Privacy Policy

1Information We Collect

Account and sign-in data

When you create an account, we collect the information needed to authenticate you, including your email address, display name, avatar URL, sign-in provider, and account role. We support email/password, one-time link, and Google OAuth through Supabase Auth.

Candidate profile data

Candidates may provide skills, role preferences, salary expectations, location, availability, work-style preferences, resume links, uploaded resume PDFs, profile headlines, bios, education, current role, and social or portfolio links. Privacy controls let candidates hide selected fields from employer-facing views.

Employer profile data

Employers may provide company name, work email, website, company size, industry, location, overview, LinkedIn URL, job postings, candidate tracker notes, and verification details. Domain verification emails are sent through Resend.

Job, swipe, and application activity

We store job saves, passes, rejects, applies, in-app interest actions, votes, reports, application tracker statuses, job alert filters, course saves, and learning progress. This activity powers matching, recommendations, anti-spam controls, and analytics.

Community and public submissions

If you submit testimonials, company reviews, referral posts, feedback, salary signals, interview experiences, culture notes, comments, or votes, we store the content and related moderation metadata. Some surfaces are public by design after moderation. Where a feature displays content as anonymous, we may still keep an internal account link for abuse prevention, editing, rate limiting, and legal compliance.

Payments

Paid plan checkout is processed by Razorpay. We do not store card numbers, UPI IDs, bank account details, CVV, or full payment credentials. We receive and store limited payment metadata such as Razorpay order IDs, payment IDs, amount, currency, plan type, payment status, and subscription access dates.

AI feature inputs and outputs

AI tools may process job descriptions, profile details, skills, resume text, uploaded resume content, cover letter notes, interview-prep requests, and fit-score context. We use these inputs to generate resume drafts, cover letters, interview prep, fit scores, course recommendations, Scam Shield signals, and matching insights.

Messages and attachments

Employer-candidate chat content, read receipts, file attachments, and image or PDF uploads are stored so the participants can access the thread. GIF search terms may be sent to our configured GIF provider when you use the GIF picker.

Automatically collected data

We may collect device type, browser, IP-derived approximate location, pages viewed, referrer, timestamps, performance metrics, error logs, cookie preferences, and similar technical information. We use this to run the service, debug issues, prevent abuse, and understand product usage.

Job and market data

Job listings, salary ranges, and market signals come from third-party job APIs, public feeds, partner feeds, direct employer posts, and user-submitted community signals. We normalize and score this information for discovery, but we do not guarantee that every listing or market signal is complete, current, or verified.

2How We Use Your Information

We use collected information to:

1. Create, authenticate, secure, and manage accounts.
2. Build candidate and employer profiles.
3. Personalize job feeds, saved alerts, course recommendations, and matching.
4. Record saves, passes, rejects, applies, votes, reports, and tracker updates.
5. Operate employer postings, candidate discovery, shortlists, candidate tracking, and chat.
6. Generate AI-powered resumes, cover letters, fit scores, interview prep, and safety signals.
7. Process payments, grant paid access, issue receipts, and handle refunds or payment disputes.
8. Send account, verification, security, job alert, and service emails.
9. Moderate testimonials, reviews, referral posts, feedback, and community content.
10. Detect scams, spam, fake accounts, platform abuse, and security incidents.
11. Analyze aggregate usage, performance, reliability, and conversion trends.
12. Comply with legal, tax, accounting, fraud-prevention, and dispute-resolution obligations.

3Cookies and Tracking Technologies

Essential cookies

Supabase Auth and related platform cookies keep you signed in, protect sessions, and remember required security state. These are necessary for the service.

Analytics and performance

Google Analytics and Vercel Analytics may help us understand traffic, product usage, Core Web Vitals, and reliability. Where consent controls apply, analytics storage is denied until you opt in.

Your choices

You can accept or decline non-essential cookies in the cookie banner where shown. You can also clear or block cookies through your browser settings, but some account features may stop working if essential cookies are blocked.

