What we keep, why, and your rights

1. Who we are

Dossier is run by ByteQ Services, which decides why and how your personal data is used (the “Data Fiduciary” under the Digital Personal Data Protection Act, 2023, the “DPDP Act”). Our contact details and Grievance Officer are at the end of this notice.

We use your personal data on the basis of the consent you give when you sign up (and again when this notice changes), and where the law allows it without consent, for example to keep tax records. You may also give, manage or withdraw consent through a Consent Manager registered with the Data Protection Board of India.

This notice is in English. On request to the Grievance Officer, we will give it to you in any language listed in the Eighth Schedule to the Constitution of India.

2. What we collect, and why

• Account: your name, email address and password (stored only as a one-way scrambled form we cannot read). To create your account, sign you in and contact you about it.
• Sign-in and security records: when you signed in, the device, browser and network address, and one-time sign-in, sign-up and two-step codes sent to your email (stored scrambled, for minutes). To keep your account safe and show you your sessions.
• Your resumes and profile: everything you type into resumes, cover letters, your profile and library, and photos, logos and signatures you upload or draw. To build, store and show your resumes. You decide what goes in them.
• Earlier versions: a copy of a resume each time it is published or restored, and while you edit it at most once every 30 minutes (the latest 30 for each resume). So you can see and bring back an earlier version.
• Imported resumes: a PDF or Word file you import, or text you paste, is read on our server to fill in a new resume. The file itself is not kept.
• Job applications: the company, role, dates, status and notes you record, and which resume and cover letter you sent. To keep your application tracker. Only you can see it.
• Resume reviews: the email addresses you invite to review a resume, a copy of the resume as it was when you asked, and the reviewers' comments, ratings and endorsements. To let only those people see that copy and help you. A reviewer's endorsement (their name, designation, company and words) shows on your public link only after you approve it.
• Ask an expert (Pro): the kind of request, the job you are aiming for, your question or note, the messages between you and the expert, your rating, and when you agreed to share them. For a resume review, a copy of the resume without your email address, phone number, web links or postal address, and with your last name shortened to an initial. To let a Dossier career expert help you and to show our administrators how requests are handled. Email addresses, phone numbers and WhatsApp or Telegram links typed into requests and messages are hidden before they are saved.
• Openings (applying): the vacancy, the resume you chose as it was when you applied, your note and any cover letter, the skill match worked out from them, your answers to the vacancy's screening questions (kept with the questions as they were asked), the steps the employer took, the messages you and the organisation exchange about the application, your answers to interview invitations (confirmed, another time with the times you wrote, or cannot attend, with any reason), and when you agreed to send them. To send your application to that organisation, show you its progress, deliver messages both ways, email you at each step and remind you of interviews.
• Employers: an organisation's registration details (name, website, email domain, GSTIN or CIN, place, size, industry, logo, about), the designation of the person who registered it, its team members and invitations, its vacancies, and our decisions on it. To check organisations, list their vacancies and keep fake jobs out. “Report this job” reports, with the reporter's account, so our team can act on them.
• Published resumes: the version you publish, its link settings, and how many times the link was opened on each day (we do not record who opened it). To show the resume to people you share it with. If you switch on the view count, visitors see the total.
• “Contact me” messages: the visitor's name, email address and message. To deliver the message to you.
• Payments: your billing name, state and GSTIN if you give one, the plan, amount, date and Razorpay's payment reference. To take payment, switch your plan on and issue GST invoices. We never receive your card, UPI or bank details.
• Invites: your invite code, the friends who joined through it, and the email addresses you ask us to send an invitation to. To send that one invitation and credit you with free months.
• Offers: which offers were shown to your account, whether you used one, the discount or free time it gave, and which offer emails we sent you. To apply the offer, keep it to one use per account, and count how offers are doing.
• Employers can find my resume (only if you switch it on): which resume you chose, when you agreed and confirmed you are 18 or older, from which network address and browser, the organisations you hide it from, and each time an organisation's team member opened it from search (the organisation, the vacancy, who and when). To let approved organisations find you for vacancies they have published, and to show you who looked.
• Job alerts: the searches you save as alerts (words, skills, cities, work modes, employment types, a minimum match and the resume to match with), how often they are sent, whether they are on, when the last email went and which openings each alert has already sent you. To email you new openings that fit, without sending the same one twice. The match is worked out on our server from your resume and the opening's required skills, the same way as when you apply; nothing is sent to employers until you apply yourself.
• Email choices: whether you switched on “Offers, news and tips” in Preferences. We send offers and news only if you switched it on, and every such email has a link to stop them. Job alert emails are sent only for alerts you set up, and each one has a link to stop that alert (you can also pause or delete alerts under Job alerts). Members of an organisation get a weekly summary of their open vacancies (views and applications) unless they switch it off in Preferences or through the link in each summary. Emails about your account, sign-in, plan and payments are sent whatever you choose, as they are part of the service.
• Suggestions and reviews: what you send us, including any pictures. To improve Dossier, and to show a review on the home page only if you agreed to that.
• Consent records: which version of the Terms and this notice you accepted, when, and from which network address and browser. To show that you gave consent, as the DPDP Act requires.
• Help requests and grievances: what you write, your email address, the ticket number and our answers. To answer you and to show that complaints were handled in time.
• Account actions by our staff: if an administrator suspends, reactivates or signs out an account, who did it, when and why. To keep the decision accountable and to answer an appeal.
• Staff access to your resumes (only if you switch it on; it is off unless you do): an authorised Dossier administrator may then open any of your resumes and cover letters, including ones you have not published, to improve Dossier: for example to find and fix faults in templates, page layout, PDFs and the ATS check, and to make features and suggestions work better. They can only read it; they do not change, download, copy or share it, and never use it to contact you or for advertising. Each time, we record who opened which resume, when and why, and you can see that record under Data & account → Staff access to your resumes. You switch staff access on or off there at any time; while it is off, staff cannot open your resumes. The record is kept for one year.

