Privacy Policy
Version 1.0 · Last updated 14 November 2026 · Effective 14 November 2026
This Privacy Policy and Notice ("Policy") applies to the processing of personal data collected when you visit https://www.careerloop.co.in, register for an account, take Assessments, pay for a Plan, communicate with us or otherwise use the Services described in the Terms and Conditions.
It explains who we are, which personal data we collect, for what purposes and on what lawful ground we use it, with whom we share it, how long we keep it, how we protect it, and what rights you have and how to exercise them.
This Policy is published under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and the rules made under them. It is intended to serve as the notice that accompanies a request for consent.
Other capitalised terms have the meaning given in the DPDP Act or, if not defined there, in the Terms and Conditions.
CareerLoop, having its registered office at Sonpur, Bihar, India ("Company", "we", "us"), processes your personal data in accordance with this Policy.
Except as stated in this Policy, the Company is the Data Fiduciary for the personal data you give us. Employers and HR agencies that receive your Dossier with your consent become independent Data Fiduciaries for their own processing.
For data protection matters, write to the Grievance Officer, Mirnal Kishore, at [email protected], or to [email protected].
When you visit the Website, we collect technical information about your device, your browser and the way you navigate the content, such as:
Analytics that are not strictly necessary are based on your consent. Operating and securing the Website is a legitimate use under section 7 of the DPDP Act and our legitimate interest in protecting our systems.
We do not ask for Aadhaar, PAN, bank account numbers, government identity documents, health information, caste, religion, or criminal or credit records. Please do not include these in your resume or messages unless you accept that they will be stored with your Dossier.
We obtain your personal data directly from you and from your browser and device. We also generate data about you, for example Assessment scores and integrity indicators. We do not purchase personal data from third parties.
The Company processes personal data only for the purposes below, on the ground stated against each. "Consent" means your free, specific, informed, unconditional and unambiguous consent given by a clear affirmative action under section 6 of the DPDP Act. "Legitimate use" means a use permitted by section 7 of the DPDP Act.
| Purpose | Lawful ground |
|---|---|
| To register you, verify your email address, create and secure your account and prevent duplicate or abusive registrations | Consent; legitimate use (security and prevention of fraud) |
| To process your payment, verify it with the Payment Gateway, grant access and keep a record of the transaction | Consent; legitimate use (compliance with law and performance of the contract you requested) |
| To deliver Assessments, score them, show your history and results, and protect Assessment integrity through photograph, face detection and integrity indicators | Consent |
| To provide mentorship, resume curation and Dossier management | Consent |
| To share your Dossier with employers and HR agencies for Referral Assistance, where your Plan includes it | Consent |
| To send transactional emails (OTPs, account and payment messages) and respond to support requests | Legitimate use; consent |
| To understand and improve use of the Website | Consent for non-essential analytics |
| To detect, investigate and prevent fraud, misuse and Assessment misconduct, to protect the Company's legal interests and to establish, exercise or defend legal claims | Legitimate use; compliance with law |
| To comply with legal, tax, accounting and regulatory obligations and to respond to lawful requests of public authorities | Legitimate use (legal obligation) |
We do not sell your personal data, and we do not use it for purposes incompatible with those listed above.
We do not currently send marketing or promotional email. If the Company introduces it, a separate, optional consent and a purpose entry will be added to this Policy first.
At signup you are asked to tick a box titled "Data Processing & Terms Consent", which records your consent to the processing of your proctoring data and Assessment scores and to the matters described in this Policy.
Consent is required for the core Services. If you do not consent, we cannot create your account or deliver Assessments.
You may withdraw your consent at any time by writing to [email protected]. Withdrawal is as easy as giving consent.
Withdrawal does not affect the lawfulness of processing done on the basis of consent before withdrawal. Withdrawal of consent to processing necessary for the Services will result in closure of your account and loss of access without refund, except as provided in the Refund and Cancellation Policy.
At enrolment, you are asked to capture one live photograph through your webcam. Browser-based face detection checks that one face is present and aligned. The photograph is stored with your profile.
During an Assessment, integrity indicators (for example, counts of face and look-away events) and device or browser information are recorded for the attempt.
These data are used to protect the integrity of Assessments and to detect impersonation. At present no automatic penalty is applied on the basis of them alone.
The Company may review integrity indicators and ask you for an explanation before taking any action. Any action is subject to the Terms and Conditions, and you may contest it through the grievance process.
Assessments are scored automatically by the Company's servers using pre-set answer keys and negative marking. Scores are indicative and for preparation only.
