1. What we collect
- Account: name, email, phone, password hash, role.
- Profile: skills, work history, city, work mode, resume file. All editable.
- Applications: jobs you applied to, assessment responses, AI grading notes.
- Bootcamps: enrollments, lesson progress, skill checks, assignments.
- Messages: AI Coach chats, recruiter conversations (post Stage 1), InMail threads.
- Payments: PhonePe transaction IDs, GST invoice data, consent timestamp + IP for chargeback defence.
2. How we use it
To run the platform: match you to jobs, grade assessments, deliver bootcamp content, track applications, enforce SLAs, send notifications.
To improve the platform: aggregate skill-gap analytics (no PII), telemetry on drop-off points, content quality signals.
To comply with the law: GST invoices, TDS for instructor payouts, breach notification, audit logs (7-year retention).
We do not sell your data. Recruiters see your profile per your visibility settings — not third parties.
3. Where it lives
Primary database: MongoDB Atlas in ap-south-1 (Mumbai). Read replicas in ap-southeast-1 (Singapore) are anonymised for analytics only — no PII crosses Indian borders without your explicit consent.
Resume files + video content: Cloudflare R2 (Mumbai region). AI inference: Anthropic + Google Vertex AI — request/response not used for model training.
4. Your rights (DPDP Act)
- Access: download a JSON bundle of everything we store via
Settings → Download my data. - Correction: edit any field via
Profile → Edit. Or email dpo@unghost.com. - Erasure: 30-day soft delete via
Settings → Danger zone. After 30 days PII is anonymised; financial + audit trails preserved per Indian law. - Portability: the JSON bundle is machine-readable.
- Withdraw consent: revoke marketing / search-visibility at any time in Settings.
- Complain: Data Protection Board of India · DPO at unGhost (dpo@unghost.com).
5. Cookies + tracking
Essential: session, CSRF, consent record. Always on.
Analytics: PostHog self-hosted in India. Opt-out via cookie banner. No third-party ad networks.
6. Breach notification
If we detect a personal-data breach we notify the Data Protection Board of India within 72 hours and affected users immediately. We publish a public post-mortem on status.unghost.com.
7. Children
unGhost is for users aged 18 and above. We do not knowingly collect data from minors. If you believe we have, email dpo@unghost.com and we will purge it.
8. Changes to this policy
Material changes are emailed to all users with 30 days notice. Minor edits are dated. Version history is preserved — request a prior version from legal@unghost.com.