Privacy Policy

This is the Privacy Policy of Career Torch ("Platform," "Service," "we," "us," or "our"), an AI-powered interview preparation platform operated by LearnerX Edtech Private Limited ("Company"), a company registered under the laws of India, operating under the brand name Codebasics.

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our services. It also describes your rights regarding your personal data and how you can exercise those rights.

This policy applies to all users who access or use the Career Torch platform, including users from India and internationally. By using our Platform, you confirm that you have read and agree to the collection and processing of your personal data as described here. If you do not agree, please do not use our services.

Under the Digital Personal Data Protection Act, 2023, LearnerX Edtech Private Limited acts as the "Data Fiduciary" for your personal data. Under GDPR, we act as the "Data Controller."

3.1 Account and Identity Data

3.2 Professional and Career Data

3.3 Service Usage Data

3.4 Technical and Device Data

4.1 Data Provided Directly by You

• Account registration using email/password or social login (Google, GitHub)
• Profile information you complete or update
• Resume uploads (PDF, DOCX, TXT formats)
• Job descriptions you provide
• Test responses during interview preparation
• Communications with our support team

4.2 Data Collected Automatically

• Cookies and similar tracking technologies
• Device and browser information
• Usage analytics
• Server log files

4.3 Data from Third Parties

• Basic profile information from Google or GitHub when you use social login
• Verification data from authentication services

4.4 Data Inferred or Derived

• Skills and competencies extracted from your resume via AI
• Performance metrics and readiness scores derived from test results

5.1 Service Delivery

• Creating and managing your user account
• Authenticating your identity and securing your access
• Analyzing your resume to extract skills and experience
• Generating personalized interview questions
• Providing performance assessments and feedback
• Tracking your learning progress over time

5.2 Communication

• Sending service-related notifications and updates
• Responding to your inquiries and support requests
• Providing security alerts
• Delivering email verification and password reset communications

5.3 Service Improvement

• Analyzing usage patterns to improve our Platform
• Developing new features and services
• Training and improving our AI models (using anonymized data only)

5.4 Security and Compliance

• Detecting and preventing fraud, abuse, and security incidents
• Enforcing our Terms of Service
• Complying with legal obligations and regulatory requirements

5.5 Marketing (Only with Consent)

• Sending promotional materials about our services (only with your opt-in consent)
• You can opt out of marketing communications at any time

6.1 Under DPDP Act, 2023 (India)

• Consent: Your free, specific, informed, and unambiguous consent provided at the time of registration
• Legitimate Uses: Processing necessary for legitimate uses as specified in the Act, including service delivery and compliance

6.2 Under GDPR (European Union)

• Consent (Article 6(1)(a)): Your explicit consent for specific processing activities
• Contract (Article 6(1)(b)): Processing necessary for the performance of our contract with you
• Legal Obligation (Article 6(1)(c)): Processing necessary for compliance with legal obligations
• Legitimate Interests (Article 6(1)(f)): Processing necessary for our legitimate interests, balanced against your rights

6.3 Under CCPA (California)

We collect and process personal information for the business purposes identified in this Privacy Policy. We do not sell your personal information.

7.1 How We Use AI

Our Platform uses artificial intelligence to provide core services:

• Automated extraction of skills and qualifications from uploaded resumes
• AI-powered analysis of job descriptions
• Generation of personalized interview questions using large language models
• Automated skill gap analysis and performance assessment

7.2 Third-Party AI Providers

We use third-party AI service providers to deliver AI-powered features. These providers process data only for the purposes we authorize, do not retain your personal data beyond the processing session, and are contractually required to maintain appropriate security measures.

7.3 Automated Decision-Making

AI-generated scores and recommendations are for educational purposes only and do not constitute binding decisions about you. We do not make decisions with legal or similarly significant effects solely based on automated processing. AI-generated content may contain inaccuracies and does not guarantee interview outcomes.

We may share your personal data with the following categories of recipients:

8.1 Service Providers

• Cloud Infrastructure: Hosting and storage services
• AI Service Providers: For resume/JD analysis and question generation
• Authentication Services: For user authentication and security
• Analytics Services: For understanding Platform usage (anonymized data only)
• Email Services: For transactional and service-related communications

8.2 Legal and Regulatory

• Law enforcement when required by valid legal process
• Regulatory authorities as required for compliance
• Courts to comply with court orders or subpoenas
• Data Protection Board of India as required under the DPDP Act

8.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you of any such change.

We do not sell your personal data to third parties. We do not share your resume or personal information with employers without your explicit authorization.

Your personal data may be transferred to and processed in countries outside India, including the United States and the European Union, where our AI service providers and cloud infrastructure operate.

When transferring your personal data internationally, we use standard contractual clauses, ensure compliance with restrictions under India's DPDP Act, and require our processors to maintain appropriate security measures.

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

When personal data is no longer required, we securely delete or anonymize it.

We implement appropriate technical and organizational security measures to protect your personal data, including encryption in transit (TLS) and at rest (AES-256), strong password hashing, role-based access controls, and regular security assessments.

11.1 Data Breach Response

In the event of a personal data breach, we will notify the Data Protection Board of India within 72 hours as required under the DPDP Act. We will also notify affected users without undue delay if the breach is likely to result in high risk to their rights.

12.1 Rights Under DPDP Act, 2023 (India)

12.2 Additional Rights Under GDPR (EU/EEA Users)

12.3 Rights Under CCPA (California Users)

• Right to Know: What personal information we collect, use, and disclose
• Right to Delete: Request deletion of personal information
• Right to Opt-Out: Opt-out of the sale of personal information (we do not sell your data)
• Right to Non-Discrimination: Not be discriminated against for exercising your rights

12.4 How to Exercise Your Rights

• Account Settings: Access, update, or delete certain data directly through your account settings
• Email Request: Email us at privacy@codebasics.io
• Grievance Officer: Contact our Grievance Officer at grievance@codebasics.io

We will respond to most requests within 30 days. You may withdraw consent at any time by emailing privacy@codebasics.io or through your account settings. Withdrawal will not affect the lawfulness of processing done prior to withdrawal.

Our Platform is intended for users who are at least 18 years of age. In compliance with the DPDP Act, 2023:

• We require verifiable parental or guardian consent before processing personal data of children (individuals below 18 years)
• We do not engage in tracking, behavioral monitoring, or targeted advertising directed at children
• We prohibit processing that could have a detrimental effect on a child's well-being

If we discover that we have collected personal data from a child without appropriate parental consent, we will take immediate steps to delete the data and discontinue services to the child's account. If you believe we have inadvertently collected data from a child, please contact us at privacy@codebasics.io.

We use cookies and similar technologies to provide Platform functionality, remember your preferences, and understand usage patterns. Essential cookies are always active as they are necessary for the Platform to function. You can accept or decline optional cookies (such as analytics) via the cookie consent banner or your browser settings.

For detailed information about the cookies we use and how to manage them, please visit our Cookie Policy.

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page. For material changes affecting your rights, we will provide notice via email or a prominent notice on the Platform at least 30 days in advance. Your continued use of the Platform after the updated Privacy Policy becomes effective indicates your acceptance of the changes.

If you have questions or requests regarding this Privacy Policy or our data practices: