Privacy and DPDP notice

Last updated 5 September 2026. This notice is written for the person using the service, not for a lawyer. If any part of it is unclear, write to us and we will fix the wording.

1. Who is responsible

VisoGreen is the data fiduciary for this service. In the language of the Digital Personal Data Protection Act 2023, that means we decide why and how your personal data is processed, and we are accountable for it.

For anything at all about your data, including a request, a complaint, or a question about this notice: privacy@visogreen.com. A person reads that address.

The service currently runs at krackjobs.visogreen.com. That address is temporary and borrowed from a domain we already own. Every page carries a no-index header, so search engines are asked not to remember it.

2. What we collect, item by item

What you type, or import from your CV

• Your name, email address, phone number, and links you choose to add, such as LinkedIn or a portfolio.
• Your city and country, and which countries you may work in without sponsorship.
• Employment history: employer, job title, dates, location, and what you did there.
• Education, certifications, projects, and skills.
• Your postal address, kept in its own table because it is the most sensitive block in the profile.
• Preferences such as notice period and salary expectation. These never leave your profile without a separate confirmation from you each time.

We deliberately do not store salary history. Asking for it is prohibited in several places, and data we never hold cannot be volunteered by an autofill.

What you paste in, about a job

• The text of a job advertisement you want to be measured against, and the address it came from if the extension read it.
• The requirements our parser found in it, and the CVs generated against it.

What we create about you

• A password, stored only as a scrypt hash. We cannot read it and we cannot recover it for you.
• Sign-in sessions. Only a hash of the session token is stored, never the token itself.
• A security log of events such as signing in, changing a password, or deleting an account.
• Product counts, such as "a CV was generated". These carry no free text and nothing you wrote. See section 6.

What your browser sends

• Your IP address, which we store only as a one-way hash, to detect abuse such as repeated failed sign-ins. We do not keep a log of where you are.
• Your browser's user agent string, recorded against a session.

3. Why we hold each of these

• The profile, so a job-specific CV can be assembled from facts you wrote, and so you do not retype them for every application.
• The job text, so an analysis can be shown again later without asking you to paste it a second time, and so a score can be reproduced rather than guessed at.
• Account and session data, to sign you in and keep you signed in.
• Hashed IP and the security log, to protect your account from someone else. This is the one thing here we hold to keep the service safe rather than because you asked for a feature.
• Product counts, to answer whether the product is used enough to be worth continuing.

We do not sell your data. We do not share it with recruiters, employers, or advertisers. Nobody buys access to a profile here.

4. Where it is stored, and who else touches it

Your profile lives in a Postgres database hosted by Supabase in Mumbai (ap-south-1). The application runs on Vercel, also pinned to Mumbai. Both act on our instructions only. Every table has row-level security switched on, so a request can read your rows and nobody else's, enforced by the database itself rather than by a screen hiding a button.

Password reset emails are sent through Resend, which receives your email address and nothing else.

The one place a model is used

If you choose to import a CV, the text of that document is sent once to a model, which transcribes it into structured fields. This is the only model call in the product, and it is your choice: you can type a profile instead, and nothing is sent until you press the button.

Today that document would go to:

• OpenAI (gpt-5-mini). Does not train on API data by default. Retained up to 30 days for abuse monitoring, then deleted. Their published policy.

This list is generated from the running configuration rather than written by hand, so it is what the service would actually use right now. We may change provider for cost or reliability, and this line changes with it.

Job advertisement text is not sent to any model. Reading a posting is done by our own parser, on our own servers.

Your profile is never sent to a model. Not for tailoring, not for scoring, not for filling a form. Matching a job to your experience is done by our own code, against your own words.

Data leaving India

A model provider named above is outside India, so importing a CV means that document crosses a border once. Under the DPDP Rules 2025 such transfers are permitted except to countries the Central Government restricts, and no restricted list has been notified. Everything else, your stored profile included, stays in Mumbai.

