What we keep, why, and your rights

1. Who we are

Dossier is run by ByteQ, which decides why and how your personal data is used (the “Data Fiduciary” under the Digital Personal Data Protection Act, 2023, the “DPDP Act”). Our contact details and Grievance Officer are at the end of this notice.

We use your personal data on the basis of the consent you give when you sign up (and again when this notice changes), and where the law allows it without consent, for example to keep tax records. You may also give, manage or withdraw consent through a Consent Manager registered with the Data Protection Board of India.

This notice is in English. On request to the Grievance Officer, we will give it to you in any language listed in the Eighth Schedule to the Constitution of India.

2. What we collect, and why

• Account: your name, email address and password (stored only as a one-way scrambled form we cannot read). To create your account, sign you in and contact you about it.
• Sign-in and security records: when you signed in, the device, browser and network address, and one-time sign-in, sign-up and two-step codes sent to your email (stored scrambled, for minutes). To keep your account safe and show you your sessions.
• Your resumes and profile: everything you type into resumes, cover letters, your profile and library, and photos, logos and signatures you upload or draw. To build, store and show your resumes. You decide what goes in them.
• Earlier versions: a copy of a resume each time it is published or restored, and while you edit it at most once every 30 minutes (the latest 30 for each resume). So you can see and bring back an earlier version.
• Imported resumes: a PDF or Word file you import, or text you paste, is read on our server to fill in a new resume. The file itself is not kept.
• Job applications: the company, role, dates, status and notes you record, and which resume and cover letter you sent. To keep your application tracker. Only you can see it.
• Resume reviews: the email addresses you invite to review a resume, a copy of the resume as it was when you asked, and the reviewers' comments, ratings and endorsements. To let only those people see that copy and help you. A reviewer's endorsement (their name, designation, company and words) shows on your public link only after you approve it.
• Published resumes: the version you publish, its link settings, and how many times the link was opened on each day (we do not record who opened it). To show the resume to people you share it with. If you switch on the view count, visitors see the total.
• “Contact me” messages: the visitor's name, email address and message. To deliver the message to you.
• Payments: your billing name, state and GSTIN if you give one, the plan, amount, date and Razorpay's payment reference. To take payment, switch your plan on and issue GST invoices. We never receive your card, UPI or bank details.
• Invites: your invite code, the friends who joined through it, and the email addresses you ask us to send an invitation to. To send that one invitation and credit you with free months.
• Suggestions and reviews: what you send us, including any pictures. To improve Dossier, and to show a review on the home page only if you agreed to that.
• Consent records: which version of the Terms and this notice you accepted, when, and from which network address and browser. To show that you gave consent, as the DPDP Act requires.
• Help requests and grievances: what you write, your email address, the ticket number and our answers. To answer you and to show that complaints were handled in time.
• Account actions by our staff: if an administrator suspends, reactivates or signs out an account, who did it, when and why. To keep the decision accountable and to answer an appeal.

Our administrators see totals (for example sign-ups, plans bought and links published each day) to run Dossier. These totals come from the records above; we add no tracking or analytics tools for them.

We do not use your data for advertising, we do not sell it, we do not use it to train AI models, and we do not track you across other websites.

3. Other people's data you give us

If you add other people's details to a resume (for example referees) or ask us to send an invitation to a friend, you confirm that they have agreed. We send an invited friend one email only and do not write to them again unless they sign up.

When you ask someone to review your resume, we email them once with the link. If you review someone else's resume, the owner sees your name with your comments and rating; your endorsement shows publicly with your name, designation and company only if the owner approves it, and you can remove it while the review is open.

4. Who we share it with

We share personal data only with service providers who process it for us under contract, and only as much as they need:

• our hosting provider, which runs Dossier's servers and database;
• Brevo (Sendinblue), which sends our emails: it receives your email address and the email's content;
• Razorpay, which takes payments: it receives what you enter in its checkout;
• Google Fonts, from which your browser loads the site's fonts (including fonts for Hindi and other Indian languages): it sees your network address.

PDF, Word and image downloads, QR codes and drawn signatures are made in your browser or on our own server; no other company receives your resume for them.

Some of these providers may store or process data outside India. We send data only to countries the Government of India has not restricted. We also disclose data when the law requires it, for example to a court or a government authority acting under law.

