Privacy Policy

Last updated: 1 May 2026

This page explains what personal data CraftCV (craftcv.in) collects, why, where it is processed, and the rights you have under the Digital Personal Data Protection Act, 2023 (DPDP Act) of India, the EU/UK GDPR (for users in those jurisdictions), and equivalent data-protection laws.

CraftCV is operated by an individual developer based in India. For the purposes of the DPDP Act, the operator is the Data Fiduciary; you are the Data Principal.

1. Summary (plain English)

Resume builder: Your resume draft is saved locally in your browser. AI features send only the text you actively choose to polish or generate.
Marriage biodata builder: Nothing leaves your device. Ever. Fields like caste, religion, and horoscope are processed entirely in your browser.
Personality resume: Date of birth, time, and place (if you enter them) are sent to AI providers solely to generate symbolic/astrological content. Clearly labelled in the UI.
Analytics: Cookie-free, self-hosted. Tracks aggregate page views and event counts. No individual user profiles, no cross-site tracking.
Payments: Razorpay handles card / UPI details directly. We never see or store your card or UPI ID.
No accounts, no emails. We do not ask you to sign up.

2. Marriage biodata — special device-only guarantee

Biodata data never leaves your device

Marriage biodata fields — including caste, religion, gotra, rashi, nakshatra, manglik status, family details, and uploaded photos — are processed entirely on your device. They are never transmitted to CraftCV servers, never sent to AI providers, and never stored anywhere outside your browser's local storage on this device.

This is a deliberate architectural decision. The biodata builder:

Runs the PDF generation in your browser (no server-side render).
Does not offer AI "improve my biodata" or similar features, because those would require sending biodata text to third-party AI APIs. Keeping biodata AI-free is how we keep the device-only claim honest.
Does not offer Word (.docx) export for biodata, to preserve the traditional layout and keep the device-only promise absolute.
Saves biodata drafts only to your browser's localStorage. Clearing your browser data clears the biodata.

What this means for you: if you want to move your biodata to another device, you'll need to re-enter it there. We cannot recover or restore biodata if your browser data is cleared. This is the cost of the stronger privacy guarantee — we think it's worth it for data this sensitive.

3. What personal data we process — and where

The table below lists every category of personal data CraftCV touches, where it is processed, and why.

Category	Where processed	Purpose	Retained
Resume fields (name, email, phone, LinkedIn URL, work history, education, skills)	Your device; sent to our server only when you explicitly trigger an AI feature (Describe yourself, AI Pro polish) or a download.	Build your resume; AI tailoring if you opt in; PDF / DOCX generation at download.	Drafts: in your browser's `localStorage` until you clear it. Server-side: transient, deleted within 24h of the API call.
Marriage biodata fields (name, DOB, caste, religion, gotra, rashi, nakshatra, manglik, family details, photos, partner preferences)	Your device only. Never transmitted anywhere.	Biodata PDF generated in your browser.	Your browser's `localStorage` until you clear it.
Personality-resume astrology inputs (DOB, time of birth, place)	Sent to our AI provider (Anthropic or Google) if and only if you explicitly ask for an astrology-flavoured resume. Clearly labelled in the UI.	Generate symbolic / zodiac-themed copy.	Transient. Not retained by CraftCV; see provider policies for their retention (typically ≤30 days for abuse detection).
Device ID (random UUID generated in your browser)	Sent with AI and payment requests so we can rate-limit fairly and track lifetime paid amount for the Pro Monthly subscription trigger.	Anti-abuse; subscription eligibility.	In-memory on the server (lost on restart). Not linked to your identity.
IP address	Received by our server as part of any HTTP request.	Secondary rate limiting; security logs.	Access logs: 30 days. Not joined to your resume content.
Payment details (card number, UPI ID, bank details)	Razorpay only. We never receive these.	Processing the payment you initiate.	Governed by Razorpay's policy.
Payment metadata (order id, payment id, tier, amount)	Our server, via Razorpay's signed webhook / verify response.	Anti-fraud; issue your download token; sum toward rupees_paid_lifetime for the subscription offer.	In-memory on the server. Full records are available on Razorpay's dashboard to us for reconciliation.
Analytics (aggregate page views, CTA clicks, funnel events)	Our self-hosted Umami instance on the same server (`analytics.craftcv.in`). Cookie-free, no cross-site tracking.	Understand which features work, improve the product.	2 years, then auto-deleted.

4. What we do NOT do

We do not sell personal data to anyone. Ever.
We do not use tracking cookies, advertising pixels, or third-party fingerprinting.
We do not send biodata fields to AI providers, under any circumstances.
We do not profile users for ad targeting or build marketing segments.
We do not combine your resume with other users' data to train AI models. Your resume is never part of any training corpus.

5. Third parties we rely on

Anthropic (claude.ai API) — AI resume polish and draft generation. Your resume text is sent when you use those features. Their privacy policy.
Google (Gemini API) — fallback AI provider. Same scope. Their API terms.
Razorpay — all payment processing. Their privacy policy.
Amazon Web Services (AWS) ap-south-1 Mumbai — our server infrastructure. Data stays in India.
Let's Encrypt — TLS certificates.

We do not send biodata data to any of the above.

6. Your rights under the DPDP Act

As a Data Principal, you have the right to:

Access the personal data we process about you.
Correct, complete, or erase your data.
Withdraw consent for any processing that relies on consent.
Nominate another person to exercise these rights in the event of your death or incapacity.
Grievance redressal — contact us first; if unresolved, escalate to the Data Protection Board of India.

For resume data you submit to our server, email support@craftcv.in and we will respond within 30 days. For biodata, there is nothing on our server to access, correct, or erase — clear your browser's local storage and the data is gone.

7. Children

CraftCV is not intended for use by children under 18. We do not knowingly collect personal data of children. If you believe a child has used CraftCV, email support@craftcv.in and we will delete any associated data.

8. Data breach notification

If we become aware of a breach of personal data stored on our servers, we will:

Notify the Data Protection Board of India within the timeframes specified by the DPDP Act.
Notify affected users via the email address they provided (if any) or via a notice on the homepage.
Disclose what data was affected, what actions we are taking, and what you can do.

Note: because biodata never leaves your device, a breach of our servers cannot expose biodata data. This is the entire point of that architecture.

9. Changes to this policy

If we make material changes to this policy, we will update the "Last updated" date above and surface a notice on the homepage for a reasonable period. Continuing to use CraftCV after the change indicates acceptance.

Contact & grievances

Email: support@craftcv.in

We aim to respond within 30 days. If we cannot resolve a grievance, you may escalate to the Data Protection Board of India.

CraftCV · Back to home