Privacy Policy

OneRoadmap is the platform and the brand you use. It is operated by GHAI TECHNOLOGIES PRIVATE LIMITED (“Ghai Technologies”), India - the primary operator of the platform, and the owner and operator of both the OneRoadmap and The Perfect Resume brands.

Two further entities handle payments and billing, and only that:

• India. For certain transactions in India, payments and tax invoices for OneRoadmap services may be processed and issued under The Perfect Resume, the Indian billing and GST-registered entity supporting OneRoadmap's domestic payment operations. Applicable GST - currently generally 18% for the relevant taxable services - may be charged where Indian tax law requires it.
• Outside India. For certain customers outside India, payments, billing and related commercial processing may be handled by One Roadmap Marketing Management, a business licensed by the Dubai Department of Economy and Tourism (DET), Licence No. 1633597, Dubai, United Arab Emirates.

Collectively, these entities are referred to in this Privacy Policy as ‘OneRoadmap’, ‘we’, ‘us’, or ‘our’.

For applicable privacy laws, Ghai Technologies acts as the data fiduciary/controller for personal data processed through the Services. Where a law uses different words for the same role - data fiduciary under India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”), controller under the EU/UK GDPR, business under the CCPA/CPRA, controller under the UAE PDPL - it is this role we are describing. The billing entities process only the personal data needed to take a payment and to issue and keep the records the law requires of them; what that means in practice is set out in Section 10.

Privacy / Grievance Officer: Gaurav Ghai - gaurav.ghai@oneroadmap.in. We have not appointed a statutory Data Protection Officer, and this policy does not claim we have; the Privacy / Grievance Officer is the person who handles privacy requests and grievances.

This policy applies to personal data we process through:

• Our website at oneroadmap.io, including public pages, blog and marketing pages.
• The OneRoadmap web app, including your account, dashboard, profile and settings.
• Ori on WhatsApp, our career assistant that you can message on WhatsApp.
• The OneRoadmap Chrome extension, which reads a job or application page when you ask it to and can fill a form for you.
• Job matching and job discovery, including matched jobs, saved jobs and jobs you import by link.
• Resume tools and application preparation, including resume parsing, tailored resumes, cover letters and application answers.
• The Perfect Resume integration (the “bridge”), which connects your OneRoadmap account to the resume builder at The Perfect Resume.
• Membership, credits and paid services, including top-ups, the 24-hour premium pass, and anything else you buy from us.
• Skill certifications and job simulations, including attempts, submissions, scores and certificates.
• Readiness scores and target role readiness programmes, including the Talent Graph that produces them.
• Support and communications, including email, WhatsApp messages, forms and anything you send us.

It does not cover third-party websites and services we link to or that you choose to use - employers' application systems, WhatsApp itself, your bank, or a job board. Their own policies apply there. Your use of the Services is also governed by our Terms of Service, and purchases by our Pricing, Payments & Refunds Policy.

Account data

Your name, email address, phone number where you provide it, the basic profile information Google sends us when you sign in with Google (name, email, profile photo), your profile photo and your OneRoadmap user ID. We use one-time email codes (OTP) or Google sign-in rather than storing passwords.

Career and profile data

Your resume, skills, education, work experience, projects, certifications, target roles, job preferences (location, work mode, markets, salary expectations) and readiness programme data.

Job and application data

Saved jobs, matched jobs, job links you share with us, job descriptions, application preparation data, tailored resumes, cover letters, the answers prepared for an application's questions, the fields used to autofill an application form, and the status of each application in your tracker.

Application profile, including sensitive answers

Job applications ask questions that ordinary profiles do not. If you use application preparation or autofill, you can save answers once so you are not retyping them for every employer. Some of them are sensitive, so they are worth naming rather than hiding under “profile data”:

• Work eligibility. Citizenship, work authorisation status per country, and whether you need visa sponsorship.
• Compensation. Current and expected salary, notice period and earliest start date.
• Declarations employers ask for. Security clearance, employment restrictions such as a non-compete, whether you have relatives at the employer, and any legal disclosures you choose to record.
• Self-identification (EEO) answers. Gender, ethnicity, disability status, veteran status and pronouns - the questions US employers ask for equal-opportunity reporting.
• Your own words. Short answers about yourself - how you introduce yourself, why the field, work you are proud of, how you work - which we use to keep drafted answers in your voice.