5. Cookies and storage in your browser

We use one essential cookie that keeps you signed in. It cannot be read by scripts on the page and is sent only to Dossier. Your browser also keeps a few settings (for example a panel you folded) and, for 30 days, an invite code from a friend's link. We use no advertising or analytics cookies.

6. How long we keep it

• Your account, resumes, cover letters, photos, signatures, profile, library, job applications and messages: until you delete them or your account is deleted. Deleting the account removes them at once, including uploaded photos.
• Sign-up details of a deleted account (name, email address, phone number, public link name, the dates it was opened and closed, and any suspension): for 180 days after deletion, as the IT (Intermediary) Rules 2021 require. After that only the account number, those dates and a scrambled fingerprint of the email address stay, for reference and so that the same address cannot earn invite rewards again: the fingerprint cannot be turned back into the address.
• Earlier versions of a resume: the latest 30, deleted together with the resume.
• Review requests, the copy of the resume reviewers saw, their comments, ratings and endorsements: until you delete the resume or your account. A reviewer's own comments and endorsements are also deleted if they delete their account.
• Published links: a copy is held in our server's memory for up to 30 seconds so that links open quickly; taking a link offline or changing it clears it.
• Help requests and grievances, with any pictures: for 3 years after they were last updated, even after your account is deleted, so that we can answer later questions and show the law was followed; then they are deleted.
• Records of staff actions on an account: in the security log for one year. The reason for a suspension stays with the account only while it is suspended.
• Payment records, invoices, refunds and credit notes: 8 years from the payment, as GST law requires, even after your account is deleted; then they are deleted.
• Consent records: as long as we may need to show that consent was given, which can be after your account is deleted.
• Sign-ups that were never finished: deleted after one day. Sign-in sessions: until you sign out or they expire.
• Security and access logs (sign-ins, network addresses, changes to accounts): kept for one year, as the DPDP Rules require, to detect and investigate misuse, then deleted.

7. Your rights

Under the DPDP Act you can:

• get a summary of your personal data and how we use it: Data & account → Download your data gives you a copy, or send a request (Help & requests → My personal data);
• correct, complete or update it: edit your profile and resumes, or write to us;
• have it erased: Data & account → Delete account, or where that page shows “Request deletion”, a request under Help & requests → My personal data (done within 15 days). We keep only what the law requires (see “How long we keep it”);
• withdraw your consent at any time, as easily as you gave it, by having your account deleted or writing to us. This does not affect what was done before, but it means we can no longer provide Dossier to you;
• nominate a person to use these rights for you if you die or become unable to: write to the Grievance Officer with their name and contact details;
• complain to our Grievance Officer, and if you are not satisfied with the answer, to the Data Protection Board of India.

We may ask you to confirm your identity before acting on a request. We acknowledge a request within 24 hours and answer it within 15 days, and in any case within the time the law sets. You need to use our grievance process before you can complain to the Data Protection Board.

8. Children

Accounts are for people aged 18 and over. A parent or lawful guardian may create an account to make a resume for their child; the parent is then the account holder and gives consent for the child's personal data, as section 9 of the DPDP Act requires. We do not track children's behaviour, show them targeted advertising or process their data in ways likely to harm them. If you believe someone under 18 has opened their own account, write to the Grievance Officer and we will close it and delete its data.

9. How we protect it

Data travels encrypted (HTTPS). Passwords, codes and links are stored only in scrambled form, payment and email keys are encrypted, access to the database is limited to the people who run Dossier, and access is logged. Two-step sign-in with an email code is available to every account.

If a breach affects your personal data, we tell you without delay, by email and in Dossier, what happened and when, its likely effect on you, what we are doing about it, what you can do to protect yourself, and whom to contact. We inform the Data Protection Board of India without delay and send it a full report within 72 hours of learning of the breach, as the DPDP Rules require, and we report cyber security incidents to CERT-In within the time it sets (now 6 hours).

10. Changes to this notice

When this notice changes in a way that matters, we update the date above and ask you to read and accept it the next time you use Dossier.

11. Contact and Grievance Officer

For any question, request or complaint about your personal data, send a request through Help & requests (choose “My personal data”) or write to our Grievance Officer. You get a ticket number and an automatic acknowledgement at once, and we resolve it within 15 days.