Privacy Policy

Effective: May 14, 2026

This Privacy Policy explains what personal data Why Not Initiatives (“MyInteractiveCV,” “we,” “us,” or “our”) collects when you use myinteractive.cv (the “Service”), how we use and share it, how long we keep it, and the rights you have over it. We try to use plain language; where we use a defined legal term, we explain what it means.

1. Who Is the Controller

The data controller (under GDPR), business (under CCPA/CPRA), and data fiduciary (under India’s DPDP Act 2023) for personal data processed through the Service is:

Why Not Initiatives
A5, Fifth Floor, RSR Enclave, 19th M Cross, Kaggadasapura, CV Raman Nagar, Bengaluru, Karnataka 560093, India
Contact: support@myinteractive.cv

2. Scope

This Policy covers all personal data we process when you visit our website, create an account, upload a resume, customize a Bot, chat with someone else’s Bot, or receive emails from us. It does not cover websites or services that we do not operate, even when linked from the Service.

3. Data We Collect

We collect only the data we need to run the Service. Concretely:

3.1 Account data

• Email address
• Password (we never see this in clear text — our auth provider stores only a salted hash)
• Full name
• Phone number (optional)
• Profile photo (optional)

3.2 Resume and Bot data

The PDF or DOCX you upload, plus the structured data we extract from it. This typically includes: name, email, phone, location, LinkedIn and portfolio URLs, work experience, education, skills, certifications, languages, awards, projects, recommendations, and other online presence.

3.3 Bot settings

Your chosen tone, communication style, highlighted strengths, starter prompts, allowed and restricted topics, custom instructions, work preferences, career goals, and personal brand notes.

3.4 Conversation data

Messages exchanged with your Bot, the recruiter’s name and company if they share them, session and tab identifiers, message count, AI tokens used, cost, and timestamps (started, last message, completed). Recruiters can mark a conversation private, in which case its transcript is not visible to the candidate.

3.5 Click and engagement analytics

When someone visits or shares a Bot link, we store a row in our bot_link_clicks table with: session identifier, source (e.g., direct, referrer host), device type, country, region, city, and latitude/longitude rounded to roughly one decimal place (about a 10 km radius) to reduce re-identification risk.

3.6 Payment records

When you purchase a plan, Razorpay handles the card data; we never receive or store your card number, CVC, or full bank details. We store the Razorpay payment ID, amount, plan type, status, and timestamp.

3.7 Notification state and email events

Your per-category email preferences, weekly-digest pause state, and last-sent timestamps. We also log delivery, open, click, and bounce events received from our email provider for each message we send.

3.8 Technical data

Standard request metadata (IP address, user agent, request timestamps) used by our hosting and rate-limiting providers to keep the Service available and free of abuse.

4. How We Use Your Data and Lawful Bases

For users in the EU, EEA, UK, and Switzerland, the GDPR requires us to specify a lawful basis for each use. Where the basis is consent, you can withdraw it at any time without affecting earlier processing.

5. AI Processing

The Service uses third-party large language models from OpenAI (currently GPT-4.1-mini as the primary provider) and Google AI (Gemini 2.5 Flash as a fallback) to:

• Parse and structure your uploaded resume.
• Generate Bot responses during recruiter conversations.
• Run our AI-assisted personal-information redaction step (described in Section 7) when you delete your account.
• Generate insights and summaries from your completed conversations.

When we call these providers we send only the data needed for the task at hand. OpenAI and Google AI may retain prompt and response data per their own retention policies (typically around 30 days) for abuse-monitoring and compliance purposes. Because that retention is outside our direct control, we cannot guarantee instantaneous deletion of data that has already been sent to them.

AI output can be inaccurate, incomplete, or inconsistent with the underlying resume. Bot replies are machine-generated and should not be treated as your personal statements or as legal, professional, medical, or financial advice.