Delivery address, if you win a reward

If you place in a leaderboard season that ships merchandise, we ask for a delivery name, phone number and postal address. It is optional, it is used only to ship the item, and you can decline it and still keep your placing.

WhatsApp (Ori) data

Your WhatsApp number, the messages you send to Ori and the replies we send, media and documents you upload, resume files you share, job links you share, whether the number is linked to a OneRoadmap account, the conversation's working state (for example the job you last asked about), and your opt-in or opt-out status for alerts.

Chrome extension data

The job page URL, the job title and company, the job description visible on that page, the application form fields needed to autofill it, the actions you trigger, and diagnostic information about the extension itself.

Two details worth being exact about. First, we send the questions an application form asks - their labels and field types - so we can recognise them; we do not send the values you or anyone else typed into that form, and password fields are dropped before anything leaves the page. While the panel is open on a form, that recognition happens on its own rather than waiting for a click. Second, the extension keeps three things on your own device: your extension sign-in token, a note of whether you have seen the welcome screen, and a short cache of recent job summaries that expires after 30 minutes. Signing out deletes the token; uninstalling removes all of it.

Resume and The Perfect Resume bridge data

Resume files you upload or import, the parsed content of those resumes, resume versions, tailored resumes we generate, bridge session metadata (a signed, single-use handoff so you are not asked to sign in twice), and your entitlement or access status.

OneRoadmap and The Perfect Resume are both operated by Ghai Technologies, and may share limited account, resume and access data with each other in order to provide the resume builder and premium access. That is the purpose of the bridge. It runs when you upload or import a resume, when we tailor one for an application, and when you open the resume builder — and uploading a resume can create your workspace there if you do not already have one. Every surface that takes a resume says so at the point you hand over the file.

Certification and simulation data

Your answers and submissions, files and screenshots you submit, scores, attempts and retry counts, integrity signals (for example tab switches, submission timing and unusually fast completion), certificates issued to you, and leaderboard entries where you take part.

Readiness and Talent Graph data

Your target roles, readiness scores, identified gaps, the evidence behind each of them, simulation and certification results, the observations AI produced from your evidence, the deterministic scoring outputs our own rules produced, and the version of the graph each result belongs to.

Connected accounts, only the ones you connect

You can connect other accounts so your evidence is verified rather than self-reported. Nothing here is connected by default, and you can disconnect any of them at any time, which deletes the stored access token.

• GitHub. Through GitHub's own authorization screen. We read the repositories you grant - including their code, README and dependency files - to observe what you have actually built. If you grant private repositories, their contents are read too.
• LinkedIn. Through LinkedIn sign-in, for identity and profile. If you ask us to share an achievement, we also need permission to post to your LinkedIn feed. We post only what you review and confirm.
• Credly, Hugging Face, LeetCode and HackerRank. Public activity for the username you enter - badges, models, solved problems. No password and no authorization is involved; we read what anyone could read, and we ask you to place a short verification token on the profile to prove it is yours.
• LinkedIn profile import. If you import your LinkedIn profile by URL, that URL is sent to a third-party profile service which returns the public profile, and we store the result. See Section 10.

Access tokens for connected accounts are encrypted at rest and used only to read what is described above. We never ask for, and never store, your password on another platform.

Payment and billing data

Razorpay or Stripe order IDs, payment IDs and invoice IDs; the plan you are on; credits purchased, granted and spent; your billing region and currency; the base amount, the GST, VAT or other tax amount where applicable, and the total amount; payment status; and renewal, cancellation and refund status. For India we also record the tax metadata a GST invoice requires, including your place of supply; that invoice is issued under The Perfect Resume, the Indian billing and GST-registered entity, and carries its GSTIN.

