Who we are

Email: info@careerscraft.com

Students under 18

Careers Craft is designed for school and college students, and we expect many users to be under 18. Under India's Digital Personal Data Protection Act 2023, a person under 18 is a Child, and processing their personal data requires verifiable consent from a parent or lawful guardian.

Where an account is identified as belonging to a Child, we obtain parental consent before processing, we do not use their data for behavioural advertising or tracking, and we do not undertake processing likely to cause a detrimental effect on their wellbeing.

A parent or guardian may at any time request access to, correction of, or deletion of their child's data by writing to our Grievance Officer, named at the end of this policy.

We do not run behavioural analytics on accounts belonging to a Child. Product analytics that record how individual users click through the site are not loaded at all for school-band accounts — the tracking is never started, rather than started and then opted out of. We still count aggregate, non-behavioural operational events (such as how many career plans were generated in a day) so we can run and bill for the service.

What we collect

Account details: name, email address, password (stored only as a salted hash), role, and where applicable your institute, class and grade.

Profile and career data: the answers you give in assessments and quizzes, career interests, skills, goals, résumés, portfolios and any documents you upload.

Usage data: pages visited, features used, approximate device and browser information, and IP address, used to keep the service secure and to understand which features are worth improving.

Payment data: we do not store card numbers. Payments are processed by Razorpay, and we retain only the transaction identifiers and invoice records we are legally required to keep.

Why we use it

To provide the service you signed up for — generating career paths, assessments, reports, portfolios and recommendations.

To operate your account, process payments, issue invoices and provide support.

To keep the platform secure, prevent abuse, and meet our legal and tax obligations.

To improve the product. Where we analyse usage for this purpose we do so in aggregate, and we exclude accounts identified as belonging to a Child from behavioural analytics.

Artificial intelligence

Several features generate content using third-party AI models. The prompts and content needed to produce your result are sent to that provider for processing.

AI output can be wrong. Career guidance, assessment interpretation and generated study plans are informational and are not professional counselling, medical, legal or financial advice.

Who we share it with

Service providers who host, secure and operate the platform on our behalf, under contract and only for that purpose.

Your institute, if you use Careers Craft through a school or college. Your institute's administrators and assigned teachers can see your progress and assessment results within that institute.

Your parent or guardian, where a parent account is linked to yours.

Authorities, where we are legally required to disclose.

We do not sell personal data.

Our Sub-processors page names every third party that handles personal data on our behalf, what each one receives and where it operates. Our Data Residency page sets out where your data is stored and which processing takes place outside India.

How long we keep it

We keep account and career data while your account is active.

If you delete your account, we delete or irreversibly anonymise your personal data, except records we must retain for statutory reasons such as tax and accounting. We record an erasure receipt so we can confirm to you what was deleted and when.

Our retention schedule:

Account profile, assessments, reports, résumés and portfolios — kept while the account is active, deleted when the account is deleted.

AI prompt logs (a short truncated preview of what was sent to an AI model, used to detect abuse and duplicate requests) — 30 days.

Feature usage records used for billing and capacity planning — 24 months, in aggregate form after that.

Security records: sign-in sessions, rate-limit records and administrative audit logs — 12 months, retained after account deletion where we need them to investigate abuse or fraud.

Invoices, payment records and tax documents — 8 years, as required by the Companies Act 2013 and GST law. We keep these even after you delete your account, because we are legally obliged to.

Database backups — 30 days, after which the backup and anything in it is destroyed. This means a deletion you request today can persist in a backup for up to 30 more days before it is gone everywhere.

Dormant accounts

If you do not sign in for an extended period we will email you before doing anything, and if you still do not return we will delete the account and its career data.

Your rights

You may access the personal data we hold about you, correct it if it is wrong, request its deletion, and withdraw consent where processing relies on consent.

You can export your data and delete your account from your account settings. If anything there does not work, write to us and we will action it manually.

You have the right to nominate another person to exercise these rights on your behalf in the event of death or incapacity, as provided under the DPDP Act.

Security

We protect accounts with hashed passwords, encrypted connections, access controls and audit logging, and we offer two-factor authentication.

A Careers Craft support agent can only enter your account after you have given consent, either in the app, through a link emailed to you, or with a one-time code you read out. You can see and revoke any such access from your account settings at any time, and everything done during that session is logged against the agent.

No system is perfectly secure. We maintain a written incident response plan with defined severity levels, a named decision-maker and set notification deadlines. If a breach affects your personal data we will notify the Data Protection Board of India within 24 hours of confirming it, and we will notify you — and, if you are under 18, your parent or guardian — within 72 hours, telling you exactly what was involved and what to do.

If you believe you have found a security vulnerability in Careers Craft, please report it to us privately rather than publicly. Our disclosure policy and contact address are published in the SECURITY.md file of our public repository.

Cookies

We use cookies that are necessary for signing in and keeping your session secure, and — only where you consent — cookies that help us understand product usage.

You can change your choice at any time from the cookie settings link in the site footer.

Grievance Officer

If you have a complaint about how your data is handled, contact our Grievance Officer. We will acknowledge your complaint and respond within the period required by law.

If you are not satisfied with our response, you may escalate to the Data Protection Board of India.