> For the complete documentation index, see [llms.txt](https://viewzenlabsug.gitbook.io/policies/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://viewzenlabsug.gitbook.io/policies/zenrol/privacy-policy.md).

# PRIVACY POLICY

**Effective Date: 18th July, 2026**

**Last Updated On - 18th July, 2026**

This Privacy Policy explains how **\[ViewZen Labs Pvt. Ltd.]** ("**zenRol**", "**we**", "**us**", "**our**"), operating the **zenRol Match** résumé to job profile matching tool (the "**Service**"), collects, uses, shares, and protects your personal data.

We are the **Data Fiduciary** in respect of the personal data processed through the Service, and you (the person using it) are the **Data Principal**, as those terms are used in the DPDP Act, 2023.

### Information we Collect

We may collect the following types of user data:

**a) Identity & contact data**

* Email address (verified) - the account identifier.
* Optional name and phone number, if you provide them.
* For Google Sign-In: the email address (and basic profile) released by Google when you authorise it.

**b) Content you submit**

* Your **résumé** - the uploaded file (PDF/Word/etc.) and the text extracted from it.
* The **job description** - pasted text, an uploaded file, or the content fetched from a URL you provide.
* Any words you strike out in the "review what the AI will read" step.

**c) Matching results**

* The generated match score, matched and missing skills, suggestions, and the reasoning report.

**d) Payment data**

* Records of your credit purchases: order and payment identifiers, amount, currency, credit quantity, status, and invoice number.
* We do **not** collect or store your card, UPI, or bank details - those are handled directly by our payment processor, **Razorpay** 

**e) Referral data**

* Your referral code, and - if you arrived through someone's referral link - a link to the referring account.

**f) Usage & technical data**

* IP address and coarse request metadata (used for rate-limiting, fraud/abuse prevention, and security).
* Verification-code request logs.
* Local browser storage on your device

### How we use your data

We use the data to:

* Verify your identity and maintain your session
* Produce your match score and suggestions
* Show and let you revisit your past checks
* Process payments and issue tax invoices
* Operate the free tier, credits, and referrals
* Prevent fraud/abuse and secure the Service
* Comply with legal and tax obligations
* Personalize your experience
* Improve application performance and usability
* Communicate important updates

We may share the information provided by you to our partners /affiliates wherever sharing of such information would enable us to serve you better; to detect and prevent identity theft, fraud and other illegal activities. We may share and disclose your information to law enforcement agencies when asked to do so.

We do **not** use your résumé to make automated decisions that produce legal or similarly significant effects about you — the score is informational and advisory only.

### &#x20;AI processing of your résumé and job description <a href="#id-4-ai-processing-of-your-resume-and-job-description" id="id-4-ai-processing-of-your-resume-and-job-description"></a>

To generate the match, the redacted text of your résumé and the job description are transmitted to and processed by **third-party large-language-model (AI) providers** acting as our processors (for example, \[OpenAI, Anthropic, Google, and/or others] - the "**AI Providers**").

* **Redaction:** before the text is sent, we apply automated redaction intended to remove common personal identifiers (such as email, phone, name, and address) and honour any words you struck out. Redaction is automated and **may not remove all identifying information**; the model still processes the substantive content of your résumé (your experience, skills, and history).
* **Provider terms:** we rely on the AI Providers' commitments regarding the handling of API data. Many providers state that data submitted via their API is **not used to train their models**; however, their practices are governed by their own terms, which may change. Review the relevant provider's policy for details.
* **International transfer:** some AI Providers process data on servers **outside India**&#x20;

### &#x20;When we share your data <a href="#id-5-when-we-share-your-data" id="id-5-when-we-share-your-data"></a>

We share personal data only with the following categories of recipients, and only as needed:

* **AI Providers** - to generate the match&#x20;
* **Razorpay** (payment processor) — to take payment and issue receipts. Razorpay processes your payment instrument under its own privacy policy at \[<https://razorpay.com/privacy>].
* **Email/communications provider** - to send verification codes and transactional messages.
* **Hosting & infrastructure** - Supabase / oralce where the Service and its database and file storage run.
* **Google** - if you choose Google Sign-In.
* **Professional advisers, authorities, or acquirers** - where required by law, to enforce our terms, protect rights and safety, or in connection with a corporate transaction, subject to appropriate safeguards.

We require our processors to protect your data and to use it only to provide services to us.

### Data Storage and Security

* Your original uploaded résumé file is stored in a **private (non-public) storage bucket**; access requires a signed, time-limited link.
* Provider/API credentials are stored **encrypted** at rest; API keys are stored only as **irreversible hashes**.
* The Service is served over **HTTPS**, and access to production data is restricted.

No method of transmission or storage is completely secure; while we take reasonable safeguards, we cannot guarantee absolute security. In the event of a personal-data breach, we will notify the Data Protection Board of India and affected users as required by the DPDP Act.