Technical data

IP address, device and browser type, approximate location derived from your IP (which also decides your billing region and currency), server logs, cookies, analytics events, and fraud and security signals.

How you found us

If you arrive from a campaign, a referral or a creator link, we record the campaign tags in the link, the referring page and the page you landed on, and we keep them with a purchase so we know which channels work. It is attribution for our own reporting; it is not shared with advertisers and we do not use it to target ads at you.

Where the GDPR or UK GDPR applies, every use of your data rests on a legal basis; the DPDP Act, the CCPA/CPRA and the UAE PDPL impose comparable purpose limitations. We use personal data to:

• Provide the Services (contract / service delivery). Create and manage your account, match you to jobs, prepare applications, generate tailored resumes and cover letters, run certifications and simulations, compute readiness, issue certificates, and operate memberships, credits and the premium pass.
• Do the things you ask for (consent). Connect WhatsApp, connect accounts, use the Chrome extension on a site, run the resume bridge, publish a profile, or receive marketing. You can withdraw consent at any time.
• Communicate with you (contract / legitimate interests). Sign-in codes, results, receipts, match alerts, reminders and other service messages. These are not marketing and continue while you hold an account.
• Keep the product and its results honest (legitimate interests). Detect cheating, fraud, duplicate accounts, scraping and abuse; and void or revoke results obtained in breach of our Terms.
• Take payment and keep records (contract / legal obligation). Process payments, grant credits and entitlements, issue invoices, and keep the tax and accounting records that Indian and UAE law require of the entity that billed you.
• Improve the Services (legitimate interests / consent). Understand how features are used, fix errors and improve content. Analytics run only if you accept them in the cookie banner.
• Comply with law (legal obligation). Respond to lawful requests from authorities, and meet our obligations under tax, company and data-protection law.
• Market to you (consent, with opt-out). Product updates and offers, where you have opted in or where local law permits it. Every marketing email has a working unsubscribe link, and unsubscribing is honoured immediately.

Where we rely on legitimate interests, we have considered your interests and rights against ours, and you can object - see Section 13.

One AI provider: Google. Every AI feature in OneRoadmap runs on Google's Gemini models through Google's API. We do not send your data to any other model provider. If that ever changes, we will name the new provider here before it starts.

We use those models to:

• read a resume and turn it into structured sections;
• observe evidence for a target role - a project, a repository, work history, a connected profile - against a fixed competency rubric;
• draft answers to an employer's application questions;
• write a tailored resume or a cover letter for a specific job;
• review certification, job-simulation and Daily Challenge submissions and write the feedback you read;
• answer you as Ori on WhatsApp;
• read a job page you opened with the Chrome extension and prepare an application from it.

What we actually send to Google

It depends on the feature, and we would rather be specific than reassuring:

• Preparing an application. This one carries the most. To draft answers, a cover letter or a tailored resume for a job, we send a summary of you that includes your name, email address, phone number and location, your profile links, work history, education, skills, projects, certifications, readiness scores and the answers you wrote in your own words - together with the job description and the employer's questions. A drafted answer has to be grounded in real facts about you, and those facts are what we send.
• Resume parsing. Where we structure a resume ourselves, the email address, phone number and links are replaced with placeholders before the text is sent, and stitched back afterwards. Your name is not removed - the model is asked to find it. Where the resume is parsed through The Perfect Resume bridge instead, the file itself is sent.
• Evidence and readiness. The project, repository or profile being assessed. For a connected GitHub repository this includes README, dependency files and samples of the source code - including private repositories, if you granted them.
• Ori on WhatsApp. Your message, the last few turns of the conversation and a one-line summary of your goal and progress. Not your resume, not your contact details.
• Assessments. Your written answer or submission and the marking rubric. Not your name, and not your account details.
• Never sent. Your self-identification (EEO) answers, your compensation figures, your payment details and your password - the last of which does not exist, because we do not use passwords.