4Third-Party Processors and Sharing

We do not sell personal information. We share data only as needed to operate the service, process requests you initiate, prevent abuse, comply with law, or work with vendors that process data for us.

1. Supabase: authentication, PostgreSQL database, storage, and real-time features. See Supabase's Privacy Policy.
2. Razorpay: payment checkout, payment verification, refunds, and transaction records. See Razorpay's Privacy Policy.
3. Anthropic: AI processing for resume, cover letter, fit score, interview prep, classification, and matching features. See Anthropic's Privacy Policy.
4. Google: OAuth sign-in and consent-gated Analytics. See Google's Privacy Policy.
5. Resend: transactional email, domain verification, receipts, and service notifications. See Resend's Privacy Policy.
6. Twilio: SMS OTP delivery if phone verification is enabled. See Twilio's Privacy Policy.
7. Vercel: hosting, serverless functions, performance telemetry, and deployment infrastructure. See Vercel's Privacy Policy.
8. External job and application sites: when you open or apply to an external listing, you leave ScrollGigs and the destination site controls the data you submit there.

5Public and Community Content

Some content you submit can become visible to other users or the public, including approved testimonials, company reviews, referral posts, community salary/interview/culture notes, comments, votes, and selected profile fields. Do not submit private documents, confidential employer information, personal data about other people, or content you are not allowed to disclose.

Anonymous or partially anonymous display does not mean the submission is untraceable inside our systems. We may keep account-level records to enforce rate limits, remove abuse, investigate reports, and respond to legal requests.

6Data Storage and Security

We store platform data in Supabase-hosted infrastructure and use row-level security, authenticated API routes, HTTPS, scoped service keys, rate limits, and logging to reduce unauthorized access risk. No internet service can guarantee perfect security, but we design the product to limit unnecessary exposure.

Payment secrets stay server-side. Razorpay key secrets, Supabase service keys, email provider secrets, and AI provider keys are not intentionally exposed to client-side code.

7Data Retention

1. Account data: retained while your account is active.
2. Deleted accounts: account deletion is a 30-day soft-delete period, during which you can reactivate. After that deadline, our daily purge removes the auth identity, profile, private application activity, matches, messages, uploaded avatars and chat attachments, and identifying free-text submissions.
3. Payments: payment IDs, order IDs, receipts, refund records, and accounting metadata are retained as needed for tax, accounting, fraud, and dispute requirements. The ScrollGigs profile identifier is detached when the account is purged.
4. Community content: public or moderated posts, reviews, testimonials, votes, and comments linked to the account are removed. Abuse reports may retain only their reason, status, and timestamps after identities and free-form notes are removed.
5. Messages and attachments: stored privately while the conversation is active and removed when the related match is purged after account deletion.
6. Logs and analytics: retained for a limited operational period unless longer retention is needed for security, fraud prevention, or legal reasons.

8Your Rights and Choices

Depending on your location, you may have rights to access, correct, delete, export, restrict, or object to certain processing of your personal data. You can update many fields directly in your profile, privacy controls, job alerts, and account settings.

You can opt out of marketing emails where unsubscribe controls are provided. You can request account deletion from your profile page or by contacting us. To make a privacy request, email admin@scrollgigs.com.

9Children’s Privacy

ScrollGigs is not intended for children under 16. We do not knowingly collect personal information from children. If you believe a child has provided personal information, contact us and we will take appropriate deletion steps.

10Third-Party Links

External job listings, application links, payment pages, social profiles, company sites, and community links are controlled by third parties. Their privacy practices are not controlled by ScrollGigs. Review the destination site's policies before submitting personal information.

11Changes to This Policy

We may update this Privacy Policy to reflect product, vendor, security, or legal changes. Material changes will be posted on this page with a new “Last updated” date and, where appropriate, communicated by email or in-app notice.

12Contact Us

For privacy questions, data requests, or complaints, contact admin@scrollgigs.com.