Privacy Policy
What we collect, why we collect it, and what we do (and don't do) with it.
1. Who we are
Spektr Career Solutions ("Spektr") is operated by SPEKTR Career Matrix Pvt Ltd. We act as the data controller for personal information collected through the service.
2. What we collect
2a. Account data
- Email address and password (hashed, never stored in plain text)
- Full name (optional, for personalisation)
- Profile details you choose to add: phone, target role, target country, visa type, degree, job-search status
2b. Resume + AI inputs
- Resumes you upload (PDF, DOCX, TXT) and the plain text we read out of them
- Job posts you paste into Tailor, Job Match or Cover Letter
- Quiz answers and AI feedback returned for them
- Cover letter drafts the AI writes for you
2c. Activity data
- Job searches you run (roles, country, location, experience and job type) — stored on our servers against your account, so the “Recent” list follows you to any device you sign in on. We keep the last eight; you can clear them from that list at any time, and they are deleted with your account
- Saved jobs and notes you add to them
- Applications you log (role, company, status)
- Tasks you create
2d. Technical data
- IP address, browser type, device type — collected by our hosting provider's standard server logs
- Pages you visited and timestamps — for debugging and abuse prevention
3. Why we collect it
- To run the service: matching jobs to your profile, running AI tools on your resume, tracking your applications.
- To improve the product: aggregate, anonymised analytics on which features are used.
- To communicate with you: account-related emails (password reset, billing receipts, security alerts). We don't send marketing without explicit opt-in.
- To prevent abuse: detect spam, scraping, or attacks.
4. Who we share it with
We share data only with the subprocessors required to operate the service:
- Supabase — managed Postgres database (Singapore region)
- Render — application hosting (web service + static files)
- Google — the Gemini API powers our AI features. Your resume text and the job post you paste are sent to Gemini to tailor a resume, score a match, write a cover letter, or set and mark a practice interview
- xAI — Grok API as a secondary AI provider on routes where it's the configured primary; falls back to Gemini when Grok credentials aren't present
- Razorpay — payment processing for Pro/Pro+ subscriptions (we never see your full card details)
- logo.dev — company logos shown on job result cards
We don't sell, rent, or trade your personal data. We don't use it to train AI models without your explicit opt-in.
5. Cookies
We use:
- Session cookies — required for login. Without these, the site doesn't work.
- CSRF cookies — security, required for form submissions.
- Browser storage — a small amount of per-tab state, such as the URL of the search you last ran so the sidebar can take you back to it. It is rebuilt as you use the app and nothing is lost by clearing it. Your theme and your recent searches are not kept here; they are stored against your account.
We don't use third-party tracking cookies. No Google Analytics, no Facebook Pixel, no advertising trackers.
6. Your rights
You can at any time:
- View your data — most of it is visible in your Profile, Settings, and Saved Jobs pages
- Edit your account details in Settings
- Export your data — email support@spektrcareers.com and we'll send a JSON dump within 30 days
- Delete your account — email support@spektrcareers.com. We'll delete all your data within 30 days, except where retention is legally required (e.g. financial records for paid subscriptions, retained per Indian accounting law)
7. Data retention
- Account data — kept while your account is active, deleted within 30 days of account closure
- Resume + AI inputs — kept while your account is active so you can revisit past tailored versions; deleted on account closure
- Server logs — retained for 30 days for debugging, then deleted
- Billing records — retained 7 years per Indian tax law
8. International transfers
Some of our subprocessors are based outside India (xAI and Google in the US, Render in the US, Razorpay in India). Data passed to them is protected by standard contractual clauses and the security commitments of each vendor.
9. Security
We use HTTPS everywhere, hash passwords with PBKDF2 (Django's default), and limit access to production data to a small set of authorised engineers. No system is perfectly secure; if we detect a breach we'll notify affected users within 72 hours per Indian DPDP Act standards.
10. Children
Spektr is for adults age 18+. We don't knowingly collect data from children under 18. If you believe a minor has signed up, email support@spektrcareers.com and we'll delete the account.
11. Changes
We'll announce material changes to this policy by email and at least 14 days before they take effect.
12. Contact
Privacy questions: support@spektrcareers.com
Or use the contact page.