Where the processing happens

Some AI work runs on our own server in Mumbai, India rather than inside the web app, so that long jobs can be retried without charging you twice or repeating work. That server keeps a record of each run for 30 days: what ran, which model, how long it took, and the result. It identifies you only by a one-way hash of your user ID, and it stores a fingerprint of the input rather than the input itself.

What AI does, and what it does not do

AI assists with extraction, drafting, analysis and recommendations. OneRoadmap's own product logic and rules produce the outputs that count: scores, levels, limits, credit balances and readiness outputs are computed by our rules from validated inputs, not chosen by a model - and each result records the evidence and the rule versions that produced it, so it can be audited and re-run.

• AI-generated outputs may be inaccurate and should be reviewed by the user before use. Read a tailored resume, a cover letter or a drafted answer before you send it.
• AI does not guarantee jobs, interviews, admissions, employment, salary, or immigration outcomes.
• AI does not make hiring or legal decisions. OneRoadmap is not an employer; employers decide who they interview and hire, using their own processes.
• You can request review or correction of important profile or readiness data. Write to the Privacy / Grievance Officer in Section 17 and a person will look at it.

Training, and what we can honestly promise

• We do not train any model on your data. OneRoadmap builds no models of its own. Your resume, answers and submissions are used to serve you, not to build a product out of you.
• We do not sell your data to AI companies and we do not licence it as training material to anyone.
• What Google does with data sent to its API is governed by the terms of the Google API service we use, not by us. We are not going to print a promise on Google's behalf in our policy - if you want to know their retention and training posture, it is theirs to state. We will tell you here if we change provider or move to a materially different tier.

What we keep from an AI run

We store what the model produced about you - the observations behind a readiness score, a drafted answer, a graded submission, an AI reply on WhatsApp - along with the model name and prompt version, so a result can be explained, audited and re-run. We do not keep a copy of the prompt text itself.

Some of OneRoadmap works while you are not looking. That is the point of it, and it is also the part of a product you are most entitled to have described plainly. Here is everything that runs without you clicking anything.

• Auto Match - finds jobs. On a schedule, we look for jobs that fit your profile and target role, and save the ones that match. That is all it does. A match is not an application, nothing is written to an employer, and nothing is prepared until you open a job and ask for it.
• Application preparation - builds a package. For a job you asked us to prepare, we find the employer's application form, draft answers to its questions, write a cover letter, tailor your resume to the role and score the result. Then it stops and waits for you. The finished package is for you to read, edit and use.
• Prepare for Me - starts preparation from a match. If you switch this on, a strong enough match can go into preparation without you asking each time, up to a daily limit you can see. It produces the same reviewable package as above, in the lane where you submit the application yourself.

Messages these agents send you

• Email: at most one job match email a day, and reminders about a streak you have going. Every one has a working unsubscribe link.
• WhatsApp: only if you linked your number and switched alerts on, and only in the categories you chose - new matches, application updates, readiness, guidance, news. Reply STOP to end alerts, or turn individual categories off in Settings.

Turning them off

Dashboard → Settings, or the Apply Agent page, has a switch for each one. Pausing preparation keeps your saved answers and stops new work. Withdrawing Auto Match stops discovery. Neither deletes anything, and neither requires you to talk to us.

A decision that matters to you

None of this is a decision about you with a legal or similarly significant effect. We do not screen you out, rank you for an employer or refuse you a service on the strength of an automated score. Employers decide who they interview; we are not an employer. If a readiness score or a piece of profile data looks wrong to you, ask us and a person will look at it - see Section 17.

Commitments are easy to write, so these are limited to ones built into how the product works rather than into our intentions.