Our administrators see totals (for example sign-ups, plans bought and links published each day) to run Dossier. These totals come from the records above. We also count visitors to the site ourselves, without cookies or outside analytics tools: each page opened is counted, and a visitor is told apart for one day only, by a code made from the network address and browser name that changes every day and is never stored. Only daily totals are kept (visitors, pages opened, the kind of device, and the site that sent the visitor). In the same way we count views of each public job page (/openings/…) for the organisation that posted it: a visitor is counted once a day per job, told apart by a code that changes every day and is never stored (made from a random value your browser keeps for that day only, or else the network address and browser name), and only daily totals per job and per kind of source (for example WhatsApp, LinkedIn, a search engine or a direct visit) are kept. When a signed-in candidate opens the Apply form, we note it once per job as a coded value that does not show who it was, so the organisation sees how many started applying. These counts hold no personal data, are shown only to the organisation and our administrators, and are deleted with the job.

We do not use your data for advertising, we do not sell it, we do not use it to train AI models, and we do not track you across other websites.

3. Other people's data you give us

If you add other people's details to a resume (for example referees) or ask us to send an invitation to a friend, you confirm that they have agreed. We send an invited friend one email only and do not write to them again unless they sign up.

When you send a request to Ask an expert, the career expert who takes it sees your first name, the copy of the resume described above (for a resume review), your question and your messages. They never see your email address or phone number, and you see only the expert's name (first name and initial) and a short description of their experience. If you are a career expert, the people you help see the same about you, and our administrators see how many requests you handled and the ratings you received.

When you ask someone to review your resume, we email them once with the link. If you review someone else's resume, the owner sees your name with your comments and rating; your endorsement shows publicly with your name, designation and company only if the owner approves it, and you can remove it while the review is open.

4. Who we share it with

We share personal data only with service providers who process it for us under contract, and only as much as they need:

• our hosting provider, which runs Dossier's servers and database;
• Brevo (Sendinblue), which sends our emails: it receives your email address and the email's content;
• Razorpay, which takes payments: it receives what you enter in its checkout;
• Google Fonts, from which your browser loads the site's fonts (including fonts for Hindi and other Indian languages): it sees your network address.

If you use Ask an expert, what is described under “What we collect” is shared with the Dossier career expert who takes your request. Experts are people we have vetted and who are bound to keep it confidential, to use it only to answer you, and not to keep copies outside Dossier. They work inside Dossier and do not receive your contact details.

If you apply for an opening, what is described under “Applying to employers through Openings” is shared with that organisation, which uses it for that recruitment only. Organisations are checked by our team before they can list vacancies, and they are bound by the employer section of the Terms.

PDF, Word and image downloads, QR codes and drawn signatures are made in your browser or on our own server; no other company receives your resume for them.

Some of these providers may store or process data outside India. We send data only to countries the Government of India has not restricted. We also disclose data when the law requires it, for example to a court or a government authority acting under law, or when it is needed to protect the rights, property or safety of Dossier, our users or others.

If our business, or a part of it, is merged, acquired or transferred, personal data may pass to the new owner, who must keep to this notice.

