Privacy Policy

DIYguru Mobility Pvt. Ltd. (Private Limited Company, CIN/LLPIN U35999DL2021PTC390357) operates the Platform from its registered office at 374, MG Road, New Delhi, Delhi 110030, India. For any privacy-related question, contact [email protected] or our Grievance Officer (details at the end of this page).

We collect the following categories of data:

• Account information — name, email, password (hashed), phone, role (candidate / employer / admin), preferred locale, profile photo URL. Provided by you at signup, or imported from a third-party identity provider (Google or LinkedIn) if you choose social sign-in.
• Profile content — résumé, work experience, education, certifications, skills, awards, projects, languages spoken, salary expectations, location, social links, custom CTA, and any other content you publish to your public profile.
• Recruitment activity — applications submitted, jobs saved, messages exchanged with employers, interview slots, mentorship bookings, recommendations given and received, peer skill endorsements.
• Verification data — DIYguru student ID (where applicable), email-domain proof for employer verification, KYC documents uploaded by employers for company approval.
• Payment data — for paid features (mentor sessions, featured listings, premium employer plans), our payment processor (Razorpay) collects card or UPI details directly. We never store full card numbers; we receive a tokenised reference and the success/failure status of each transaction along with masked metadata (last four digits, card brand) for receipts and refunds.
• Technical data — IP address, user-agent string, device type, referral source, pages visited, click events, error logs, and session identifiers. Used to operate, secure, and improve the Platform.
• Cookies & similar technologies — see the "Cookies" section below.

We do not knowingly collect data from children under 18. The Platform is intended for adult professionals and students preparing for the workforce; if we learn we've collected a minor's data without verifiable parental consent, we delete it.

We process your personal data only for these purposes:

• To create and operate your account, authenticate you, and keep the service available.
• To match candidates with relevant jobs and employers with relevant candidates.
• To deliver messages, notifications, and email/SMS digests you have opted in to.
• To process payments, invoice you, and provide receipts and refunds.
• To prevent fraud, abuse, spam, scraping, and credential stuffing.
• To comply with legal obligations (tax, court orders, lawful government requests).
• To improve the Platform — anonymous, aggregated analytics on feature usage.

We rely on the following lawful bases under the DPDP Act and applicable laws: your consent (for marketing communications and optional profile fields), performance of a contract (to deliver the service you signed up for), our legitimate interests (security, fraud prevention, product improvement), and legal obligations (e.g. responding to tax or law enforcement requests).

We share data only in the following situations:

• With employers you apply to — your profile, résumé, cover letter, and answers to job-specific questions are visible to the posting employer's recruiting team. You control discoverability via the privacy controls in your profile.
• With other candidates and the public — when your profile visibility is set to "Everyone", your profile is publicly indexable. Set it to "Recruiters only" or "Private" in /me/profile to restrict it.
• With service providers (sub-processors) we engage to run the Platform. They are bound by contract to use data only as instructed:
  • Hosting & storage — our cloud infrastructure provider.
  • Email — Resend (transactional emails).
  • SMS & WhatsApp — MSG91.
  • Payments — Razorpay.
  • Analytics & error reporting — privacy-friendly tooling for product analytics and crash reports.
  • AI features — OpenAI for résumé parsing, JD assistance, and matching reasoning. We do not allow these providers to train models on your data.
• For legal reasons — when required by law, court order, or to protect rights, safety, or property.
• In a business transfer — if eMobility Careers is acquired or merged, your data may be transferred to the successor under the same terms as this Policy.

We do not sell your personal data to advertisers or data brokers.

Some of our sub-processors (notably OpenAI, Resend) are located outside India. When we transfer data internationally, we rely on the protections permitted under the DPDP Act and contractually require equivalent safeguards from those providers. Personal data of users located in the European Economic Area is processed under the GDPR's standard contractual clauses.

We retain personal data only as long as needed for the purposes above:

• Account and profile data — until you delete your account.
• Application history — for 24 months after the application closes, then anonymised for analytics.
• Messages — for 36 months for dispute resolution; you can delete individual threads at any time.
• Payment records — for 8 years to comply with the Income Tax Act.
• Server logs — for 90 days, then aggregated.

When you delete your account, we erase or anonymise all data tied to you within 30 days, except records we are legally required to keep.

Subject to verification of identity, you have the right to:

• Access a copy of the personal data we hold about you.
• Correct inaccurate or incomplete data — most fields are editable from /me/profile.
• Delete your account and the associated data.
• Withdraw consent for marketing or optional processing.
• Restrict or object to certain processing.
• Port your data — receive an export in a machine-readable format.
• Nominate another individual to exercise these rights on your behalf in case of incapacity (DPDP Act, Section 14).
• Lodge a complaint with the Data Protection Board of India.

To exercise any of these, write to [email protected]. We respond within 30 days.

We follow industry-standard practices: TLS 1.2+ in transit; passwords hashed with bcrypt; encrypted backups; least-privilege access controls; rate limiting and bot mitigation; regular dependency audits; logged and monitored privileged actions. No system is perfectly secure — if you suspect your account has been compromised, contact [email protected] immediately.

We use strictly-necessary cookies for authentication, CSRF protection, and locale preference. Optional analytics cookies record pseudonymous page-view metrics; these can be declined via your browser's do-not-track setting. We do not use third-party advertising cookies.

We may update this Policy when we add features, change sub-processors, or when the law changes. The "Last updated" date at the top will reflect the revision; substantial changes are emailed to registered users. Continued use of the Platform after a change constitutes acceptance.

We acknowledge complaints within 24 hours and resolve them within 15 days, as required by the IT Rules.