• We never submit a job application for you. Every application we prepare is handed back to you to send yourself. Applying on your behalf without you seeing it first is not a setting you can switch on, because we have not built it as one. Nothing reaches an employer without you.
• We never answer self-identification questions for you. Gender, ethnicity, disability, veteran status, pronouns, date of birth, criminal history, government ID, a legal attestation or an electronic signature - autofill refuses all of them, even when your profile happens to hold the answer. Those are yours to answer on the employer's form.
• We never send those answers to an AI model. The drafting model is explicitly forbidden from answering questions about demographics, compensation, visas, sponsorship, relocation, notice periods or references. It returns nothing for them rather than inventing something.
• We never invent a fact about you. If your profile does not truthfully answer an application question, the answer comes back empty with a reason, and you are asked. We would rather hand you a gap than a confident fabrication.
• We never type over something you wrote. Autofill skips any field you already filled, and abandons the whole plan if the form changed underneath it.
• We never work around a captcha or a login wall. If a form has one, automation stops and the application becomes yours to finish.
• The extension never watches your browsing. It reads a page only when you open the panel and act on that page, it has no standing permission to any website, and it never sends us what you typed into a form - only the questions being asked.
• We never let a model set a score. Readiness, match percentages, certification results and simulation marks come from our own rules. A model observes and drafts; it does not grade you.
• Employers never get your contact details from us. An employer hiring through OneRoadmap sees your name and the evidence you earned for their role, and your profile handle unless you have made your profile private. Not your email address, not your phone number, not your answers to anyone else's questions, and nothing about your other applications. That shortlist view is built field by field, so nothing arrives in it by accident.
• Employers we have verified can open your resume, while your profile is public. This is the one thing on your profile an employer can open that is not on the page itself. An employer we have verified - not a pending or suspended one, and nobody who is signed out - can view your resume file from your profile. We stream it from private storage rather than handing out a link, so it cannot be forwarded or indexed. Making your profile private in Settings stops it, and removing your resume removes it everywhere.
• We never sell your personal data. No advertising cookies, no ad pixels, no data brokers, no sharing for anyone else's marketing.
• We never hold your passwords or card numbers. Sign-in is a one-time email code or Google. Card details go to the payment processor and never reach our servers.

Most of what OneRoadmap holds about you is private to your account. These are the exceptions, and you control each one:

• Certificates may have public verification pages. When you earn a certificate, a verification page can be created at a unique URL showing the certificate name, the credential, score/percentile, issue date and certificate ID. That page is how a recruiter checks the credential is real - anyone with the link can view it.
• Your profile page is public by default. When you create an account we give you a profile page at your username, and it is visible by default - to employers using OneRoadmap and to anyone with the link. It shows what you have chosen to put on it: your name and photo, your target role, your skills, the certifications and job simulations you have completed, and your readiness score. You can make it private at any time in Settings, which removes it from public view and from employer search; you can also remove individual sections. We tell you this again at the point you upload a resume, because that is when it matters most.
• Your resume FILE is not public, even when your profile is. The resume you upload is held in private storage, not at a public web address, and is served only to you and to employers we have verified. Making your profile private removes it from your profile for everyone else. See Section 15.
• Leaderboards show your name, photo and rank if you take part. Taking part is your choice, and you can ask to be removed.
• Anything you post or share yourself. Reviews, or a certificate you share to LinkedIn or a resume.

You can ask us to unpublish a verification page or anonymise a leaderboard entry where the product supports it - email the address in Section 17 and we will action it within 30 days. Note that unpublishing a verification page makes that credential unverifiable to anyone you have already shared it with.

• Essential cookies. Sign-in sessions, security, and remembering your cookie choice. These are required for the Services to work and do not need consent.
• Analytics cookies. Help us understand aggregate usage. They load only after you accept them in our cookie banner; declining keeps them off and does not affect your use of the Services.
• Marketing cookies and pixels. We use these only if they are enabled and you have consented. If we add an advertising pixel in future, we will say so here and in the cookie banner before it is switched on.

A consent banner appears on your first visit. Your choice is stored on your own device rather than in a cookie, so you can change it at any time by clearing cookies and site data for oneroadmap.io - the banner will reappear - or through your browser settings.

We do not sell your personal data, and we do not share it with third parties for their own advertising. Data moves in two directions only: between our own operating and billing entities, and out to the service providers listed below.

