Privacy Policy
Last updated: 20 October 2026
This policy explains what personal data JobPass Copilot ("we", "us") collects through our website and desktop app, why, who we share it with, how long we keep it, and the rights you have wherever you live. We wrote it to be read, not skimmed past.
In short
- Audio and screenshots are processed live and never stored on our servers.
- Your resume is stored privately and used only to personalise your answers. Delete it any time.
- We don't sell or share your data for advertising, and we don't use it to train AI models.
- You can download or delete your data yourself from your dashboard.
1. Who is responsible
The data controller (in India, the "data fiduciary") is Endless Software Solutions(sole proprietorship, Udyam UDYAM-MH-21-0145780), Maharashtra, India. Privacy questions and requests: privacy@jobpass.in. Our Grievance Officer (India) can be reached at the same address. We acknowledge grievances within 72 hours and resolve them within 30 days.
2. What we collect
| Data | Where it comes from | Stored? |
|---|---|---|
| Name and email address | You when you sign up, or Google if you use Continue with Google | Yes, while your account exists |
| Password | You, when you sign up | Only as a salted one-way hash; we can't read it |
| Interview profile: target role, experience, preferred language, instructions | You | Yes, until you change or delete it |
| Resume text and an AI-generated summary of it | You upload or paste it | Yes, until you delete it or your account |
| Short audio chunks from your computer during a session, and their transcripts | Desktop app, only while listening is on | No. Processed in real time, then discarded |
| Screenshots you take with the app | Desktop app, only when you trigger it | No. Processed in real time, then discarded |
| Generated answers and your answer history | Our AI | Only on your own computer, not on our servers |
| Usage: session start/end, number of answers and screenshots, audio minutes, AI token counts and cost | Our servers | Yes (billing, fair use, abuse prevention) |
| Mobile number you give Razorpay at your first India checkout | Razorpay (payment confirmation) | Yes, until you delete your account; only used to pre-fill later checkouts |
| Payments: amount, currency, order reference, UPI transaction ID (UTR) or payment provider ID | You and our payment providers | Yes. We never see card numbers, UPI PINs or bank logins |
| Device data: a one-way hashed device identifier, app version, operating system | Desktop app | Yes (one free setup check per device, account security, updates) |
| Approximate country (from your IP address; the country at sign-up sets your prices and payment methods), and how you found us (e.g. an Instagram link) | Your browser / our hosting provider | Yes. We don't store your IP address |
| Messages you send us (contact form or feedback): your email, optional name, topic and message | You | Yes, 24 months, used only to reply and improve support |
| Reviews you choose to post (rating, text, display name) | You | Yes, until you delete them; shown publicly only after approval |
Other people in your interview
When listening is on, the app transcribes audio playing on your computer, which can include the voices of other call participants. This audio is processed live and never stored by us. You are responsible for using the app in line with the laws that apply to you and the rules of the meeting you are in, including any requirement to inform or get consent from other participants.
3. Why we use it, and our legal basis
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Logging you in, running sessions, generating answers, personalising them with your resume | Performance of our contract with you |
| Taking payments, issuing credits, handling refunds | Contract; legal obligation (tax records) |
| Preventing fraud and abuse (setup-check limits, device checks, cost caps, blocking) | Legitimate interests |
| Counting visits and learning which channels bring sign-ups | Legitimate interests; consent where required (e.g. EU/UK) |
| Service emails (sign-up and password-reset codes, payment confirmations) | Contract |
Under India's Digital Personal Data Protection Act, 2023 we process your data based on the consent you give when you create an account and for the legitimate uses the Act allows. You can withdraw consent at any time by deleting your account.
4. Who we share it with
Only with service providers who process data on our instructions, under contracts that protect it:
| Provider | What for | Location |
|---|---|---|
| OpenAI | Transcription and answer generation (audio, screenshots, questions, resume summary) | United States |
| Vercel | Website and API | Global edge network / United States |
| Cloudflare | App installers and updates (sees your IP address when downloading) | Asia-Pacific storage / global network |
| Neon | Database | Region chosen at setup (e.g. Singapore) |
| Optional "Continue with Google" sign-in (we receive your name and verified email only) | United States | |
| Resend | Login and payment emails | United States |
| Brevo | Login and payment emails on busy days (backup to Resend) | European Union |
| Razorpay | Payments in India (UPI, cards, netbanking) | India |
| Dodo Payments | Card payments outside India; as merchant of record it also receives your billing country and tax details | India / United States |
OpenAI does not use data sent through its API to train its models, and may keep it for up to 30 days for abuse monitoring before deleting it. We may also disclose data if required by law, or to a buyer if the business is sold (we will tell you first). We do not sell personal data or share it for cross-context behavioural advertising.
5. International transfers
Our providers are located outside your country, including in the United States and India. Where the law requires, transfers are protected by the European Commission's Standard Contractual Clauses or equivalent safeguards.
6. How long we keep it
- Account, profile and resume: until you delete them or your account. If you don't use JobPass for 24 months, we delete your resume automatically.
- Audio, transcripts and screenshots: not stored (only in memory while being processed).
- Login codes: expire after 10 minutes and are deleted within a day.
- Session usage records: 24 months, then deleted or anonymised.
- Payment records: 8 years, as required by tax law. If you delete your account we keep these in a form no longer linked to your email.
- Support messages from the contact form: 24 months, then deleted.
- Website visit statistics: anonymous (no IP address or identifier), kept for 24 months.
7. Your rights
Depending on where you live, you can:
- Access and download your data: Dashboard → Privacy & data → Download my data.
- Delete your account and data: Dashboard → Privacy & data → Delete my account.
- Correct your profile at any time in your dashboard, or ask us.
- Object to or restrict processing based on legitimate interests, and withdraw consent at any time.
- Nominate someone to exercise your rights if you die or become incapacitated (India).
- Complain to your data protection authority (e.g. your EU/UK supervisory authority or the Data Protection Board of India). We'd appreciate the chance to fix things first.
California residents (CCPA/CPRA): you have the right to know, delete and correct personal information, and to not be discriminated against for using these rights. We do not sell or share personal information, and we do not use sensitive personal information to infer characteristics about you.
Email privacy@jobpass.in for anything you can't do yourself. We reply within 30 days.
8. Cookies and local storage
| Name | Purpose | Type | Lasts |
|---|---|---|---|
| jp_session | Keeps you logged in on the website | Strictly necessary | 30 days |
| jp_consent | Remembers your cookie choice | Strictly necessary | 6 months |
| jp_src | Remembers which link brought you here (e.g. Instagram) | Analytics: only set with your consent in the EU/UK | 30 days |
We use no advertising or third-party tracking cookies. The desktop app stores your login token encrypted on your computer, plus your settings and answer history locally.
9. Security
Data is encrypted in transit (HTTPS). Passwords are stored only as salted one-way hashes, and one-time email codes confirm sign-ups and password resets. Desktop login tokens are encrypted on your device, only work on the computer they were issued to, and can be revoked. Access to production data is limited to the operator of the service. No system is perfectly secure; if a breach affects you we will notify you and the authorities as the law requires.
10. Children
The service is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has used it, contact us and we will delete the data.
11. Changes
If we make material changes we will update the date above and notify you by email or in the app before they take effect.