and the relevant authorities (including India’s Data Protection Board) within the timelines applicable law requires, and tell you what happened and what we are doing.

7. International transfers

We operate from India, and your personal data is hosted in India — our application and database run on Amazon Web Services infrastructure in the Mumbai region, and our payment processor also processes data in India.

Your data leaves India for one purpose only: AI processing in the United States, and only the inputs needed for the feature you invoked, exactly as described in Section 3. Nothing is transferred when you are not using an AI feature.

Wherever your data is processed, it is protected by this policy and by our contracts with those providers. For EEA/UK users, transfers rely on appropriate safeguards such as standard contractual clauses.

8. Your rights and choices

8.1 Everyone, everywhere

Regardless of where you live, you can: access your data in the app; correct anything in your log at any time; export your data by request; delete individual entries, documents, or your whole account; and unpublish your public profile instantly. Write to [email protected] for anything you cannot do in-app. We respond within 30 days. We will never discriminate against you for exercising a privacy right.

8.2 India (DPDP Act, 2023)

You have the rights of access, correction and erasure, the right to nominate a person to exercise your rights in case of death or incapacity, and the right to grievance redressal. Where processing rests on consent, you may withdraw it at any time, and withdrawal is as easy as giving it. Grievances: write to our Grievance Officer at [email protected] with the subject “Grievance” — acknowledged within 72 hours, resolved within 30 days. If unsatisfied, you may approach the Data Protection Board of India.

8.3 United States state laws (California and others)

In the categories used by US state laws, we collect: identifiers (name, email, IP), professional and employment-related information (your career log and documents), education information, commercial information (credits and purchases), internet activity (usage data), audio (voice input, transcribed then discarded), and inferences you request (scores and analyses). We do not collect precise geolocation, biometric identifiers, or — by design — the sensitive categories listed in Section 1.5, and we do not seek consent to process sensitive personal data because we do not ask for it.

You have the rights to know, access, correct, delete, and port your personal data, and to opt out of sale, sharing, and targeted advertising — noting that we do not sell or share personal data or serve targeted advertising, so there is nothing to opt out of. We do not use automated decision-making technology that produces legal or similarly significant effects on you. You may appeal a refused request by replying to our decision; appeals are reviewed by a different reviewer within 45 days. Authorized agents may submit requests with proof of authorization.

8.4 EEA / UK (GDPR)

You have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with your supervisory authority. Our legal bases are set out in Section 2. We do not perform automated decision-making under Article 22.

8.5 Verification

For privacy requests made by email, we verify identity by confirming control of the account email. We never ask for government ID for verification.

9. Children

The Services are for adults building careers. You must be 18 or older. We do not knowingly collect data from anyone under 18; if we learn we have, we delete the account. If you believe a minor is using PurpleHunt, contact [email protected].

10. Do Not Track and GPC

We do not track you across other sites, so there is nothing for Do Not Track to disable. We honor Global Privacy Control signals as an opt-out of sale/sharing — which is already our default state.

11. Changes to this policy

We will post updates here with a new “last updated” date. For material changes we will notify you by email or in-app notice at least 15 days before they take effect. If you object, you may delete your account before the change applies; continued use after the effective date is acceptance.

12. Contact

PurpleHunt · Bengaluru, Karnataka, India

All privacy matters and Grievance Officer: [email protected]