Privacy notice
Last updated: 12 November 2026
In short
- Your resume file is read on your device. It is never uploaded and we never store it.
- When you search with AI, the AI provider receives only the resume passages that show your skills. Contact details are removed and your name, street address and postcode are masked first.
- We do not sell your data, show advertising, or build profiles about you for anyone else.
- Analytics are off unless you choose “Allow analytics”.
- You can download or delete your data at any time in Privacy controls.
- Questions or complaints go to Shriansh Vikram Singh at omshriansh16@gmail.com. We reply within 30 days.
1. Who we are
Insta Job (instajob.shrianshvikram.tech) is a product of SynapSoul Labs. SynapSoul Labs is a sole proprietorship operated by its founder, Shriansh Vikram Singh, in India. In this notice, “we” and “us” mean SynapSoul Labs.
We decide why and how your personal data is processed for Insta Job. Under India's Digital Personal Data Protection Act 2023 (the DPDP Act) we are the Data Fiduciary. Where the EU or UK General Data Protection Regulation (GDPR) applies, we are the controller.
Privacy questions and grievances: Shriansh Vikram Singh answers them personally.
Email: omshriansh16@gmail.com
This notice covers Insta Job only. Policies that apply across SynapSoul Labs are in the company policy centre.
2. What we process, and what we don't
Your resume file
- Insta Job reads your PDF, DOCX or TXT file inside your browser. The file is never uploaded, and we never store it.
- The extracted text stays in the open page, where you can review and correct it.
When you search with AI
- Before anything leaves your browser, Insta Job removes email addresses, phone numbers and links. It also drops lines about date of birth, marital status, religion, caste, gender or nationality.
- Your browser then sends the reviewed text, any corrections, and the graduation year and experience you confirmed, to our server over an encrypted (HTTPS) connection.
- Our server removes email addresses, links, phone numbers and lines about protected attributes, and masks your name (taken from the top of your resume), street addresses and 6-digit postcodes wherever they appear. It then sends the AI provider only the passages that show skill evidence for candidate roles. The rest is used in memory to finish your request and is not stored.
- Automatic filtering can miss unusual formats. Please check the text before you search.
When AI is off or your allowance is used
Ranking happens on your device. Nothing from your resume is sent to us or to any AI provider.
Job matching
Openings come from public company job feeds that we admit and check about every six hours. Your browser downloads public listings from our server and compares them with your resume on your device. Job sources receive no personal data from us.
If you sign in with Google
Signing in is optional. Google gives us your Google account ID, name and email address, and we store them to run your account. We never see your Google password.
Running the free allowance and preventing abuse
-
When you start your first search, we set a cookie with a random
trial identifier (
ij_trial). It counts your free searches and lets us enforce abuse limits. Visiting the site, the resume studio's AI help and requirement explanations never create one. - We keep a short receipt for each search and daily usage counters.
- IP addresses are never stored. Daily usage counters use keyed hashes (HMAC, made with a secret key) of your IP address and of your trial or account identifier. Stored counters cannot be turned back into an IP address or linked to you without that key, and the service refuses AI requests rather than store counters without it.
What we do not do
- We do not sell or rent personal data.
- We do not show advertising or share data with advertisers.
- We do not build profiles about you for anyone else, and we do not fingerprint your device.
- We do not send contact details to AI providers, and we mask your name, street address and postcode before any text goes to them. Masking is automatic and can miss unusual formats, so check the excerpt under “Review resume text” before you search.
- We do not use your Google email address for marketing.
- We do not share your resume or results with employers.
You do not have to give us any personal data, and no law requires you to. Without the resume passages, we cannot run an AI search for you.