The Company does not make any decision that produces legal effects for you, or that similarly significantly affects you, solely by automated means. Integrity indicators alone do not lead to any penalty.
You may write to [email protected] to request a manual review of a score you believe is wrong. The Company will review the request and respond within thirty (30) days.
Payments are made on the Payment Gateway's hosted page. The Company shares with the Payment Gateway your name, email address, mobile number, the amount, the product name and the Company's transaction reference, so that the payment can be processed and reconciled.
The Payment Gateway collects your card, UPI, net banking or wallet details directly and acts as an independent processor of that information. The Company receives only a payment reference and status.
Payment requests and responses are digitally signed using SHA-512 with a secret key held only on the Company's server, and each response is independently verified through the Payment Gateway's verification service.
Your personal data may be shared with: (a) Data Processors engaged by the Company, listed in Annexure C, who process it only on our documented instructions and for the purposes of the Services; (b) employers and HR agencies, only where your Plan includes Referral Assistance and you have consented; (c) any person or authority, including a government department or body, with a lawful entitlement to obtain the information, or where disclosure is required by law, court order or to protect the rights, property or safety of the Company, its users or the public; and (d) a successor to the Company's business in the event of a merger, acquisition, reorganisation or sale of assets, subject to the successor honouring this Policy.
We require our Data Processors to implement appropriate security safeguards and to process personal data only on our instructions.
A public WhatsApp channel is linked from the landing page. The Website sends no data to WhatsApp. If you choose to follow the link, WhatsApp's own terms and privacy policy apply.
Where your Plan includes Referral Assistance, and subject to your consent, the Company may disclose your Dossier to HR agencies and employers in its network. The Dossier may contain your name, contact details, domain, experience, city, photograph, resume and Assessment results.
Each recipient is an independent Data Fiduciary and handles your data under its own privacy policy. The Company does not control its further use.
You may ask us to stop sharing your Dossier at any time. We cannot recall data already disclosed, but we will ask recipients to delete it where practicable.
Some of our Data Processors, such as providers of cloud hosting, database, email delivery and analytics, may store or process your personal data on servers located outside India.
We transfer personal data outside India only to the extent permitted by section 16 of the DPDP Act and any restriction notified by the Central Government.
Cookies are small text files saved on your device when you visit a website. CareerLoop itself sets no first-party cookies.
The Website stores the following in your browser's local storage: (a) a cached copy of your candidate profile (including name, email, phone number, links to your photograph and resume, domain and city), and (b) session tokens that keep you signed in. These remain until you sign out, clear your browser data or they expire.
Google Tag Manager tags and the third-party chat assistant may set cookies or use local storage of their own, depending on how they are configured. You can control cookies through your browser settings. Blocking them may affect parts of the Website.
Cached profile data in local storage is accessible to anyone who uses the same browser profile. Please sign out on shared devices.
We keep personal data only for as long as needed for the purpose for which it was collected, or for as long as the law requires, and then erase it or cause it to be erased, as section 8(7) of the DPDP Act requires. Annexure B records the categories and current retention.
Payment and order records are retained as financial records for the period required by tax, accounting and other applicable laws.
We may retain data for longer where needed in connection with an actual or potential dispute, to establish, exercise or defend legal claims, in which case we retain it until the end of the dispute, or where we are required to do so by law.
Where processing rests on your consent, we will stop that processing when you withdraw consent, subject to the retention clauses above.
We implement reasonable technical and organisational safeguards to protect personal data against unauthorised access, disclosure, alteration, loss and destruction, including the following: (a) all traffic to the Website is encrypted in transit using TLS; (b) row-level security restricts each user's access to their own records, and payment, assessment and OTP tables deny direct access from the browser; (c) privileged service keys are used only on the server and are never exposed to the browser; (d) passwords are stored only as hashes by the authentication provider; (e) OTP codes are stored only as peppered hashes and each verified code creates one account; (f) Assessment answer keys never reach the browser; and (g) payment signatures are generated and verified on the server.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe your account has been compromised, write to us immediately.
In the event of a personal data breach affecting you, the Company will notify the Data Protection Board of India and you, in the form and within the time prescribed by the DPDP Act and the rules made under it.
The Services are intended only for individuals aged eighteen (18) years and above. We do not knowingly process the personal data of a child.
If you believe that a child has provided personal data to us, please write to us and we will delete it.
You have the following rights regarding your personal data. These rights are subject to the conditions and exceptions in the DPDP Act and the rules made under it.