Between our own entities

Personal information may be shared between Ghai Technologies and the billing entities described in Section 1, and with authorised service providers, where reasonably necessary for:

• account and service administration;
• payment processing;
• billing and invoicing;
• GST, tax and accounting compliance;
• fraud prevention and security;
• customer support;
• subscription management;
• legal and regulatory compliance; and
• delivering and improving OneRoadmap services.

Only the information reasonably necessary for these purposes is shared. A billing entity receives what a payment and a compliant invoice require - your name, email address, the amount, the tax and the order reference, and in India the place of supply a GST invoice needs. It does not receive your resume, your evidence, your application drafts, your assessment answers or your WhatsApp conversations.

Because a billing entity is separately answerable to its own tax authority, it may retain transaction, invoice and tax records independently, for as long as the law that applies to it requires - including after you delete your OneRoadmap account. See Section 12.

Service providers and partners

We share data with the following recipients, under contract and only for the purposes described here:

• Razorpay - payments in India, in INR. Its checkout receives your name, email address and phone number to fill its own form, plus the amount and a reference to your order. We receive back the payment reference and whether it succeeded. Indian transactions are billed, and the GST invoice issued, under The Perfect Resume.
• Stripe - payments outside India, in AED or USD. Receives your email address, the amount and a reference to your order, and creates its own customer record. We receive back the payment reference and the result. These transactions are billed through One Roadmap Marketing Management, Dubai.
• Banking and payment partners. Behind each processor sit banks, card networks and payment partners that settle the money. Payment processors and these partners handle transaction-related information under their own privacy and security obligations, not ours - including the card details you enter, which never reach us.
• Google - AI models (Gemini). Everything described in Section 5: resume text, evidence, your answers, and - when preparing an application - your name, email address and phone number.
• Google - sign-in. If you sign in with Google, Google confirms your identity and sends us your name, email address and profile photo.
• Google - Analytics. Page views and usage events, with the IP address and cookies Google Analytics collects by default. This one runs only if you accept analytics cookies.
• Meta - WhatsApp. Your WhatsApp number and the text of every message, in both directions, because that is how WhatsApp delivers a message. Meta keeps its own record under its own policy; deleting your data with us does not delete Meta's copy.
• Amazon Web Services. Email delivery through Amazon SES - your email address and the contents of the email. We also run our own servers on AWS in Mumbai, India for AI processing, certificate rendering and background work.
• Vercel. Hosting for the website and app, so Vercel processes requests, IP addresses and server logs. It also stores uploaded files - resumes, simulation submissions - and provides the cookieless usage measurement that runs whatever you choose in the cookie banner.
• MongoDB Atlas. The database where your account and everything in Section 3 is stored.
• The Perfect Resume - the resume product. The other brand Ghai Technologies operates. Your name, email address and resume file cross over so a resume can be parsed, built and kept in sync, and so premium access follows you between the two. Uploading a resume can create an account for you there. Sign-in is shared through a signed, single-use link that expires in two minutes.
• The Perfect Resume - the Indian billing entity. The same name in its second role: for applicable Indian transactions it receives the billing details needed to take the payment and issue a GST invoice, and nothing more. This is the sharing described under Between our own entities above.
• LinkedIn profile import services. If - and only if - you import your LinkedIn profile by URL, that URL goes to a third-party profile service (currently Apify, and on an older path a RapidAPI provider) which returns the public profile.
• Employers and their application systems. When you apply, the application you reviewed - your details, resume, cover letter and answers - goes to that employer and the recruiting system they use. From that point their privacy policy governs it, not ours.
• Legal, accounting and tax advisors. Where we need professional advice or must file returns.
• Authorities, where legally required. In response to a lawful request, court order, or to protect the rights, property or safety of OneRoadmap, our users or the public.
• A buyer or successor. If we are involved in a merger, acquisition or asset sale, personal data may transfer as part of that transaction. We will tell you, and this policy continues to apply until it is amended.