3. Purposes and legal bases
This table shows why we process each kind of data, the legal basis under the GDPR (Article 6) and under the DPDP Act, and how long we keep it. Section 9 gives full retention details.
| Purpose | Data | GDPR basis | DPDP basis | Kept |
|---|---|---|---|---|
| Suggest career directions and job matches (AI search) | Filtered resume passages, corrections, confirmed graduation year and experience | Art. 6(1)(b): needed to provide the service you ask for | Consent (section 6), given when you confirm and start the search | In memory during the request; encrypted result up to 24 hours |
| Optional AI writing help in the resume studio | The bullet points you select and the job text you paste, with contact details removed | Art. 6(1)(b) | Consent, given each time you tick the AI box and ask | In memory during the request; not stored by us |
| Free allowance, fair use and abuse prevention | Trial identifier, search receipts, daily counters with keyed hashes of IP address and browser or account | Art. 6(1)(f): our legitimate interest in keeping a free service available and fair, and stopping abuse | Consent, given when you start your first search | Receipts 90 days; trial record 90 days after last use; counters deleted within 2 days |
| Google sign-in and your account | Google account ID, name, email address; session token (stored as a hash) | Art. 6(1)(b) | Consent, given when you choose to sign in | Account 30 days after last activity; sessions 7 days; sign-in state 10 minutes |
| Optional analytics | Cloudflare Web Analytics page measurements; anonymous daily feature counts | Art. 6(1)(a): consent | Consent | Feature counts 30 days; Cloudflare under its own terms |
| Remembering your choices | Your analytics choice, your 18+ confirmation, and a draft kept across Google sign-in | Art. 6(1)(f): remembering a choice you made so we don't ask again | Stored only on your device; not sent to us | Until you change or clear it; the draft is deleted when you return |
| Answering your requests and grievances | Your email address and what you tell us | Art. 6(1)(c): legal duty to answer data protection requests | Legitimate use: information you give us for this purpose (section 7(a)) | As long as needed to resolve the request |
| Security and legal compliance | Request details Cloudflare processes while serving pages (such as IP address and browser type); error codes in our logs | Art. 6(1)(f): keeping the service and users safe | Covered by your consent to use the service; legitimate uses where a law or court order requires disclosure (section 7(d) and (e)) | We keep no raw IP addresses |
Where we rely on legitimate interests, you can object (see your rights). Where we rely on consent, you can withdraw it at any time. Withdrawing does not affect processing that already happened.
4. AI processing and providers
Cloudflare Workers AI (default)
By default, searches use Cloudflare Workers AI. Cloudflare runs an open model on its own network. The model is set in our configuration and is currently Meta Llama 3.3 70B. Cloudflare states that it does not use content processed by Workers AI to train AI models, and does not keep inputs or outputs after it has processed the request.
Google Gemini (signed-in users, when enabled)
When we turn it on, searches by signed-in users may use Google Gemini instead. We use Gemini only through Google Cloud's Vertex AI, or through a Gemini API project that we have confirmed is on Google's paid tier. We never use Gemini's unpaid tier, because Google's terms let it use unpaid-tier content to improve its products. For the services we use, Google's terms say it does not use your prompts or responses to train its models or improve its products. Google may cache data briefly (Vertex AI says for no more than 24 hours) and log prompts for a limited time to detect abuse.
Before you search, the app shows which provider will receive your passages.
If a provider fails
If Gemini fails during a search, the same minimised passages may be sent to Cloudflare Workers AI instead. The line shown before you search says so.
When AI is off or unavailable
When AI is switched off or unavailable, or today's allowance is used, ranking happens on your device and nothing is sent. Free AI capacity is limited each day and may end; we will update this notice if our providers change.
Other optional AI features
- AI writing help in the resume studio sends the bullet points you select and the job text you paste, with contact details removed, to Cloudflare Workers AI. It runs only when you tick the consent box and ask.
- Explaining employer wording sends only text from the public job listing. No resume content is included.
AI output is a suggestion, not a decision
- Career directions and job matches are suggestions to help you explore. They are not hiring decisions, and no employer receives them.
- We make no automated decisions that have legal or similarly significant effects on you.