5. The browser extension

The extension is a side panel that reads the job page you are on and shows how you match it, beside the application form.

What it can do:

• Read the page you are looking at, after you grant page access with a button. Nothing is requested when you install it.
• Fetch your own saved details from the app, over one request, to fill a form.
• Put a value into a box on a form you have open.
• Hand a job advertisement to the app, in a tab you can see, for analysis.

What it cannot do:

• It cannot submit an application. Ever. You press send, always.
• It cannot change anything in your profile. The single request it makes is a read, and the route it calls has no write method at all.
• It does not run in the background, does not watch your browsing, and holds nothing once the browser closes.
• It sends no page content anywhere except the job text you explicitly ask it to analyse.

Honest about one thing: the page access it asks for is broad, covering any site, because a job seeker cannot say in advance which employer's careers site they will open next. Nothing is requested until you press the button, and you can revoke it at any time in your browser's extension settings. Revoking it turns the panel off rather than breaking anything.

6. Product counts, and why they are not about you

We count a handful of events, such as a signup or a CV being generated, to answer whether the product is used. They are stored against a one-way pseudonym rather than your account, computed with a key that is not kept in the database, so a copy of that table identifies nobody. They hold counts and flags only, never anything you wrote.

Any figure covering fewer than five people is suppressed rather than shown, so a small number can never be traced back to one person. A pseudonym is still personal data under the Act, so it is treated that way, and it is erased with your account.

7. How long we keep it

• Your profile and everything in it: until you delete it. We do not delete inactive accounts. A career history is worth having three years later, and deleting it because one job search finished would be the worse mistake.
• Sign-in sessions expire on their own, and signing out ends them immediately.
• Password reset links expire, and can be used once.
• Parser diagnostics, which record what our parser made of a job advertisement and contain the employer's wording rather than yours, are deleted after 90 days.
• After you delete your account we keep one line recording that a deletion happened, with no indication of who it was. That is the evidence we did what you asked.

8. Your rights, and the buttons that exercise them

Under the Act you have these rights, and each one has something you can press:

• To know what we hold. This notice, plus download everything, which returns every row of your profile as a file.
• To correct it. Every field is editable on your profile. Nothing needs a request to us.
• To erase it. Delete your account from your profile page. It asks for your password and for you to type a confirmation, because a borrowed laptop should not be enough to destroy your career history. It is immediate and it cannot be undone.
• To withdraw consent. Deleting your account withdraws it entirely, and is as easy as giving it was. You can also delete a single item, such as one job or one CV, without touching the rest.
• To nominate someone to exercise these rights if you are unable to. Write to us and we will record it.
• To complain. Section 9.

If a right is easier to exercise by writing to us than by finding a button, write to us. We will not send you back to the interface.

9. Complaints

Write to privacy@visogreen.com. We will acknowledge it and tell you what we are doing about it. The DPDP Rules 2025 allow up to 90 days for a resolution. We do not intend to use anything like that long, but 90 days is the outer limit you are entitled to hold us to.

If we do not resolve it, you can complain to the Data Protection Board of India, the statutory body for exactly this. You do not need our permission, and you do not have to come to us first.

10. If something goes wrong

If personal data here is exposed, we will tell you without delay: what happened, what it means for you, and what we have done about it. We will also report it to the Data Protection Board, with a detailed report within 72 hours, as the Rules require. You will not find out about it from somebody else.

11. Children

This service is for people applying for jobs and is not intended for anyone under 18. We do not knowingly collect a child's data, and we do not profile, track, or target advertising at anyone at all. If you believe a child has created an account here, tell us and we will delete it.

12. Changes to this notice

If we change what we collect, or who processes it, we will change this page and move the date at the top. For a change that materially affects you, we will tell you directly rather than relying on you noticing.

Written against the Digital Personal Data Protection Act 2023 and the Digital Personal Data Protection Rules 2025, notified on 13 November 2025. The Rules phase in over 18 months, to May 2027. We are not waiting for that date.

Back to the app