Privacy notice
This is a standalone notice, separate from our terms of service, as required under India’s Digital Personal Data Protection framework. It explains what we collect, why, how long we keep it and what you can make us do about it.
Last updated: [DATE] · Effective from: [LAUNCH DATE]
[PLACEHOLDER] with your real company details, and (b) have an Indian lawyer review the whole thing. Your payment gateway will also require these pages to be live and complete before approving your merchant account. Delete this box before publishing.
1. Who we are
Resume Mint is operated by [COMPANY_LEGAL_NAME], a company registered in India at [REGISTERED_ADDRESS]. For the purposes of the Digital Personal Data Protection Act, 2023 and the rules made under it, we are the Data Fiduciary in respect of the personal data described below. You are the Data Principal.
2. What personal data we collect
We collect the following categories of personal data:
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, Google account identifier | You, via Google sign-in |
| Resume content | Name, phone number, postal address, date of birth, photograph, education history, employment history, skills, certifications, projects | You, entered into the editor |
| Transaction data | Order records, amounts, payment reference numbers, invoices | You and our payment gateway |
| Technical data | IP address, browser and device type, timestamps, access logs | Automatically, when you use the site |
We never ask for and never store: card numbers, bank account details, UPI PINs, passwords for other services, Aadhaar or PAN numbers, or any government identification number. If you enter any of these into a resume field, please remove them — they do not belong on a resume and we do not want them.
3. Why we collect it
- To build and deliver your resume. This is the core purpose; without your resume content there is no product.
- To operate your account. Signing you in, saving your work, letting you return and edit.
- To process payments and issue invoices, including meeting tax and accounting obligations.
- To provide support when you contact us about an order or a problem.
- To keep the service secure, including detecting fraud and abuse.
- To send service communications — order confirmations, download links, material changes to this notice. If you joined the waitlist, to tell you when we launch.
We do not use your resume content to train machine learning models, and we do not use it for advertising.
4. Consent
We process your personal data on the basis of the consent you give when you create an account and when you enter information into the editor. Consent is requested in clear language, for specified purposes, and separately from our terms of service.
You may withdraw consent at any time. Withdrawing consent means we can no longer provide the service, so it is functionally the same as closing your account — we will tell you this clearly before you confirm. Withdrawal does not affect the lawfulness of processing carried out before it.
Where we materially change the purposes for which we process your data, we will ask for consent again rather than assuming the old consent covers it.
5. Who we share it with
We do not sell personal data. We do not share resumes with recruiters, job boards, staffing agencies or advertisers.
We share limited data with service providers who process it on our behalf, under written agreements that restrict what they may do with it:
| Provider | Purpose | Data shared |
|---|---|---|
| Cloud hosting (Amazon Web Services, Mumbai region) | Running the service and storing your data | All categories, encrypted |
| Payment gateway ([GATEWAY_NAME]) | Processing UPI payments | Name, email, order amount — never resume content |
| Email provider ([EMAIL_PROVIDER]) | Sending confirmations and download links | Name, email address |
| Error monitoring ([MONITORING_PROVIDER]) | Diagnosing faults | Technical data only, with personal data scrubbed |
We may also disclose data where required by law, by a court, or by a competent authority acting within its powers.
6. How long we keep it
| Data | Retention |
|---|---|
| Draft resumes never purchased | Deleted after [12] months of account inactivity, with prior email notice |
| Purchased resumes and generated PDFs | Retained for [24] months from purchase, then deleted with prior notice |
| Account data | Until you delete your account |
| Transaction and invoice records | Retained for the period required by Indian tax law, currently [8] years, even after account deletion |
| Access and security logs | [12] months |
When the purpose for which data was collected is complete and no legal obligation requires us to keep it, we delete it.
7. Your rights
As a Data Principal you have the right to:
- Access a summary of the personal data we hold about you and how we process it.
- Correct data that is inaccurate, and complete data that is incomplete.
- Erase your personal data where it is no longer needed for the purpose it was collected for.
- Withdraw consent at any time, as described in section 4.
- Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
- Complain to us through our Grievance Officer, and thereafter to the Data Protection Board of India if you remain dissatisfied.
Most of these you can exercise yourself from your account settings. For anything else, write to our Grievance Officer at [GRIEVANCE_EMAIL]. We acknowledge requests within 24 hours and resolve them within 90 days.
You also have a duty, under the Act, not to impersonate anyone else and not to file false or frivolous complaints.
8. How we protect it
- Encryption in transit (TLS) and at rest for all stored personal data.
- Access to production data restricted to named personnel, with multi-factor authentication and access logging.
- Generated PDFs stored in private storage and served only through short-lived, single-use links tied to your account.
- Uploaded photographs re-encoded on receipt, which removes embedded metadata including any GPS coordinates recorded by your camera.
- Personal data scrubbed from application logs and error reports.
- Regular backups, with restoration tested rather than assumed.
9. Children
Resume Mint is not directed at children. You must be 18 or older to create an account. We do not knowingly collect personal data of children, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children. If you believe a child has given us personal data, contact our Grievance Officer and we will delete it.
10. If something goes wrong
In the event of a personal data breach we will notify the Data Protection Board of India and every affected user without delay, and in any case within the timelines the law requires, describing what happened, what data was involved, what we are doing about it and what you should do.
11. Changes to this notice
If we change this notice materially we will email you and, where the change affects the purposes of processing, ask for your consent again. The version and date at the top always reflect the current text.
12. Contact
Grievance Officer: [GRIEVANCE_OFFICER_NAME]
Email: [GRIEVANCE_EMAIL]
Post: [COMPANY_LEGAL_NAME], [REGISTERED_ADDRESS]
If we do not resolve your complaint to your satisfaction, you may escalate it to the Data Protection Board of India.