Your personal data may be processed in India, the UAE, the United States, the EEA/European Union, the United Kingdom or other locations where our entities and service providers operate. Two kinds of transfer happen:

• Between our own entities. Billing data may move between India and the UAE so that the right entity can take a payment and issue an invoice - limited to what Section 10 describes.
• To service providers. The providers in Section 10 process data in the countries they operate from, commonly including the United States.

Where a transfer needs protection, we use contracts, safeguards and vendor controls appropriate to the law that applies to you:

• EEA / UK. Transfers rely on an adequacy decision where one is available, or on Standard Contractual Clauses, the UK Addendum / IDTA or an equivalent safeguard, together with supplementary measures where required.
• UAE (PDPL). Transfers are made to jurisdictions with adequate protection, or under appropriate contractual safeguards, or with your consent where that is the applicable basis.
• India (DPDP Act). We follow the transfer restrictions under the DPDP Act, including any restriction on transfers to particular countries if and when the Central Government notifies one.
• United States and elsewhere. Providers are engaged under written terms covering confidentiality, security and permitted use, and may process data only on our instructions and for the purposes in this policy.

• Account data: kept while your account is active.
• Resume and application data: kept while your account is active, or until you delete it.
• WhatsApp data: kept while the number is linked and the conversation is active, or until you ask us to delete it.
• Chrome extension sessions: the sign-in token expires on its own and the record is removed within 7 days of expiring. The job cache on your device lasts 30 minutes.
• Job matches: recomputed as your profile changes, and cleared after 90 days.
• Records of an AI run: 30 days, identified by a one-way hash of your user ID rather than by you.
• Application working files: where preparing an application produced screenshots or a trace of a form being filled, those are deleted on a fixed window after the application finishes. The record of what was sent is then reduced to an audit skeleton - references and checksums, not content - after 90 days.
• Certificates and verification records: kept while the credential remains valid, because other people rely on the verification page - unless you ask us to unpublish or anonymise it.
• Payment, invoice and tax records: retained for as long as the tax, accounting and company law applicable to the billing entity requires. A billing entity is separately answerable to its own tax authority, so it may keep transaction, invoice and tax records independently - including after your OneRoadmap account is deleted. Deleting your account does not, and legally cannot, erase an issued tax invoice.
• Backups: encrypted, and rolled off within 90 days. Deleted data is not restored from them.
• A deleted account: personal data is deleted or anonymised within 30 days of a verified deletion request, and backups roll off within 90 days after that.

When data is no longer needed for the purpose it was collected - or when you withdraw consent and no other lawful basis applies, as the DPDP Act requires - we delete it or irreversibly anonymise it.

You can exercise any of these rights by emailing gaurav.ghai@oneroadmap.in from your registered email address; we may need to verify your identity. We respond within 30 days, or the shorter period your local law sets, and we will never treat you worse for exercising a privacy right. Many actions - editing your details, disconnecting a connected account, turning off WhatsApp alerts, requesting a copy of your data, or deleting your account - are also available in your settings. Requesting a copy there records your request and reaches the same people as the email above; a person then assembles the copy and sends it to your account email address, so it is not an instant download. Step-by-step deletion instructions are at Delete your data.

India - Digital Personal Data Protection Act, 2023

• Right to access a summary of your personal data and the processing we carry out.
• Right to correction, completion, updating and erasure of your personal data.
• Right to withdraw consent as easily as you gave it.
• Right to grievance redressal through our Privacy / Grievance Officer, whose details are in Section 17.
• Right to nominate another individual to exercise your rights in the event of your death or incapacity.
• Right to approach the Data Protection Board of India, where applicable, if you are not satisfied with our response.

European Economic Area and United Kingdom - GDPR / UK GDPR

• Right of access, rectification and erasure (the “right to be forgotten”).
• Right to restriction of processing, data portability, and objection - including to processing based on legitimate interests and to any direct marketing.
• Right to withdraw consent at any time, without affecting processing already carried out.
• Right to lodge a complaint with your supervisory authority - in the UK, the Information Commissioner's Office (ico.org.uk); in the EEA, the authority of your member state.

