privacy

What we collect, who else sees it, and how to get it deleted

Privacy policy

A resume is one of the more personal documents a person writes. It carries your name, your address, your phone number, where you have worked and what you were paid to do. This page says exactly what happens to it.

It is written against what the software actually does. Where something may surprise you — that the text of your resume is sent to a model provider, for instance — it is stated plainly rather than buried.

Last updated 8 October 2026

1Who is responsible for your data

The data controller is Avyukt Techologies. Reach us at hi@openroles.in, or through the contact page.

2What we collect

What you type or upload. The answers you give in the interview; the resume it produces — your name, email, phone number, location, professional links, employment history, education, skills and projects; any resume file you upload to be scored; the job descriptions you paste; and the applications you record, including the company, the role, the stage you moved it to, the notes you add, when you followed up, the next action and when it is due, and the history of every change — when it happened, and whether you, the extension, an email or a connected app made it.

Answers you save for application forms. If you choose to save them: current and expected CTC, notice period, work authorisation, whether you need sponsorship, whether you will relocate, years of experience, and — only if you enter them — gender and date of birth. They are kept so the extension, or an app you connect, can fill a form for you; you can clear any of them at any time, under Account.

Your account. Your email address, whether it has been verified, and — if you signed up with a password — a bcrypt hash of it. We never store your password itself and cannot read it. If you sign in with Google we receive your email address, name and profile picture from Google, and no password exists.

Payments. The plan you bought, the amount, Razorpay’s order and payment identifiers, and when it expires. Card, UPI and bank details are entered on Razorpay’s side and never reach our servers.

Technical data. Your IP address, stored for up to one hour in a rate-limiting record that expires by itself, so that anonymous scoring and interviews cannot be run at our expense in bulk. Standard server logs at our hosting provider. We do not run analytics scripts. One advertising script, Meta’s pixel, runs on every page so we can tell which of our ads bring sign-ups — see clause 3, which is also where you can turn it off.

3Cookies

Two are strictly necessary. The rest are for measuring our ads, and you can turn them off from this page.

  • An anonymous work cookie. Before you have an account, the interview and the resume it builds are stored against a random identifier held in an httpOnly cookie for 30 days. It exists so that the work you did before signing up is still yours after you sign up. When you create an account it is claimed onto that account and the cookie is cleared. It identifies a browser session, not a person, and is never used for advertising.
  • A session cookie once you sign in, so that you stay signed in.
  • Meta’s pixel. Meta Platforms’ script runs on every page and sets its own cookies (such as _fbp) so Meta can tell us which of our ads led to a visit or a sign-up. When you create an account we also set a 15-minute marker that lets the pixel count that sign-up once, then clear it.
  • Your opt-out, if you use the button below: a cookie that keeps Meta’s pixel off in this browser for 180 days.

To turn ad measurement off in this browser — no pixel, no sign-up marker, and nothing sent to Meta when you create an account:

4Why we are allowed to hold it

To provide the service you asked for, which is the performance of our contract with you; to charge for it and keep the records tax law requires; and, for the abuse limits in clause 2, our legitimate interest in not having the service run up an inference bill on our behalf. Product email — an expiry notice, a follow-up nudge — can be switched off from the link in every one of those emails.

5Who else sees it

We do not sell your data. The one thing we share for advertising is that you signed up: when you create an account we tell Meta Platforms that a sign-up happened, with your email address hashed (SHA-256) so Meta can match it to the ad you saw. Nothing else from your account — no resume, no answers, no tracker — goes to Meta. Like any request from your browser, it carries your IP address and browser type. If you turned ad measurement off in clause 3, none of this is sent.

Otherwise your data reaches these providers only because the service cannot run without them:

  • The model provider — OpenRouter, and the model it routes to. This is the one to read twice: to write, score or tailor a resume, the text of that resume and the job description you paste are sent to a large language model. We send no more than the task needs and we do not send your account email with it. Requests may pass through Respan, a gateway we use to see what our model calls cost.
  • Razorpay — payments. They collect your payment credentials directly under their own privacy policy.
  • Resend — the email we send you: address verification, password resets, receipts, expiry notices and nudges.
  • Google — only if you choose to sign in with Google.
  • MongoDB Atlas — the database that stores everything in clause 2.
  • Vercel — hosting, and the server logs that come with it.

Some of these process data outside India. We may also disclose data where the law requires it, or to establish or defend a legal claim.

We do not use your resume to train models, and we do not give it to anyone for that purpose.

6Apps you connect

You can connect an AI app — Claude, ChatGPT, Cursor, or a script of your own — to your account, either by signing in to OpenRoles from the app and allowing it, or with a personal token you make under Account → Agents. A connected app acts as you, within the permissions you gave it: it can read your resumes, your tracker and your saved application answers, and, if you allowed it, log, update and delete applications in your tracker, save application answers, upload resume versions and rename or archive them, and score resumes against your plan. It cannot edit a resume, change your plan or pay for anything.

What a connected app does with what it reads is governed by that app’s own terms and privacy policy, not this one. The data leaves us when the app asks for it, and we have no say over it after that.

For each connection we keep the app’s name or the name you gave the token, the permissions, when it was made and when it was last used. The token itself is never stored: we keep a hash of it, which cannot be turned back into the token. You can disconnect an app or revoke a token at any time under Account → Agents, and it stops working on its next request.

7What is public, and only when you say so

Nothing you make is public by default. If you publish a share link, the resume at that address becomes readable by anyone holding the link and may be indexed by search engines — that is what publishing means. The address carries a random suffix so it cannot be found by guessing your name, and unpublishing takes effect immediately.

Published pages are deliberately left out of our sitemap: your link being reachable if you share it is a different thing from us handing search engines a list of everyone’s resume.

8How long we keep it

Your account and its contents are kept until you delete them or ask us to. Rate-limit records expire within an hour. Payment records are kept for as long as tax and accounting law requires, which is longer than the rest, and they hold the plan and the amount rather than any payment credential.

9Your rights, and how to use them

You can ask us for a copy of your data, ask us to correct it, or ask us to delete your account and everything in it. Write to hi@openroles.in from the address on your account and we will act within 30 days. Deletion is deletion: the resumes, the applications, the interview transcripts and the account itself. Payment records are retained where the law requires, as in clause 8.

Correcting your resume needs no request at all — you can edit every field yourself, free and without limit.

10Security, stated honestly

Traffic is served over HTTPS. Passwords are stored as bcrypt hashes. Reset tokens are single-use, hashed at rest and expire in thirty minutes, and using one signs out every other session. Sign-in attempts are not throttled: nothing counts wrong passwords, by email address or by IP. Tokens for connected apps are stored only as hashes (clause 6). The database is a managed instance with access restricted to the application.

No service can promise it will never be breached, and we are not going to be the ones who do. If a breach affects your data we will tell you and the relevant authority as quickly as we can establish what happened.

11Children

OpenRoles is meant for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has given us data, write to us and we will delete it.

12Changes

If this policy changes, the date at the top changes. If a change materially affects how we handle data you have already given us, we will email the address on your account rather than quietly editing this page.