Your data, explained properly.

Supalander is operated by Ecliptz Labs Private Limited, Telangana, India. We are the data controller, and under Indian law the data fiduciary, for the personal data described in this policy. This policy covers supalander.com, its subdomains, WhatsApp messages we send, and emails we send about your account.

It does not cover Employer websites you reach through a listing, or third-party services you use to sign in or pay. Those have their own policies.

Our Terms of Service explain the rules of the Service. This policy explains the data.

• We collect what a feature needs, and we list all of it below.
• We do not sell personal data, and we do not run advertising or ad trackers.
• AI features send your input to an AI provider only when you press the button, and we never use your content to train models.
• WhatsApp alerts are strictly opt-in. Reply STOP to pause them.
• You can ask for a copy of your data, a correction, or deletion at any time.
• You must be 18 or older to use Supalander.

Information you give us

• Account details. Your email address and a password you choose, or the name and email shared by the identity provider you sign in with.
• Career content. Resumes you upload or build, cover letters, your career profile, notes you type to the AI assistant, and the job descriptions you paste in. This is your content and it lives in your account.
• Preferences. Job areas, work types, salary floor, and other filters you save, plus jobs you bookmark.
• WhatsApp number. Only if you turn on alerts. We store the number, the fact that it was verified, and your pause status. The one-time verification code is stored as a one-way hash and expires within minutes.
• Billing details. If you buy a paid plan, our payment processor collects your card or wallet details directly. We receive and keep a transaction reference, the plan, amount, currency, tax, status, and the last part of the payment method for support purposes. We never see or store full card numbers.
• Consent records. When you accept our Terms or this policy, authorise a renewing charge, or opt in to WhatsApp alerts, we record which document and version, the exact statement you agreed to, the date and time, your IP address, and your browser. For WhatsApp opt-in this includes the number you confirmed.
• Waitlist email. If you ask to be told when a feature or plan opens, we store the email you enter, which feature it is for, and the page you signed up on.
• Messages to us. Emails, support requests, and grievances you send, and our replies.

Information collected automatically

• Request logs. IP address, approximate location derived from it, browser and device type, pages requested, timestamps, and error details. Used for security, abuse prevention, and debugging.
• Engagement events. Which listings you view, click through, and save. When you are signed in these are tied to your account. When you are not, they are tied to a random identifier stored in your browser that is not linked to your identity.
• Usage counters. Rate-limit counters keyed to your account or IP address, and, for AI features, a record of the feature used, the model that served it, the amount of text processed, and the credits the request used. This record does not contain your prompt or the output.
• Plan and balance records. Your plan, its renewal date, and a ledger of AI credits and alerts added to and used from your balance.
• Alert records. When an alert was sent to you and for which listing, and any STOP or RESUME command you send us.

Information from others

• Identity providers share your name, email, and a profile picture when you sign in through them.
• Payment processors tell us whether a payment succeeded, failed, was refunded, or was disputed.
• The WhatsApp platform tells us whether a message was delivered or read, and passes on replies you send to our number.

We do not ask for, and ask you not to provide, sensitive data such as health, religion, caste, sexual orientation, biometric, or government identity numbers, unless a specific job application genuinely requires it in a document you choose to write.

Each purpose below lists the legal basis we rely on where one is required.

• To provide the Service: create and secure your account, show listings, save your preferences and content, and run paid plans. Contract.
• To run AI features you trigger: generate or tailor documents from your input. Contract, and your consent when you press the button.
• To send WhatsApp alerts: match new listings to your preferences and message you. Consent, which you can withdraw at any time.
• To rank listings: order the feed using listing freshness, completeness, and aggregate engagement across all users. This ranking is automated but it is about listings, not about you, and it has no legal or similarly significant effect on you. Legitimate interests.
• To keep the Service safe: rate limiting, fraud and abuse detection, debugging, and protecting accounts. Legitimate interests and legal obligation.
• To bill you and keep records: process payments, issue invoices, handle refunds and disputes, and meet tax and accounting rules. Contract and legal obligation.
• To communicate: answer support requests, send service notices such as changes to terms, security alerts, and renewal reminders. Contract and legitimate interests.
• To prove agreements: keep consent records so that we, and you, can show what was agreed and when if a question or dispute arises. Legal obligation and legitimate interests.
• To comply with law: respond to lawful requests and enforce our terms. Legal obligation and legitimate interests.

We do not use your data for advertising, we do not profile you for marketing, and we do not make automated decisions about you that have legal or similarly significant effects.

