Privacy Policy

1. Data Fiduciary & Contact

For the purposes of the DPDP Act, the Data Fiduciary is:

2. Personal Data We Collect

Third-Party Authentication: We allow authentication via Google OAuth. When using Google Sign-In, we receive your name and email address securely as provided by Google.

• Identity Data: Name, Email address (Verified via email link or Google).
• Professional Data: Resumes (PDF/DOCX), Job Descriptions, Career history references extracted for analysis.
• Financial Data: Transaction content is processed by Razorpay. We strictly DO NOT store credit card, debit card, or banking passwords. We only retain transaction references for tax auditing.
• Technical Data: IP address, device type, browser logs (kept for 6 months as per IT directives).

3. Purpose of Processing (Consent-Based)

We process your data primarily based on your explicit consent (checked during signup) for:

• Service Delivery: Analyzing resumes against JDs using AI.
• Service Communication: Sending transaction receipts, email verification, password resets, and critical account or service alerts. These are essential to the service and are sent to all account holders.
• Marketing & Product Updates: Occasional resume tips, product updates, and offers. Every such email includes a one-click unsubscribe, and you can opt out at any time. In the EU, EEA, UK & Switzerland we send these only if you explicitly opt in (the optional checkbox at signup). In other regions we may send them on a legitimate-interest basis unless and until you unsubscribe. This never affects the essential service emails above.
• Legal Compliance: Retaining financial records for tax authorities.

We do NOT sell your data, and we never share it with data brokers or marketing agencies. Our marketing email is sent only by us, about ATSAlign.

AI Processing

To analyze and optimize your resume, the text of your resume and the job description you provide are sent to Google's Gemini API for processing. We use Google's paid Gemini API tier, under which — per Google's API terms — your content is not used to train Google's models. We do not use it to train any models either. This processing happens solely to deliver the analysis and optimization you requested.

Service Providers & International Transfers

We rely on the following processors to operate ATSAlign. Some are located outside India and may process data in the United States or other regions; we share only what each provider needs to perform its function:

• Google — Gemini AI processing, Google Analytics (with consent), Sign-In.
• Supabase / AWS — database & encrypted resume file storage.
• Razorpay — payment processing (we never receive card details).
• Microsoft Clarity — anonymized product analytics (with consent).
• Vercel — website hosting & performance analytics.
• Titan Email — transactional and service emails.

4. Data Retention & Deletion Policy

You may delete your account at any time from your account settings. Upon deletion, your personal data will be permanently erased except where retention is required for legal or financial compliance.

5. Rights of the Data Principal

Under the DPDP Act, you have the following rights:

• Right to Access: Request a summary of personal data we process.
• Right to Correction: Update inaccurate or misleading personal data.
• Right to Erasure: Request deletion of your account and data ("Right to be Forgotten").
• Right to Grievance Redressal: Contact our Grievance Officer for unresolved privacy concerns.

To exercise these rights, email support@atsalign.com.

6. Security Measures

We implement permissible security safeguards as per IT Rules, 2011:

• Encryption: Data in transit is encrypted via HTTPS (TLS 1.2+).
• Hashing: Passwords are salted and hashed (never stored in plain text).
• Access Control: Database access is restricted to authorized personnel only.

Data Breach Notification: In the event of a personal data breach that is likely to affect you, we will notify you without undue delay and report the breach to the relevant authority (including the Data Protection Board of India) as required by applicable law.

7. Cookies & Analytics

We use two categories of cookies and similar technologies. Essential cookies are always on because the site cannot function without them. Analyticscookies are handled based on your region:

• EU, EEA, UK & Switzerland: analytics cookies load only after you opt in via our cookie banner.
• Other regions (including India & the US): analytics cookies may load by default as permitted by local law, and you can opt out at any time using the “Cookie Settings” link in our footer.

Either way, you can change your choice at any time, we do not use advertising or ad-targeting cookies, and we never sell your data.

Rejecting analytics never affects your access to any feature.

8. Browser Extension

The ATSAlign browser extension (Chrome) is optional. When installed and used on a supported job site, it:

• Reads only the visible job description, title, and company on supported job pages (LinkedIn Jobs, Greenhouse, Lever, Naukri, Indeed) — and only to compute your match score. It does not read any other page, tab, or site.
• Never accesses your credentials, passwords, cookies, or browsing history on those sites.
• Sends the job description and your saved resume profile to ATSAlign servers solely to produce the match score and (if you click Optimize) to pre-fill the optimizer. Job descriptions used for a one-click handoff are stored briefly (minutes) and then deleted.
• Authenticates with the same ATSAlign session token used on the website, stored locally in the browser's extension storage. You can log out from the extension popup at any time, which clears it.
• Records minimal, non-sensitive usage events (e.g. that a job was analyzed or the Optimize button was clicked) to improve the product. These contain no passwords and no full resume content.

Data collected by the extension is used only to provide the match-score feature. ATSAlign never uses it for advertising, ad targeting, or building profiles of you, and never sells or rents it to third parties.

Uninstalling the extension removes its local data. Your account data is governed by the retention and deletion policy above.