What we store
We store your résumé text, parsed structured data, the job descriptions you paste, scoring outputs, and your account email. That's it. We don't track you across other sites.
What we don't do
We don't sell data. We don't share with advertisers. We don't use your résumé content to train models, ours or anyone else's. We don't profile you for anything beyond the agent pipeline you explicitly run.
Auth and identity
Sign-in is magic-link via Supabase Auth. We see your email and a Supabase user id. No password, no third-party social logins by default.
Payments
Razorpay (India) or Stripe (global) handle the actual card / UPI / wallet data. We never see your card number - we receive a payment id plus the plan you bought.
Retention
Active accounts retain résumés, score reports, and tailorings only for the retention window described below, so you can re-score recent work without us storing it indefinitely. Deleting your account purges all stored résumés, score reports, and tailorings within 30 days. Anonymous aggregate metrics (for example, “how many tailorings were run last month”) may be retained.
Your rights
You can request a data export, a deletion, or a copy of what's stored about you by emailing privacy@reciprocate.in. We respond within 7 days. India users: this satisfies our obligations under the DPDP Act, 2023. EU users: this is our GDPR commitment.
Cookies and local storage
We use first-party storage: localStorage for the Writing Room draft, sessionStoragefor the builder→analyzer hand-off, and Supabase's auth session cookie.
We use PostHog for product analytics. PostHog runs in the browser, sets a first-party cookie/localStorage entry to maintain an anonymous session id, and records page views and product events (e.g. “upload started”, “verdict shown”). PostHog does not track you across other websites. We do not use Google Analytics, Hotjar, or Meta Pixel.
Children
Reciprocate is not for users under 16. If you believe a minor has signed up, write to us and we'll delete the account.
DPDPA Compliance (India)
This section sets out our obligations and your rights under India's Digital Personal Data Protection Act, 2023 (“DPDPA”).
Data Fiduciary: Reciprocate, operated as a sole proprietorship by Hemang Sengar in Bengaluru, Karnataka, India. Our registered correspondence address is available on written request to privacy@reciprocate.in; we share it with verified Data Principals and lawful authorities. General contact: privacy@reciprocate.in.
Lawful basis for processing:we process your personal data on the basis of (i) your explicit consent given at signup and when you submit a résumé or job description, and (ii) the “certain legitimate uses” ground under Section 7 of the DPDPA, limited to operating the service you signed up for.
Your rights as a Data Principal: you have the right to (a) access a summary of the personal data we hold about you and the processing activities we have undertaken, (b) correction and updating of inaccurate or incomplete data, (c) erasure of your personal data, (d) grievance redressal via our Grievance Officer (below), and (e) nomination of another individual to exercise these rights in the event of your death or incapacity. To exercise any right, email privacy@reciprocate.in.
Grievance Officer: Hemang Sengar, reachable at privacy@reciprocate.in. Grievances are acknowledged within 7 days and resolved within 30 days, as required by the DPDPA. Mark the subject line “Grievance · DPDPA” so we triage it on the right queue.
Retention policy: résumés, parsed structured data, score reports, and tailorings are automatically purged 90 days after your last account activity. Account deletion via the in-app control is processed immediately - all personal data is removed from the primary database the same day, with any encrypted backups expiring within 30 days on rolling rotation. Anonymised, aggregate usage metrics that cannot be linked to you may be retained for product analytics.
Cross-border transfer:our configured LLM processor currently processes résumé and job-description text outside India. Specifically, Groq (United States) receives the text of your résumé and the job description when you run the scoring or tailoring pipeline. If Reciprocate configures another model processor for this workflow, we will update this policy before that processor handles résumé or job description text. PostHog Inc. (product analytics, EU/US-hosted, runs in-browser) receives anonymous page-view and product-event data. We do not send these processors your email or other directly identifying account data. We rely on these processors' published Data Processing Agreements and standard terms; India does not currently restrict these destinations under any DPDPA notification. Write to privacy@reciprocate.in if you need the specific processor agreements on record for a regulatory request.
Contact
privacy@reciprocate.in for any privacy question. We read every email.