6. Who We Share Data With (Sub-processors)

We do not sell your personal data and we do not share it for cross-context behavioural advertising. We share data only with the following service providers, who act as processors on our behalf under appropriate data-processing terms.

We may also disclose data when required by law, to enforce our Terms, to protect rights, property, or safety, or in connection with a corporate transaction (merger, acquisition, asset sale) where the recipient is bound to honour this Policy.

7. Retention and Deletion

7.1 24-hour pre-verification hold

When you sign up, we write your resume and Bot record into our database before you confirm your email, so that the upload flow is seamless. That row is marked pending with a verification_expires_at field set to 24 hours after signup. If you confirm within 24 hours, the marker is cleared and your account becomes normal. If you do not, our daily sweep at 04:00 UTC automatically deletes the unverified record. The lawful basis for this hold is legitimate interest: it is the minimum necessary to deliver the user-requested account creation flow, the data never leaves our infrastructure during the hold, and the 24-hour cap matches our auth provider’s own confirmation-link expiry.

7.2 Account deletion — three-tier policy

When you delete your account, we apply the following policy:

• Tier A — hard delete. Your authentication record, profile, Bot, Bot settings, Bot insights, and profile photo are permanently deleted.
• Tier B — anonymize and retain. Conversation rows, messages, and Bot-link click rows are retained for aggregate analytics and audit purposes but are scrubbed of personal data: recruiter name and company are set to NULL, the session identifier is rotated, the Bot identifier is replaced with a sentinel value, message content is redacted in place by our AI-assisted redaction pipeline, the click rows have their user-agent dropped and coordinates rounded.
• Tier C — retain under legal obligation. Payment records and plan history are kept with the user-ID field set to NULL. Indian and international tax and financial-record law generally requires us to retain these for 5–10 years; this falls under the GDPR Article 17(3)(b) exemption to the right of erasure.

7.3 AI-assisted PII redaction

For Tier B messages, we use a two-phase pipeline before deleting the source personal data. Phase 1 is a deterministic, anchored find-and-replace using the personal data we already have on file (your name variants, email, phone, companies, URLs, and the recruiter’s self-disclosed name and company), replaced with category tokens such as [REDACTED_NAME], [REDACTED_EMAIL], and [REDACTED_PHONE]. Phase 2 sends the already-redacted transcripts to Gemini 2.5 Flash to catch fuzzy variants, nicknames, third-party names, and other personal data the deterministic pass missed. The source personal data is hard-deleted only after both phases succeed.

7.4 Backups

Our Postgres database is backed up by Supabase per their retention policy. Deletions propagate to backups as those backups age out of rotation; we do not selectively edit backup files.

7.5 Limits we cannot guarantee

Data that we have already sent to AI providers (OpenAI, Google AI) for chat completions or insights generation may be retained by those providers per their own policies. We cannot guarantee instant deletion of data already sent to third parties.

8. International Data Transfers

Our processors are based primarily in the United States. If you use the Service from the EU, EEA, UK, Switzerland, or another region with cross-border transfer restrictions, your data will be transferred to those countries. Where applicable, we rely on the European Commission’s Standard Contractual Clauses (SCCs) and equivalent transfer mechanisms (UK IDTA, Swiss FDPIC clauses) to provide appropriate safeguards. You can request a summary of our transfer arrangements by emailing us.

9. Your Rights

9.1 GDPR (EU / EEA / UK / Switzerland)

Subject to local conditions, you have the right to: access your data (Art. 15), rectify it (Art. 16), erase it (Art. 17), restrict its processing (Art. 18), receive a portable copy (Art. 20), object to processing based on legitimate interest (Art. 21), and withdraw any consent you gave us (Art. 7(3)). You also have the right to lodge a complaint with a supervisory authority.

9.2 CCPA / CPRA (California)

California residents have the right to know what personal information we collect, to request deletion, to correct inaccurate information, and to opt out of the sale or sharing of personal information. We do not sell or share personal information for cross-context behavioural advertising; the “Do Not Sell or Share My Personal Information” signal does not change our practices because we already do not engage in those activities. You also have the right not to be discriminated against for exercising these rights.

