NicheHire Privacy Policy & Data Fiduciary Notice

1. Information We Collect & Architecture Principles

When you use NicheHire as a job seeker or employer, we process only the minimum necessary data required for job matching and employer verification:

• Browser-First Local Storage: Candidate profile details (such as educational qualification, degree, domicile state, and draft resumes created via our Resume Builder) are persisted directly inside your device's browser localStorage. They are not uploaded to central tracking servers.
• In-Memory Resume Parsing: When you upload a resume (PDF, DOCX) for AI skill screening or tailoring, the document is evaluated in an ephemeral server memory buffer by Google Gemini / Mammoth and immediately discarded. We do not maintain any persistent raw document storage buckets (e.g., AWS S3, Google Cloud Storage).
• Account Identifiers: Email address, encrypted authentication hashes, and optional display names managed through Supabase Authentication with Row-Level Security (RLS).
• Employer Verification Data: Corporate work email, corporate website domain, hiring hub locations, and 12-digit UPI Transaction Reference (UTR) numbers used solely for manual payment reconciliation by our founder.
• Zero Geolocation Persistence: When you use the “Detect My Region” feature, your device latitude and longitude are calculated against offline centroid boundaries purely in client-side memory to suggest your state and district. Raw GPS coordinates are never sent to or logged on our servers.

2. Purpose of Processing & AI Match Scoring

We process collected data exclusively for the following specified purposes:

• AI Match Scoring: To evaluate skill overlap (50%), experience alignment (25%), and education requirements (20%) between your profile and verified job descriptions to output an objective High, Medium, or Low Match Score. NicheHire does not make automated hiring decisions or guarantee employment.
• ATS Tailoring & Outreach Drafts: To generate customized cover emails and bullet point recommendations requested explicitly by you.
• Zero-Ghost-Job Verification: To authenticate corporate employer domains and ensure that job vacancies reflect active career portal openings.
• Bank UPI Reconciliation: To enable direct founder verification of employer membership payments without gateway fees or third-party card processors.

3. Data Sovereignty & Your DPDP Act Rights

In accordance with Section 11, 12, and 13 of the Digital Personal Data Protection Act, 2023, data principals hold the following statutory rights:

• Right to Erasure & Withdrawal: You may clear your locally stored profile data instantly using browser settings or request complete deletion of your account and application history by emailing our Data Protection Fiduciary.
• Right to Access & Portability: You may request a complete export of all data associated with your registered email address.
• Right to Grievance Redressal: Any privacy concerns will be acknowledged within 24 hours and addressed within 7 business days.

4. Security & Storage Architecture

All data transmissions are encrypted using Transport Layer Security (TLS 1.3). Database tables are protected by AES-256 encryption at rest, and access controls are governed by strict Supabase Row Level Security (RLS) policies. No unauthenticated third parties or automated scrapers are granted access to candidate data.

5. Data Protection Fiduciary Contact

For statutory privacy notices, data erasure requests, or compliance inquiries under India's DPDP Act:
Data Protection Fiduciary: Harshit Mishra (Founder & CEO, NicheHire)
Official Grievance Email: harshit0913@gmail.com / harshit@nichehire.in
Headquarters: India