- The model is told to cite passages from your own resume, and not to infer protected traits or age. Results that do not cite your resume are rejected.
6. Website traffic analytics
Analytics are off by default. They start only after you choose “Allow analytics”.
- Cloudflare Web Analytics measures page views, visits, referring websites, country, browser and device type, and page performance. Cloudflare states that it uses no cookies or local storage for this and does not fingerprint visitors.
- Anonymous feature counts record that a feature was used, such as “finished a search”. Each count carries the event name only, with no identifier and no cookie, at most once per event per page session. We keep daily totals for 30 days.
- Analytics never include resume files or text, names, email addresses, AI prompts or AI results.
Saying no never limits any feature. Change your choice at any time in Cookie settings. The policy pages, including this one, never load analytics.
7. Who receives data
We share personal data only with the providers below, and only to run Insta Job.
| Recipient | What they do | What they receive |
|---|---|---|
| Cloudflare, Inc. (United States) | Hosting, network, security, databases, Workers AI, and Web Analytics if you allow it | All traffic to the site; the records described in this notice; minimised resume passages for AI searches; page measurements if you allow analytics |
| Google LLC (United States) | Google sign-in; Gemini through Vertex AI or a paid Gemini API project, for signed-in searches when enabled | For sign-in, Google knows you signed in to Insta Job and acts under its own privacy policy. For Gemini, minimised resume passages. |
| Company job sources | Publish the public job listings we show | No personal data |
| LinkedIn, Glassdoor, Foundit, Naukri and employer sites | Separate websites that open only when you click a link | The role and location you typed, which are part of the link, plus what any website receives when you visit it. Their own privacy policies apply. |
| Authorities | Only when the law requires it | Only what a valid legal request requires |
8. International transfers
We operate from India. Cloudflare and Google run global infrastructure, so your data may be processed in other countries, including the United States.
For personal data from the EU, UK or Switzerland, we rely on these providers' data processing terms. Those terms use recognised transfer mechanisms, such as the EU Standard Contractual Clauses and, for transfers to the United States, the EU–US Data Privacy Framework where the provider takes part. Email us if you want more detail.
9. How long we keep data
Automatic cleanup jobs run every six hours, so an item can last up to six hours past the period shown.
| Data | How long |
|---|---|
| Your resume file | Never uploaded. It stays on your device. |
| Resume passages sent for an AI search | Used in memory for that request only. Not stored. |
| Encrypted career result (directions, cited passages, profile facts) | Recoverable for up to 24 hours, so a dropped connection does not cost you a search. The content is then deleted. |
| Search receipts (hashed owner reference, request ID, input fingerprint, time, outcome) | Up to 90 days, to enforce free-search limits |
| Trial identifier record (random ID, dates) | Deleted 90 days after last use |
| Daily AI usage counters (keyed hashes) | Kept for the day they count; deleted within 2 days of being written |
| Failure and quality metrics (day, model, outcome codes, timings) | 30 days. They contain no personal data. |
| Google account (account ID, name, email, last activity) | Deleted after 30 days without activity, or at once when you use Delete my data |
| Encrypted workspace saved in an earlier version of the beta, if you made one | Deleted with your account |
| Sign-in sessions (stored as hashes) | 7 days, or until you sign out |
| Sign-in state | 10 minutes |
| Anonymous feature counts (only if you allow analytics) | 30 days |
| Deletion record (internal account number and date, no name or email) | Kept until the deletion has been fully applied, then deleted 30 days later |
| Your emails to us | As long as needed to deal with your request and show we handled it |
| Provider backups | Roll off on the provider's own cycle. Cloudflare's database recovery feature keeps earlier states for up to 30 days. |
10. How we protect data
- Resume files never leave your device.
- All traffic uses HTTPS.
- Search results are encrypted (AES-GCM) before storage, bound to your browser or account, and their content is deleted after 24 hours.