9.3 DPDP Act 2023 and DPDP Rules 2025 (India)

As a data principal under the DPDP Act, you have the right to access a summary of the personal data being processed, to request correction, completion, updating, and erasure of personal data, to nominate another person to exercise rights on your behalf, and to grievance redressal. As a sole-proprietor data fiduciary, the proprietor of Why Not Initiatives serves as the Grievance Officer. Grievances can be submitted to support@myinteractive.cv; we will acknowledge within a reasonable period and resolve in accordance with the timelines set by the DPDP Rules.

9.4 Other jurisdictions

We honour analogous rights granted under laws including China’s PIPL (right to know, copy, correct, delete), Singapore’s PDPA, Japan’s APPI, the Australia Privacy Act, and Brazil’s LGPD. Contact us using the address below and identify the law you are exercising rights under.

9.5 How to exercise your rights

Most rights can be exercised directly inside the product: you can edit your profile and Bot data from your dashboard, change email preferences from the notifications panel, and delete your account from account settings. For anything you cannot do in-product, email support@myinteractive.cv. We may need to verify your identity before responding. We do not charge fees for reasonable requests and we do not retaliate against people who exercise their rights.

10. Cookies and Similar Technologies

We use a small number of strictly necessary cookies and browser-storage items. We do not use Google Analytics, Facebook Pixel, or any other marketing or cross-site tracking technology.

• Supabase Auth session cookie. Essential to keep you logged in. Persists for the duration of the session.
• Cloudflare Turnstile. A transient cookie set during signup and similar form submissions to verify that the request is not from a bot. Expires shortly after the form is submitted.

Both cookies fall within the “strictly necessary” category under the EU ePrivacy Directive because they are essential to deliver the service you requested, which is why we do not display a consent banner. We will revisit this position with counsel before we launch into the EU, and will update this Policy if a banner becomes required.

11. Email Communications

We send two categories of email. Non-functional emails are opt-out by default and can be controlled per category from your notification preferences, or unsubscribed with the one-click link in every such email’s footer:

• New-conversation alerts
• Plan-capacity alerts (with configurable threshold)
• Weekly insights digest
• Recharge reminders (togglable only via the in-email unsubscribe link)
• First-insights notification (folded into the day-0 plan-exhausted email for free-plan users)

Functional emails are always sent because they are required to operate the Service. You cannot opt out of these while you have an active account: signup confirmation, password reset, password changed, and the account-deletion family of emails. Every non-functional email also includes a single “Unsubscribe from all emails” link.

12. Children

The Service is not directed to children. Users must be at least 16 years old. We do not knowingly collect personal data from anyone under 16; if we learn that we have, we will delete it. If you believe a minor has used the Service, please email us.

13. Security

We use industry-standard administrative, technical, and physical safeguards: TLS for data in transit, encryption at rest at the database level via our hosting providers, salted password hashing through our auth provider, per-IP rate limiting, CAPTCHA on signup, role-based access controls, and least-privilege secrets management. No system is perfectly secure. If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and affected users in accordance with applicable law.

14. Changes to This Policy

We may update this Policy from time to time. The “Effective” date at the top reflects the most recent revision. For material changes, we will notify you by email or in-product notice before the change takes effect. Continued use of the Service after the effective date constitutes your acceptance of the updated Policy.

15. Grievance Officer and Contact

For privacy questions, rights requests, or complaints, please contact:

Grievance Officer: Why Not Initiatives, via support@myinteractive.cv

Postal address:
Why Not Initiatives
A5, Fifth Floor, RSR Enclave, 19th M Cross, Kaggadasapura, CV Raman Nagar, Bengaluru, Karnataka 560093, India

Questions? Contact us at support@myinteractive.cv.