We will handle your requests with care so that your rights can be exercised effectively. We may ask for proof of identity to make sure that we are not disclosing your data to anyone other than you. In particular cases, for instance where the law requires us to retain data, we may not be able to give effect to a request immediately or in full. In every case we will tell you what action we have taken and, if we decline, why.
Level 1: write to [email protected] with the subject "Privacy Request" or "Privacy Complaint".
Level 2: if you are not satisfied or do not receive a response, write to the Grievance Officer, Mirnal Kishore, at [email protected] (Annexure E). We will acknowledge within forty-eight (48) hours and endeavour to resolve within the period prescribed under the DPDP Rules, which in any event shall not exceed thirty (30) days.
Level 3: if your grievance is not resolved or you are not satisfied with the outcome, you may make a complaint to the Data Protection Board of India under the DPDP Act, after exhausting the redressal mechanism above.
The Company will not retaliate against any person who raises a good-faith concern.
To exercise any right, write from your registered email address to [email protected] or to the Grievance Officer at [email protected], stating the right you wish to exercise and the details needed to identify your account.
We aim to respond within thirty (30) days.
Registered office: Sonpur, Bihar, India.
As the DPDP Act requires, you must comply with all applicable laws, must not impersonate another person, must not suppress any material information when providing personal data, must not register a false or frivolous grievance or complaint, and must furnish only verifiably authentic information when exercising your rights.
We send you transactional emails that are necessary for the Services, such as OTPs and account or payment messages. You cannot opt out of these while your account is active.
Emails are delivered by our email service provider from [email protected]. If you reply, your reply is received at [email protected].
The Website may contain links to third-party services. This Policy does not apply to them and we are not responsible for their privacy practices.
We may update this Policy to reflect changes in the Services or the law. The date of the latest update and the version appear at the end. Where a change is material, we will notify you on the Website or by email and, where the law requires, seek fresh consent.
| Data category | Where it is held | Purpose | Retention |
|---|---|---|---|
| Account identity (name, email, phone, password hash) | Authentication service | Login and account identity | Until account deletion or as required by law |
| Candidate profile (domain, experience, city, resume, photograph, scores, status, integrity flags, plan route) | Candidates table and file storage | Dossier, Assessments, Referral Assistance | Until account deletion or as required by law |
| Assessment attempts and responses | Exam attempts and responses tables | Delivery, scoring and history | While the account is active, then erased or anonymised unless needed for a legal claim |
| Demo completion | Demo completions table | Gate before scored tests | While the account is active |
| Email OTP challenge records | OTP table | Email verification and abuse limits | For the period needed for verification and abuse prevention, after which they are deleted |
| Payment orders (plan, amount, status, references, timestamps) | Payment orders table | Payment record and access control | As required by tax and accounting law |
| Temporary signup payload | Payment orders table | Hold signup data between checkout and payment confirmation | Cleared on success, failure or supersession |
| Browser cache (profile) and session tokens | Your browser local storage | Convenience and login persistence | Until sign-out, clearing or expiry |
| Server logs | Hosting provider | Operation, security and payment verification records | As per the provider's configuration and our security needs |
| Provider | Function | Data involved |
|---|---|---|
| Supabase | Database, authentication and file storage | All application data |
| Vercel | Website hosting and serverless functions | Request metadata, IP addresses and server logs, including payment transaction reference and status |
| PayU India | Payment processing and hosted checkout | Name, email, phone, amount, product name and transaction reference. Payment instrument data is collected directly by PayU |
| Resend | Transactional email delivery | Recipient email address and message content |
| Ethora | AI chat assistant on the landing page | Text entered by the visitor and technical data collected by the widget |
| Google Tag Manager (container GTM-W7L22656) | Tag management and analytics | Page views, clicks, device and browser data, IP address |
| Cloudflare | DNS for careerloop.co.in only | No end-user data beyond DNS resolution |
| WhatsApp (Meta) | Outbound link to a public announcement channel | None sent by the Website |
| Employers and HR agencies | Referral Assistance (independent Data Fiduciaries) | Dossier, with your consent |
| Level | Channel | Acknowledgement | Target resolution |
|---|---|---|---|
| 1 | [email protected] (payment matters: [email protected]) | 48 hours | 7 business days |
| 2 | Grievance Officer | 48 hours | One month from receipt, and within 30 days for personal data complaints |
| 3 | Data Protection Board of India (personal data); Consumer Disputes Redressal Commission or National Consumer Helpline 1915 (consumer disputes) | Not applicable | As per the forum |