Privacy Policy

1. Who we are and how to contact us

Gaash is a resume and cover-letter product available at https://gaash.io. For privacy requests, questions, or complaints, email hello@gaash.io. We will respond using the contact details you provide and, where needed, the email on your account. That address is also the channel for privacy grievances under applicable Indian law.

2. Scope

This Policy covers the public website, guest editor (/try), authentication, dashboard, authenticated editor, PDF preview and download, Gaash Score, AI writing features (when enabled), cover letters and optional job-description text, public portfolio pages, payments and promo codes, contact form, and related transactional email. It does not control the privacy practices of third-party sites we link to (for example Google’s sign-in screens or Razorpay’s checkout pages).

3. Personal data we collect

• Account and authentication. Email address and authentication records when you sign in with a magic link or Google through our auth provider (Supabase Auth). We do not receive your Google password.
• Resume and cover-letter content. Text, structure, and design settings (template, fonts, colours, layout options) you save, stored in our database and associated with your user identifier. Optional job description text you paste for cover-letter drafting or Gaash Score context.
• Profile photographs. Optional uploads to object storage. The editor references a URL for that file; anyone who obtains the URL may open the image. Guests cannot upload photographs.
• Guest drafts. On /try, draft content remains in your browser (local storage) until you clear it or sign in and import it. We receive that draft on our servers only if import occurs.
• Portfolio. If you claim a username or publish a portfolio, the username and the content you choose to show (including optional social links and open-to-work signals) may be publicly available on the internet, including via social-link previews. Username availability checks may query whether a slug is already taken.
• Payments and entitlements. When you buy a pass, Razorpay processes the transaction. We store order id, payment id, verification data as required, amount, plan, status, and pass session records (including expiry and remaining AI runs). We do not store full card or UPI credentials.
• Promo codes. If you apply a promo code, we process the code, eligibility result, and redemption record tied to your account. The browser may keep a recent code or UTM parameters in session storage to help complete checkout.
• AI requests. If AI features are enabled and you initiate a rewrite or cover-letter generation with remaining AI runs, we send the text needed for that request to Google’s Gemini API, debit an AI run, and may retain limited usage metadata (model, token counts, cost estimates, success or error status). We do not build a marketing profile from your resume text.
• Gaash Score. When you run a score check, we process your resume content and any job description you provide for that check. Score results may be stored on the resume record for display in the product.
• Contact messages. If you use the contact form, we process the name, email, and message you submit in order to respond.
• Preferences and session. Theme preference (light / dark / system) is stored in your browser. Session cookies from our auth provider keep you signed in for dashboard and save APIs.
• Technical logs and traffic analytics. Our hosting provider (Vercel) may record request metadata such as IP address, URL, timestamps, and user agent. We also use Vercel Web Analytics for aggregated page views and referrers. That product is designed to avoid cookies and to process visitor data in a privacy-preserving way (for example hashed or truncated identifiers). We do not use advertising SDKs or third-party ad trackers.

4. How we use personal data

• Create and maintain your account and authenticate you.
• Store, display, and export resumes, cover letters, and portfolio pages you create.
• Provide PDF preview and download in your browser.
• Enforce free-plan and pass limits on create, template, score, AI, and portfolio actions.
• Import a guest draft after sign-in when one exists in that browser.
• Process payments, promo codes, and unlock or revoke pass entitlements.
• Send transactional email (magic links, welcome messages, payment receipts, replies to contact form).
• Provide support, investigate misuse, and protect the Service (including rate-limiting).
• Comply with legal obligations and enforce our Terms of Service.
• Operate, secure, and improve the Service (including debugging and preventing fraud).

We process personal data because it is necessary to provide the Service you request, to perform a contract with you (including paid passes), to pursue legitimate interests such as securing and improving the Service (balanced against your rights), and where required by law. Where consent is required (for example certain optional processing), we will ask for it in context.

5. When we share personal data

We do not sell your personal data. We share it with processors and providers who help us run the Service, under arrangements appropriate to the service they provide:

• Supabase: authentication, database, and file storage.
• Razorpay: payment processing when you buy a pass.
• Google: Google sign-in (if you choose it) and Gemini API (if you use AI features).
• Resend: transactional email delivery.
• Vercel or another host: application hosting and related infrastructure logs.

