Privacy Policy

Account information

Name, email address, and authentication data provided through Clerk when you register or sign in.

Resume and career data

Resume content, work history, skills, education, and job descriptions you provide for ATS scoring and tailoring.

Public ATS preview (no account required)

If you use our free ATS preview tool on the landing page without an account, we collect your email address, the resume file you upload, and the job description you paste. This data is used to send you your ATS results. It is stored in our database and subject to the same retention and deletion rights as account data.

Ad-redirect data

If you follow an ad link that opens in an in-app browser (e.g. from Instagram) where account creation doesn't work properly, we may ask for your email to send you a link to continue in your regular browser. We store that email address and the source of the redirect for this purpose only.

Usage data

Features used, pages visited, actions taken within the app, and interaction timestamps.

Payment information

Billing plan and subscription status. Payment card details are handled entirely by Stripe and never stored by us.

Team and organisation data

If you create or join a team account, we collect your organisation name, Clerk organisation ID, team role (admin or member), and membership timestamps. This data is used to manage access control and centralised billing for your team.

Chrome Extension data

If you install the Hyrenora Chrome Extension, we collect the following additional data: (a) job posting text and metadata (job title, company, URL) captured from job board pages you visit while the extension is active; (b) LinkedIn profile text captured when you visit a LinkedIn profile page; (c) autofill telemetry including the ATS platform name, job application URL, number of fields attempted and filled, and the fill method used (this helps us improve autofill accuracy); (d) screenshots of job application form pages, which may be sent to OpenAI's Vision API when standard and AI semantic autofill methods are unable to detect form fields. Captured job and LinkedIn data is stored temporarily in your browser's local storage (chrome.storage.local) and is not transmitted to our servers unless you explicitly take an action (e.g. saving a job or importing a LinkedIn profile). Your Clerk authentication token is also stored in local storage to authenticate API requests made by the extension.

AI career coach chat history and agent memory

If you use the AI Career Consultant feature, your conversation messages and session history are stored in our database to provide continuity across sessions. The consultant also maintains persistent agent memory — structured facts you share (e.g. salary expectations, target companies, relocation preferences) that are retained across sessions. This data is associated with your account and subject to the same retention and deletion rights as other account data.

Interview Simulator sessions

If you use the Interview Simulator, the generated questions, your answers, and AI-generated scores (per-axis and overall) are stored in our database linked to your account. This data is subject to the same retention and deletion rights as other account data.

Skill verification and assessment data

If you use the Verified Skills features, we process additional data depending on the method you choose: (a) GitHub verification — when you connect a GitHub username, we read your public repositories (languages, topics, and repository metadata) via the GitHub API to infer and verify skills; we do not request access to private repositories; (b) portfolio or certificate verification — the portfolio URL content or certificate text you submit is sent to OpenAI for skill extraction; (c) coding assessments — code you submit for a coding test is executed against hidden test cases on a third-party code-execution sandbox (Judge0) to grade the result. The resulting verified skills, confidence scores, evidence artifacts, and (where applicable) educator endorsements are stored in our database linked to your account, and — if you publish a public profile — may appear on your public Skills Passport. This data is subject to the same retention and deletion rights as other account data.

MCP token

If you generate an MCP token (Settings → Profile), a hashed token is stored in our database linked to your account. Token metadata (creation date, last used date) is also stored. The token grants access to your career data via the MCP server and should be treated like a password. You can revoke it at any time from Settings.

Public profile data

If you choose to share your resume via a public profile link (/p/[token]), the resume content you have selected to share becomes publicly accessible to anyone with that link. You can revoke access at any time by disabling the share link from your settings.

Technical data

IP address, browser type, device information, and error logs collected for security, rate limiting, and debugging.

Session replay

We use session replay to record anonymised interactions within the application (mouse movements, clicks, page navigation) to help us identify usability issues. Session replay does not record passwords, payment details, or resume file contents. You can opt out by disabling analytics cookies in your browser.

Cross-border data transfers

Hyrenora is operated by Hyrenora Technologies LLP (LLPIN: ADB-6511), a limited liability partnership registered in India. Your personal data is stored and processed on servers located outside India, including:

• Cloud database provider — United States (primary data store)
• Cloud hosting provider — United States (web application)
• Cloud infrastructure provider — United States (AI and processing services)
• Clerk — United States (authentication)
• OpenAI — United States (AI features: resume tailoring, career coach, skill gap analysis)
• Resend — United States (transactional email)

By using Hyrenora, you acknowledge and consent to this cross-border transfer of your personal data. We take appropriate safeguards to protect your data regardless of where it is processed.

Your rights under DPDPA 2023

• Right to access — request a summary of personal data we hold and how it is used
• Right to correction — request correction of inaccurate or incomplete data
• Right to erasure — request deletion of your personal data once the purpose is fulfilled or consent is withdrawn
• Right to grievance redressal — raise a complaint with our Grievance Officer (contact details below)
• Right to nominate — nominate another individual to exercise your data rights on your behalf in the event of your death or incapacity. To register a nominee, contact our Grievance Officer.

Consent and withdrawal

Students joining through a university partnership provide explicit consent to data processing at the time of joining (recorded with timestamp). You may withdraw this consent at any time by contacting our Grievance Officer. Note that withdrawal of consent may result in loss of access to the university-linked features.

Data breach notification

In the event of a personal data breach that is likely to affect your rights, we will notify you and, where required, the relevant regulatory authority, within 72 hours of becoming aware of the breach.