### International data transfers <a href="#id-7-international-data-transfers" id="id-7-international-data-transfers"></a>

Some processors, notably certain **AI Providers**, may store or process your data on servers located **outside India**. Where we transfer personal data abroad, we do so consistent with the DPDP Act and any restrictions notified by the Central Government, and we rely on the processor's contractual and security commitments.

### Your rights <a href="#id-8-your-rights" id="id-8-your-rights"></a>

Subject to the DPDP Act, you have the right to:

* **Access** - obtain a summary of the personal data we process about you and the processing activities.
* **Correction and completion** - have inaccurate or incomplete data corrected or completed.
* **Erasure** - request deletion of your personal data where it is no longer required and retention is not required by law.
* **Withdraw consent** - withdraw consent at any time (this does not affect prior lawful processing, and may mean we can no longer provide the Service).
* **Grievance redressal** - raise a grievance with us and, if unsatisfied, escalate to the Data Protection Board of India.
* **Nominate** -nominate another individual to exercise your rights in the event of death or incapacity.

To exercise any right, contact us at **<support@connect.viewzenlabs.com>**. We will respond within the timelines required by law. We may need to verify your identity before acting on a request.

### Retention <a href="#id-9-retention" id="id-9-retention"></a>

We retain personal data **only as long as necessary** for the purposes in this policy or as required by law:

* **Account and match data** (email, résumé file and text, job descriptions, results): retained while your account is active and for **\[retention period, e.g. 12 months]** after your last activity, after which it is deleted or anonymised, unless you request earlier deletion or law requires longer retention.
* **Payment and tax records**: retained for the period required under applicable tax and accounting law (typically several years).
* **Verification codes**: short-lived and deleted/expired shortly after use.

### Cookies and local browser storage <a href="#id-10-cookies-and-local-browser-storage" id="id-10-cookies-and-local-browser-storage"></a>

The Service uses your browser's local storage (not advertising cookies) to keep you signed in and to remember your session, any referral code you arrived with, and whether you dismissed a promotional message. You can clear this at any time via your browser settings; doing so will sign you out.

### Contact and Grievance Officer <a href="#id-11-contact-and-grievance-officer" id="id-11-contact-and-grievance-officer"></a>

For any question, request, or complaint about your personal data:

* **Data Fiduciary:** ViewZen Labs Pvt. Ltd.
* **Grievance Officer:** Devanathan N, <devanathan.n@viewzenlabs.com>
* **General privacy contact:** <support@connect.viewzenlabs.com>

If you are not satisfied with our response, you may lodge a complaint with the **Data Protection Board of India**.

### Children <a href="#id-12-children" id="id-12-children"></a>

The Service is intended for users aged **18 and above** and is not directed to children. We do not knowingly process the personal data of children except in accordance with the DPDP Act; if you believe a child has used the Service, contact us and we will take appropriate action.

### Third-Party Services

If we integrate third-party analytics (e.g., Google Analytics), they may collect anonymous usage data. Information collected by 3rd party entities, may be used by such entities to provide content, product, services or any other information pertaining to your interests and preferences.&#x20;

We do not give any third-party access to your identifiable personal or academic data.

### Modifications

We may update this policy periodically without prior notice. Any change in the privacy policy will be updated on this page. You are advised to frequently visit and read the privacy policy to keep yourself informed about the latest changes. You can always check the “Last Updated On” date mentioned above to see when the privacy policy was last updated. Continued use implies acceptance of the revised Policy.

### Providers with their data-processing terms.

#### OpenAI

* **Privacy Policy:** <https://openai.com/policies/privacy-policy>
* **API data-usage policy:** <https://openai.com/policies/api-data-usage-policies>
* **Data Processing Addendum (DPA):** <https://openai.com/policies/data-processing-addendum>
* **Enterprise privacy overview:** <https://openai.com/enterprise-privacy>
* **Key stance:** Data submitted via the **API** is **not used to train** OpenAI's models by default; API inputs/outputs may be retained for a limited period (historically up to \~30 days) for abuse monitoring, then deleted (zero-retention available to eligible accounts).

#### Anthropic (Claude)

* **Privacy Policy:** <https://www.anthropic.com/legal/privacy>
* **Commercial Terms of Service:** <https://www.anthropic.com/legal/commercial-terms>
* **Usage Policy:** <https://www.anthropic.com/legal/aup>
* **Trust Center (DPA / sub-processors / security):** [https://trust.anthropic.com](https://trust.anthropic.com/)
* **Key stance:** Anthropic does **not train** its models on **commercial/API** customer inputs or outputs by default; data is retained for a limited period for trust-and-safety purposes.

#### Google (Gemini / Vertex AI)

* **Gemini API Additional Terms:** <https://ai.google.dev/gemini-api/terms>
* **Vertex AI data governance (Google Cloud):** <https://cloud.google.com/vertex-ai/generative-ai/docs/data-governance>
* **Google Cloud Data Processing Addendum:** <https://cloud.google.com/terms/data-processing-addendum>
* **Google Privacy Policy:** <https://policies.google.com/privacy>