We may also disclose information if required by law, legal process, or to protect the rights, safety, or integrity of the Service, our users, or the public; or in connection with a merger, acquisition, or sale of assets, subject to appropriate confidentiality.

Other users cannot open your private dashboard or private resumes through the application; access controls associate resume records with your user id. Public portfolio pages and photograph URLs are exceptions you control by publishing or uploading.

6. International processing

We operate with primary operations oriented to India. Providers such as cloud hosts, authentication, payments, email, and AI may process data in other countries. Where we transfer personal data internationally, we rely on appropriate safeguards offered by those providers and on your use of the Service knowing that such transfers may occur.

7. Retention

• Account and saved content: for as long as the account exists, unless you delete content earlier.
• Photographs: until you remove them or the account is deleted.
• Guest drafts: until import, clearance, or browser deletion.
• Payment, promo redemption, and entitlement records: as needed for accounting, dispute resolution, fraud prevention, and legal obligations.
• AI usage metadata: retained with your account history until account deletion, subject to backup rotation.
• Auth cookies: until sign-out or expiry.
• Host and security logs: according to the host’s defaults and our security needs.
• Expired pass sessions may be purged on a schedule after they are no longer needed for entitlements.

8. Security

We use industry-standard measures appropriate to the nature of the Service, including transport encryption (HTTPS), access controls on administrative systems, and database access rules that restrict private resume data to the owning account. No method of transmission or storage is completely secure. You should protect your email and Google account used for sign-in. Public portfolio content and photograph URLs should be treated as potentially world-readable once published or uploaded.

9. Your choices and rights

• Edit or delete resume and letter content in the editor.
• Remove an uploaded photograph in the editor.
• Unpublish a portfolio or change visibility options in the product.
• Sign out; guest drafts remain in that browser until cleared.
• Request a refund of a paid pass as described in our Terms of Service.
• Delete your account in Settings (with confirmation). Account deletion permanently removes account-linked data we store, including resumes, portfolio, photographs, payment linkage we hold, sessions, promo redemptions tied to your user id, and AI usage history tied to your user id, subject to limited residual copies in backups or logs that rotate out on a normal schedule, and records we must keep for legal or accounting reasons.

Depending on where you live, you may have rights to request access, correction, erasure, restriction, or a copy of certain personal data, or to object to certain processing. To exercise these rights, email hello@gaash.io from your account address and describe your request. We may need to verify your identity before acting. Data export is currently handled manually upon request.

10. Cookies and similar technologies

We use cookies and similar storage that are necessary to authenticate sessions and operate the Service. Theme preference may be stored locally in your browser. Promo code and UTM helpers may use session storage on the plans flow. Vercel Web Analytics does not rely on advertising cookies. We do not run a separate advertising cookie suite. Your browser settings may allow you to block cookies; blocking auth cookies will prevent sign-in.

11. Children

The Service is directed to adults building professional documents. We do not knowingly collect personal data from children under 18. If you believe we have collected such data, contact us and we will delete it promptly.

12. Automated tools

Gaash Score and AI writing features process content you submit to produce suggestions or scores. They are assistive tools only. They do not make hiring decisions about you on behalf of employers. You should review all outputs before relying on them.

13. Legal framework

We process personal data in connection with offering the Service from India. India’s Digital Personal Data Protection Act, 2023 and related rules may apply. For privacy grievances, contact hello@gaash.io. We have not appointed a separately published Data Protection Officer on this page; that contact is the channel for privacy matters.

If you are located outside India, local laws (including GDPR-style regimes) may grant you additional rights. We will endeavour to honour reasonable access and deletion requests even where a formal local assessment has not been published.

14. Changes to this Policy and to the Service

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page will change when we do. Material changes to collection, AI processing, analytics, payments, retention, or deletion will be reflected here. Continued use of the Service after an update constitutes acknowledgement of the revised Policy, except where applicable law requires a different form of notice or consent.

Separately, we may change product features, pricing, plan limits, promo programmes, and related commercial terms as described in our Terms of Service. Those commercial changes may affect what data we need to process (for example new payment fields) and will be reflected in this Policy when relevant.

15. Related terms

Use of the Service is also governed by our Terms of Service, including passes, promos, refunds, and our right to change pricing and the Service.