5. Applying to employers through Openings

When you apply for an opening, the organisation's HR team sees the copy of the resume you chose (with your name, email address, phone number and everything else in it), your note, any cover letter you attached, your answers to its screening questions, and how many of the vacancy's required skills your resume shows. They use it only to recruit for that vacancy, and the employer terms forbid any other use. They do not see your other resumes, your account or anything else. If an answer does not meet a requirement the organisation set for the vacancy (for example “Can you join within 30 days?” – Yes), the application is not sent and you are told why.

If you switch on “Employers can find my resume”, the hiring team of an approved organisation that is searching from one of its open vacancies can see the resume you chose, as it is now, with your first name and the initial of your last name, your city and the skill match, but without your email address, phone number, web links, postal address, photo, personal-details section (for example date of birth, gender or marital status) or declaration. Interviewers cannot search. Organisations you hide it from, and organisations you asked not to invite you, never find you. An organisation may invite you to apply for that vacancy; Dossier emails you the invitation, and the organisation learns nothing more unless you apply. Under Be found by employers you see which organisations opened your resume and when. Switching it off removes your resume from search at once; deleting the resume or your account does the same.

You see every step the employer takes and every message they send you; their internal notes are not shown to you. We email you at each step and keep a card on your Job Tracker that follows it.

You and the organisation's hiring team can write to each other about the application under Messages (interviewers do not see them). Messages are plain text; the other side is emailed with their text, at most once every 15 minutes per conversation. You can no longer write after you withdraw, and a conversation closes 90 days after the application is decided. If you report a message, our administrators see it and the report.

An organisation you applied to may invite you to apply for another of its open vacancies. We send the invitation by email and show it under My applications; the organisation does not get your contact details through it and learns nothing new about you unless you apply. It can invite you at most 3 times in 90 days. Each invitation has “Don't invite me again”, which stops invitations from that organisation (you can allow them again under My applications). Invitations are deleted a year after they were sent, or with the vacancy or your account.

When an interview is scheduled you can confirm it, ask for another time or say you cannot attend, from the email or My applications; the organisation's team sees your answer and any note. We email you, and the colleagues on the panel, a reminder the evening before and about two hours before the interview.

During the recruitment the organisation may also record: interview schedules (date, time, mode, place or link, and who interviews you), its interviewers' evaluation sheets with ratings, comments and recommendations, a combined score and rank, and, at the offer stage, the salary and terms it offers and the offer letter it sends you. Evaluation sheets, scores, ranks and internal notes are never shown to you; you see the rounds by name, where you stand, your interviews, the decisions and messages sent to you, and the offer letter. If you choose to give your notice period, current and expected CTC or whether you would relocate when applying, only that organisation sees them, for that application's screening.

• Applications, the copy of the resume sent, screening answers, notes, steps and messages — and the interview schedules with your answers to them, evaluation sheets, optional CTC and notice details, offers and offer letters that belong to them — are kept while the vacancy runs and for one year after it closes, then deleted automatically.
• You can withdraw an application before a decision; the employer sees that you withdrew. Deleting your account deletes your applications at once, though an employer may already have saved or printed a copy for the recruitment.
• Download your data includes your applications, every step and message meant for you, your messages to the organisation, your screening answers and answers to interview invitations, the optional details you gave and any offer sent to you (never the employer's evaluation sheets or notes).
• If you recruit for an organisation, the candidates you handle see the organisation's name and the messages you send, not your own name or contact details (unless you write them). Our administrators see your name, email address and the actions taken for the organisation.

6. Cookies and storage in your browser

We use one essential cookie that keeps you signed in. It cannot be read by scripts on the page and is sent only to Dossier. Your browser also keeps a few settings (for example a panel you folded) and, for 30 days, an invite code from a friend's link. We use no advertising or analytics cookies.