• When data is sent. Nothing goes to an AI provider until you use an AI feature. At that moment we send the input the feature needs: for example, your resume content and the job description you chose, or your career profile and the message you typed.
• Who processes it. AI providers act as our processors under contract. They may process the input in data centres outside India and outside your country. We select providers that commit not to train on data submitted through their business interfaces and to limit retention to what abuse monitoring requires.
• What we keep. The output is saved to your account so you can edit it. Our usage log keeps the feature name, model name, the amount of text processed, and the credits used, never the content itself.
• No training on your content. We do not use your content or output to train or fine-tune any model, and we do not permit our providers to do so.
• Safeguards. Our prompts instruct the model to treat your text as data, never as instructions, and to invent nothing. Output can still be wrong. Review it before you use it, and keep other people's personal data out of your prompts unless you have the right to include it.
• Provider changes. We may switch AI providers or models to improve quality or reliability. The commitments in this section apply to any provider we use.

• Opt-in. We message a number only after you tick the opt-in box, add the number, and confirm it with a one-time code. We record that opt-in, as described under consent records, and alerts go out only while you have an active paid plan.
• What is sent. A short template message with the job title, company, location, work type, salary if known, and a link back to the listing. We do not include your resume or other content in alerts.
• The platform. Messages are delivered through the WhatsApp Business platform, which processes your number and message content under its own terms and privacy policy as an independent controller. It also reports delivery status to us.
• Control. Reply STOP to pause and RESUME to continue, or change the settings in your account. Removing your number stops all alerts.
• Retention. We keep the number while alerts are enabled and delete it when you remove it or delete your account. Delivery records are kept for 12 months.

Our researchers collect job listings from public sources such as company career pages. Listings describe roles, not people, but they can contain business contact details or a named hiring manager that an Employer chose to publish. If you are named in a listing and want it corrected or removed, email us and we will act promptly.

We share personal data only with providers that help us run the Service, under contracts that require them to protect it and use it only on our instructions. By role, they are:

• Edge hosting and content delivery for serving the site and protecting it from attacks.
• Authentication and database for accounts, sessions, and stored content.
• AI model providers for AI features, as described above.
• Messaging platform for WhatsApp alerts.
• Payment processors for paid plans. They are independent controllers of the payment details they collect.
• Email delivery for account and service emails.
• Identity providers you choose to sign in with.

We may also disclose personal data:

• to comply with law, a court order, or a lawful request from a public authority;
• to enforce our terms, protect the rights, property, or safety of Supalander, our users, or others, and to detect or prevent fraud and abuse;
• to a successor if Ecliptz Labs is involved in a merger, acquisition, or sale of assets, in which case this policy continues to apply and we will notify you.

We do not sell personal data, and we have not sold it in the past. We do not share it with data brokers or advertisers.

Our providers operate globally, so your data may be stored and processed in India, the United States, the European Union, and other countries where they run infrastructure. Those countries may have different data protection laws from your own.

When we transfer data out of the European Economic Area, the United Kingdom, or Switzerland, we rely on standard contractual clauses approved by the relevant authorities or on another lawful transfer mechanism. Transfers out of India follow the Digital Personal Data Protection Act, 2023 and any restrictions notified under it.

We use no advertising or cross-site tracking cookies. Essential storage is always on; analytics cookies are set only if you accept them. What we store in your browser:

• Session cookies that keep you signed in. Strictly necessary. They expire when the session ends or you sign out.
• Theme preference in local storage so the site remembers light or dark mode.
• A random visitor identifier in local storage, used only to avoid counting the same listing view twice when you are not signed in. It contains no personal information and is not shared with anyone.

Analytics cookies, only with your consent. If you choose Accept in the cookie banner, a web analytics provider sets cookies that give your browser a random identifier, so we can count visits, see which pages are used, and how people move through the site. We use this only to improve Supalander. We do not use it for advertising, we do not send your name, email, or account to the analytics provider, and the provider acts as our processor. Nothing is loaded and no analytics cookie is set until you accept. If you decline, the site works exactly the same.

Your choice is recorded. We keep your choice on your device and store a record of it (the choice, the time, a random device identifier, your IP address, and browser) so we can show when consent was given. You can change your mind at any time with Cookie settings in the footer; declining removes the analytics cookies.

You can also clear everything through your browser settings. The site works without local storage, but you will be signed out and your theme resets.

We honour the browser Global Privacy Control signal by design, since we never sell or share personal data for advertising.

