Privacy policy

1. Introduction

This Privacy Policy explains how Qelsa, having its registered office at HSR Layout, Karnataka, India ("Qelsa", "we", "us", "our"), collects, uses, discloses, and protects personal data of Users of the Qelsa Platform (website and mobile applications). Qelsa processes personal data in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and, where applicable to Users outside India, relevant international data protection principles. If you are between 16 and 18 years of age, you may use the Platform only with parental or guardian consent, and we process such consent in line with the DPDP Act's provisions for children's/minor's data.

2. Data Fiduciary and Grievance Officer

Qelsa acts as the Data Fiduciary for personal data processed on the Platform. Grievance Officer Name: [NAME] Email: [GRIEVANCE EMAIL] Address: HSR Layout, Karnataka, India Any complaints or queries regarding processing of your personal data may be directed to the Grievance Officer, who will respond within the timeline prescribed under applicable law.

3. Personal Data We Collect

3.1 Provided directly by you:

• Name, email address, phone number, date of birth
• Educational background, work history, certifications, skills
• Resume/CV files and free-text profile content
• Job preferences, location, industry interests
• Account credentials (or Google OAuth identifiers, if you sign in with Google)
• Payment-related information processed via Razorpay (Qelsa itself does not store full card/bank details)

3.2 Collected automatically:

• Device information, IP address, browser type
• Usage data: pages visited, features used, session duration
• Cookies and similar tracking technologies (see Section 9)

3.3 Collected from third parties (with consent, where applicable):

• Basic profile information from Google, if you sign in via Google OAuth
• Candidate or job data received via ATS integrations when an employer connects their ATS to Qelsa
• Publicly available professional information, where lawfully sourced, used to enrich company/industry/skills reference data (not scraped personal profiles)

3.4 Generated by Qelsa:

• Readiness Score and underlying skill-match assessments
• AI-generated summaries, suggestions, and competency evaluations
• Aggregated/anonymized usage and training data

4. How We Use Personal Data

We use personal data to:

1. Create and manage your account and profile
2. Generate your Readiness Score and skill-gap analysis
3. Match job seekers with relevant roles and employers with relevant candidates
4. Power AI-assisted features (resume review, job-match explanations, competency assessment) using Qelsa's AI agents, which run on third-party AI infrastructure (Anthropic)
5. Process payments for subscriptions via Razorpay
6. Facilitate ATS integrations for employer customers
7. Send service communications, updates, and (with consent, where required) marketing communications
8. Improve the Platform, including training and refining Qelsa's proprietary scoring models, in anonymized/aggregated form
9. Detect fraud, enforce our Terms, and comply with legal obligations
10. Respond to grievances and support requests

5. Legal Basis / Consent

Under the DPDP Act, we process your personal data on the basis of your consent, obtained through clear notice at the point of collection (e.g., account creation, ATS connection, cookie banner), or where processing is otherwise permitted by law (e.g., compliance with legal obligations, certain "legitimate use" categories under the Act). You may withdraw consent at any time as described in Section 8, subject to the effect withdrawal may have on your ability to use certain features.

6. Disclosure of Personal Data

We disclose personal data as follows: 6.1 To employers (Job Seekers only): When you apply to a role or participate in the hiring marketplace, employers may receive your profile, skill names, proficiency gaps, and general readiness/priority tier information. We do not disclose the exact numeric weights or internal formula behind your Readiness Score to employers or candidates. 6.2 To service providers (processors):

• Google — authentication (OAuth)
• Razorpay — payment processing
• ATS providers — where an employer customer has connected their Applicant Tracking System for integration purposes
• Anthropic — AI infrastructure powering Qelsa's agents (resume review, job matching, competency assessment, etc.)
• DigitalOcean — cloud hosting and database infrastructure These providers process data on Qelsa's behalf and are contractually/technically restricted from using it for their own purposes beyond providing their service to Qelsa, except as governed by their own applicable terms. 6.3 Legal disclosures: We may disclose data if required by law, court order, or governmental authority, or to protect the rights, safety, or property of Qelsa, our Users, or the public.

6.4 Business transfers: If Qelsa is involved in a merger, acquisition, or asset sale, personal data may be transferred as part of that transaction, subject to equivalent privacy protections.

6.5 We do not sell personal data to third parties.

7. AI Processing and Model Training

7.1 Certain features send relevant profile or query data to Qelsa's AI agents (built on Anthropic's models) to generate outputs such as resume feedback, job-match explanations, or competency assessments.

7.2 Conversations and interactions with AI features may be logged (in a table referred to internally as training_candidates) for quality improvement and, over time, to support development of Qelsa's own proprietary AI models. Where used for this purpose, data is anonymized/de-identified before being used in model training or evaluation.

7.3 The Readiness Score itself is generated primarily through a deterministic, structured skill-matching methodology (not free-text AI scoring), which limits reliance on AI interpretation for your core score.

8. Your Rights (DPDP Act)

Subject to applicable law, you have the right to:

• Access a summary of personal data we hold about you and the processing activities
• Correction and updating of inaccurate or incomplete personal data
• Erasure of personal data that is no longer necessary for the purpose it was collected, subject to legal retention requirements
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal
• Grievance redressal via our Grievance Officer (Section 2), and thereafter, if unresolved, escalation to the Data Protection Board of India
• Nominate another individual to exercise your rights in the event of death or incapacity, as provided under the DPDP Act To exercise these rights, contact [privacy/support email]. We may need to verify your identity before acting on a request.

9. Cookies and Tracking

We use cookies and similar technologies to keep you logged in, remember preferences, and understand Platform usage (analytics). You can control cookies through your browser settings; disabling certain cookies may limit Platform functionality. [Add specifics once analytics/ad tools are finalized, e.g. Google Analytics.]

10. Data Retention

We retain personal data for as long as your account is active and as necessary to provide the Platform, comply with legal obligations (e.g., tax/GST records for B2B invoicing), resolve disputes, and enforce agreements. Anonymized/aggregated data used for model improvement may be retained beyond account closure, since it is no longer personal data.

11. Data Security

We use reasonable technical and organizational measures to protect personal data, including encrypted storage of credentials and sensitive configuration, access controls, and secure hosting infrastructure (DigitalOcean, managed PostgreSQL). No system is completely secure; we cannot guarantee absolute security.

12. Children's / Minors' Data

Qelsa permits use by Users aged 16 and above. For Users between 16–18, we seek to obtain verifiable parental/guardian consent where required under the DPDP Act, and limit certain processing (e.g., behavioral tracking for advertising) accordingly. Qelsa does not knowingly collect personal data from individuals under 16; if we become aware that we have, we will delete it.

13. Cross-Border Data Transfer

As Qelsa expands internationally, personal data may be processed or stored on servers located outside India. Where required, we will implement appropriate safeguards for such transfers consistent with the DPDP Act and applicable destination-country laws. [To be finalized upon confirming international hosting/processing arrangements.]

14. Employer / B2B Data Handling

Where an employer connects an ATS or otherwise submits candidate data to Qelsa, the employer is responsible for ensuring it had a lawful basis to share that data with Qelsa. Qelsa processes such candidate data solely to provide the Employer Services (matching, readiness signals, shortlisting support) as instructed by the employer customer.

15. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be notified via the Platform or email at least [7/14] days in advance. The "Last Updated" date at the top reflects the most recent revision.