7. How long we keep it

• Your account, resumes, cover letters, photos, signatures, profile, library, job applications and messages: until you delete them or your account is deleted. Deleting the account removes them at once, including uploaded photos.
• Sign-up details of a deleted account (name, email address, phone number, public link name, the dates it was opened and closed, and any suspension): for 180 days after deletion, as the IT (Intermediary) Rules 2021 require. After that only the account number, those dates and a scrambled fingerprint of the email address stay, for reference and so that the same address cannot earn invite rewards again: the fingerprint cannot be turned back into the address.
• Earlier versions of a resume: the latest 30, deleted together with the resume.
• Review requests, the copy of the resume reviewers saw, their comments, ratings and endorsements: until you delete the resume or your account. A reviewer's own comments and endorsements are also deleted if they delete their account.
• Ask an expert requests, messages, ratings and the expert's copy of your resume: until you delete your account (deleting a resume removes the expert's copy of it). If an expert deletes their account, their messages stay with your request without their name.
• Applications through Openings, with the copy of the resume sent, screening answers, steps, messages and answers to interview invitations: one year after the vacancy closes, then deleted; at once if you delete your account. An organisation's registration and vacancies: while it is on Dossier; job reports: one year after they were handled.
• Employers can find my resume: your choice and consent record until you switch it off or delete the resume or your account; the record of organisations that opened your resume from search, one year.
• Job alerts, and the record of which openings each one sent: until you delete the alert or your account. The record of an opening goes when the opening itself is deleted.
• Published links: a copy is held in our server's memory for up to 30 seconds so that links open quickly; taking a link offline or changing it clears it.
• Help requests and grievances, with any pictures: for 3 years after they were last updated, even after your account is deleted, so that we can answer later questions and show the law was followed; then they are deleted.
• Records of staff opening your resumes (who, which resume, when and why): one year, then deleted.
• Records of staff actions on an account: in the security log for one year. The reason for a suspension stays with the account only while it is suspended.
• Payment records, invoices, refunds and credit notes: 8 years from the payment, as GST law requires, even after your account is deleted; then they are deleted.
• Consent records: as long as we may need to show that consent was given, which can be after your account is deleted.
• Sign-ups that were never finished: deleted after one day. Sign-in sessions: until you sign out or they expire.
• Security and access logs (sign-ins, network addresses, changes to accounts): kept for one year, as the DPDP Rules require, to detect and investigate misuse, then deleted.

8. Your rights

Under the DPDP Act you can:

• get a summary of your personal data and how we use it: Data & account → Download your data gives you a copy, or send a request (Help & requests → My personal data);
• correct, complete or update it: edit your profile and resumes, or write to us;
• have it erased: Data & account → Delete account, or where that page shows “Request deletion”, a request under Help & requests → My personal data (done within 15 days). We keep only what the law requires (see “How long we keep it”);
• withdraw your consent at any time, as easily as you gave it, by having your account deleted or writing to us. This does not affect what was done before, but it means we can no longer provide Dossier to you;
• nominate a person to use these rights for you if you die or become unable to: write to the Grievance Officer with their name and contact details;
• choose whether our staff may open your resumes (off unless you switch it on): Data & account → Staff access to your resumes, where you also see every time they did;
• complain to our Grievance Officer, and if you are not satisfied with the answer, to the Data Protection Board of India.

We may ask you to confirm your identity before acting on a request. We acknowledge a request within 24 hours and answer it within 15 days, and in any case within the time the law sets. You need to use our grievance process before you can complain to the Data Protection Board.

9. Children

Accounts are for people aged 18 and over. A parent or lawful guardian may create an account to make a resume for their child; the parent is then the account holder and gives consent for the child's personal data, as section 9 of the DPDP Act requires. We do not track children's behaviour, show them targeted advertising or process their data in ways likely to harm them. If you believe someone under 18 has opened their own account, write to the Grievance Officer and we will close it and delete its data.

10. What you are responsible for

• What you publish or send is your choice. Once a resume, link or file is shared, others may copy, keep or pass it on, and we cannot control or undo that.
• Keep your password, sign-in codes and devices secure. We are not responsible for access to your account that results from you not doing so; tell us at once if you think someone else has used it.
• We may turn records into anonymised totals that cannot identify you (for example, the number of sign-ups in a day). Such totals are not personal data, and we may use them to run and improve Dossier.

11. How we protect it

Data travels encrypted (HTTPS). Passwords, codes and links are stored only in scrambled form, payment and email keys are encrypted, access to the database is limited to the people who run Dossier, and access is logged. Two-step sign-in with an email code is available to every account.

If a breach affects your personal data, we tell you without delay, by email and in Dossier, what happened and when, its likely effect on you, what we are doing about it, what you can do to protect yourself, and whom to contact. We inform the Data Protection Board of India without delay and send it a full report within 72 hours of learning of the breach, as the DPDP Rules require, and we report cyber security incidents to CERT-In within the time it sets (now 6 hours).

12. Changes to this notice

When this notice changes in a way that matters, we update the date above and ask you to read and accept it the next time you use Dossier.

13. Contact: Grievance Officer / Support Manager

For any question, request or complaint about your personal data, send a request through Help & requests (choose “My personal data”) or write to our Grievance Officer. You get a ticket number and an automatic acknowledgement at once, and we resolve it within 15 days.