- Cookies are HttpOnly, Secure and SameSite=Lax. Session tokens are stored only as hashes.
- IP addresses are not stored. Every query for your records is limited to the owner our server identifies, never to an ID your browser claims.
- A strict Content Security Policy blocks third-party scripts, except the analytics beacon when you allow it.
- Admin pages require Cloudflare Access with multi-factor authentication.
- Logs carry error codes and IDs, not resume text. Secrets stay on the server and never reach your browser.
No system is perfectly secure. To report a vulnerability, see our security.txt and the security reporting policy.
11. Your rights
Under India's DPDP Act
- Access: a summary of your personal data, how we process it, and who we have shared it with.
- Correction, completion and updating of your personal data.
- Erasure of your personal data.
- Withdraw consent at any time, as easily as you gave it.
- Grievance redressal: a quick way to complain to us.
- Nominate another person to use your rights if you die or become unable to act.
Most duties and rights under the DPDP Act take effect on 13 May 2027. We already honour them.
Under the EU or UK GDPR
- Access to your personal data.
- Rectification of inaccurate data.
- Erasure.
- Restriction of processing.
- Portability: a copy in a machine-readable format.
- Objection to processing based on legitimate interests.
- Withdraw consent at any time, without affecting earlier processing.
- Complain to a supervisory authority where you live or work, or where the issue happened. EU authorities are listed by the European Data Protection Board. In the UK, contact the Information Commissioner's Office.
If you live elsewhere, write to us anyway. We will also consider rights you have under your local law.
12. How to use your rights
- Instantly, in the app: open Privacy controls. Download my data gives you a file (JSON) of everything our server holds for this browser or your account: trial and account records (including your Google account ID, last activity and sign-in session expiry dates), search receipts with their input fingerprints, cached results, and a description of the pseudonymous daily usage counters. Delete my data erases this browser's trial records, or your signed-in account and its linked records, and clears Insta Job data saved in this browser.
- Analytics consent: change or withdraw it in Cookie settings.
- Anything else (correction, objection, nomination, a grievance, or help): email omshriansh16@gmail.com. Shriansh Vikram Singh will reply within 30 days. It is free.
To protect you, we may ask you to confirm a request is yours. For example, we may ask you to write from the email address linked to your Google account. Records from searches without sign-in are linked only to a cookie in your browser, so we cannot find them from an email alone. Use Privacy controls in that browser.
If you are not satisfied
- India: after you have used our grievance process, you can complain to the Data Protection Board of India once the DPDP Act's complaint provisions apply (from 13 May 2027).
- EU or UK: you can complain to a supervisory authority at any time.
13. Children
Insta Job is for adults aged 18 or over. Before searching, signing in or using AI writing help, you must confirm that you are 18 or older. We do not knowingly process children's personal data. Under the DPDP Act, a child is anyone under 18.
If you believe a child has used Insta Job, use Delete my data in that browser, or email omshriansh16@gmail.com. We will delete the records we can link to them.
14. Marketing
We send no marketing. We have no newsletter, and your Google sign-in email is never used for marketing. If we ever start a newsletter, it will need a separate opt-in, and every email will include an unsubscribe link.
15. Data breaches
If a breach affects your personal data, we will tell you without delay: by email if you signed in, and with a notice in the app and on this page if we have no way to contact you. We will explain what happened, the likely effects and the steps you can take. We will notify the authorities as the law requires, including CERT-In in India and, where applicable, the Data Protection Board of India and EU or UK supervisory authorities.
16. Changes to this notice
When we change this notice, we update the date at the top. We will show important changes in the app before they take effect. An updated notice is never consent to a new optional use of your data; we will ask you first.
17. Contact
SynapSoul Labs, operated by Shriansh Vikram Singh
Privacy questions and grievances: omshriansh16@gmail.com
This notice is in English. If you need it in another language listed in the Eighth Schedule to the Constitution of India, email us.