• Account and career content: for as long as your account exists, then deleted within 30 days of a verified deletion request or account closure.
• WhatsApp number: until you remove it or close your account. Alert delivery records: 12 months.
• AI usage records: 24 months, for plan metering, cost control, and abuse investigation.
• Engagement events: tied to your account for 24 months. Aggregate counts per listing are kept indefinitely because they contain no personal data.
• Request logs and rate-limit counters: up to 90 days.
• Billing records: 8 years, as Indian tax and accounting law requires, even after account deletion.
• Cookie choices: the record of your choice for 3 years. Analytics data held by our analytics provider: 14 months, then deleted.
• Consent records: for as long as your account exists and for 3 years after it is closed, so that an agreement can be proven if a dispute arises. After deletion they are no longer linked to an account, and they are never used for anything else.
• AI credit and alert balances: for as long as your account exists. They do not expire, and they are deleted with the account.
• Waitlist emails: until we have told you the feature opened, or until you ask us to remove you, whichever is first.
• Support and grievance correspondence: 3 years after the matter closes.
• Backups: deleted data may persist in encrypted backups for up to 35 days before it is overwritten.

We may keep data longer where the law requires it or where it is needed to establish, exercise, or defend legal claims. Job listings themselves are never deleted, they are archived, but they are not personal data about you.

• Encryption in transit for every connection, and encryption at rest for stored data.
• Database access rules that isolate each account so that one user's data is never readable through another user's session.
• Verification codes stored only as one-way hashes, with short expiry and attempt limits.
• Rate limiting on every sign-in, API, and AI feature to slow down abuse.
• Secrets kept out of code and out of the browser, with administrative access restricted to named staff.
• Webhook and payment notifications verified by cryptographic signature before they are trusted.

No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant authority as the law requires, and tell you what happened and what we are doing about it.

Wherever you live, you can ask us to:

• Access the personal data we hold about you and receive a copy in a common machine-readable format.
• Correct data that is inaccurate or incomplete.
• Delete your data and account. See the next section.
• Withdraw consent for alerts or any other consent-based processing, with effect from that point forward.
• Restrict or object to processing based on legitimate interests, where your situation justifies it.
• Nominate another person to exercise these rights for you if you die or become incapacitated, as the Indian Digital Personal Data Protection Act, 2023 provides.

To exercise any right, email support@supalander.com from the address on your account, or include enough detail for us to verify that the request is yours. We respond within 30 days, and sooner where the law requires. We do not charge for reasonable requests and we never treat you differently for making one.

If you are unhappy with our response you may complain to your data protection authority. In India that is the Data Protection Board of India. In the European Economic Area or the United Kingdom it is the supervisory authority where you live or work. California residents have the rights listed above under the CCPA, and we do not sell or share personal information as those terms are defined there.

To delete your account and everything in it, email support@supalander.com from your account email with the subject line Delete my account. We confirm the request, remove your account, career content, preferences, phone number, and engagement history within 30 days, and send you a confirmation when it is done.

The only data that outlives deletion is what we are legally required to keep, such as billing records, and anonymous aggregate statistics that cannot identify you. Encrypted backups clear on their own schedule within 35 days.

If you signed in through a third-party identity provider, you can also revoke our access in that provider's settings. That stops future sign-ins but does not delete your Supalander data, so email us as well.

Supalander is for adults. We do not knowingly collect personal data from anyone under 18, and we do not permit anyone under 18 to hold an account. If you believe a minor has created an account, email us and we will remove it and its data.

We update this policy when our practices, the Service, or the law change. The version number and dates at the top tell you which version you are reading, and prior versions are available on request. For material changes we notify you by email or in the app at least 14 days before they take effect. Where a change needs your consent, we ask for it.

Ecliptz Labs Private Limited (CIN U62013TS2025PTC203281), Choukat Nivas, Shiridi Sai Baba Colony, Balanagar, HAL, Tirumalagiri, Hyderabad 500042, Telangana, India. Email support@supalander.com for any question about this policy or your data, or message us on WhatsApp at +91 94948 37590. All contact details are on our contact page.

Grievance Officer: Chief Financial Officer, Ecliptz Labs Private Limited, Choukat Nivas, Shiridi Sai Baba Colony, Balanagar, HAL, Tirumalagiri, Hyderabad 500042, Telangana, India. Email support@supalander.com with the subject line Grievance. We acknowledge every grievance within 48 hours and resolve it within one month, and we give you a reference number to track it.