United Arab Emirates - Federal Decree-Law No. 45 of 2021 (PDPL)

• Right to access and receive a copy of your personal data.
• Right to correction of inaccurate data, and to erasure.
• Right to restrict or stop processing.
• Right to withdraw consent.
• Right to complain to the UAE Data Office, where applicable.

United States - California (CCPA/CPRA) and other state laws

• Right to know and access the personal information we collect, use and disclose.
• Right to delete, to correct, and to data portability.
• Right to opt out of the sale or sharing of personal information. We do not sell personal information and we do not share it for cross-context behavioural advertising.
• Right to limit the use of sensitive personal information, where applicable.
• Right to non-discrimination for exercising a privacy right, and the right to use an authorized agent to make a request.
• Residents of other US states with comprehensive privacy laws have equivalent rights, which we honour through the same contact.

• The Services are intended for users aged 16 and over.
• If you are under 18 and in India, you should use the Services only with the consent of a parent or guardian.
• We do not knowingly collect personal data from children under 13. If you believe a child has given us personal data, contact us and we will delete it promptly.
• We do not carry out targeted advertising to children, and we do not use children's data for behavioural monitoring or tracking.

We protect personal data with measures appropriate to its sensitivity:

• encryption in transit (HTTPS/TLS) across the Services;
• encryption at rest where our infrastructure providers offer it, and encrypted storage for connected-account tokens;
• resumes held in private storage. A resume is the most sensitive document we hold, so it is not stored at a public web address and its storage path does not contain your account id. It is fetched by our servers and released only to you and to employers we have verified - a link on its own does not open it. Resumes uploaded before 10 September 2026 were stored at public addresses; every one of them has since been moved into private storage, and we delete the public copy as part of that move;
• sign-in by one-time email code (OTP) or Google, rather than passwords we store;
• access controls, with employee and contractor access limited to what their work requires;
• audit logs for sensitive and administrative actions;
• payment details handled by the payment processor, not by us;
• a breach response process: if we learn of a breach affecting your personal data, we will notify you and the relevant authority within the timelines the applicable law requires.

No system is perfectly secure, and this policy does not claim any certification or audit we do not hold.

Full instructions - including for data you shared over WhatsApp - are at Delete your data, which is public and does not require you to sign in.

• You can delete your account yourself from Dashboard → Settings → Account settings → Delete account, or request deletion by email from your registered address.
• WhatsApp users can ask us to delete their WhatsApp data - the number link, the conversation and the message history - without deleting the rest of the account.
• You can disconnect a connected account - GitHub, LinkedIn or a public platform profile - at any time from your profile, which revokes our access and deletes the stored token.
• For WhatsApp: you can turn alerts off in your settings, or by replying STOP to Ori. That stops the messages but does not unlink the number - to unlink it and delete the conversation, ask us and we will do it within 30 days.
• Some records may be retained after deletion where the law requires it - in particular payment, invoice, GST and other tax and accounting records. See Section 12.

What deleting your account actually does

It is a real deletion, not a hidden account. Deleting from Account Settings removes your account and the records attached to it - profile, onboarding answers, resume data, applications and prepared packages, evidence and readiness, assessment attempts, connected accounts and their tokens, and your WhatsApp link and history. Your email address is freed, so you could sign up again later as a new user.

Financial records are the exception, and they are kept because they are our accounting records rather than yours to erase: a payment, an invoice, what it bought and the membership it created. Your name, email address, phone number, photo and handle are stripped out of them, so what remains is an amount, a date and a reference. Certificate verification pages can also outlive the account, because somebody else may be relying on one - ask us and we will unpublish or anonymise it.

Privacy requests and grievances go to the Privacy / Grievance Officer above. Questions about a charge, an invoice or a GST receipt go to support, which routes them to the entity that billed you.

Related policies: Terms of Service · Pricing, Payments & Refunds · Delete your data.

When we make material changes we will update the “Last updated” date above and notify you by email and/or an in-app notice before the changes take effect. Where a change requires fresh consent under your local law, we will ask for it. Earlier versions are available on request.