Privacy Policy

Last Updated: October 22, 2026

1. Data We Collect

We collect the following information strictly to provide our services and operate the CareerSadhana platform:

  • Account Information: We store your registered name, email address, and a securely hashed password. Single-use email verification and password reset tokens are cryptographically hashed using SHA-256 to protect your credentials.
  • Organization Data: When assigned by an educational institution, corporate employer, or staffing vendor partner, candidate details (name, email) are securely imported and scoped exclusively to that authorized organization.
  • Assessment Scoring & AI Processing:
    • Aptitude & Coding (Strictly Deterministic): Scoring is 100% deterministic and rule-based evaluated against test cases and solution keys. No Large Language Models (LLMs) or external AI services are used in calculating aptitude or coding results.
    • Language Proficiency Test (LPT): Evaluated using deterministic grammars with minimal bounded context.
    • AI Interview (Text Extraction Only): Responses are converted to text transcripts directly via browser speech recognition APIs. Raw audio and video files are never recorded, stored, or transmitted to any third-party AI service. Only the textual transcription is evaluated against interview rubrics.
    • ATS Resume Screening: Resumes are processed in-memory for keyword alignment, formatting readability, and section completeness.
  • Proctoring & Assessment Integrity: For proctored tests, explicit candidate permission is requested for camera, microphone, and screen sharing. Visual presence and audio indicators are evaluated client-side in the candidate's browser to identify camera shutter obstruction, face absence, screen share termination, and background speech. Continuous video is never recorded or streamed to our servers.

    Evidence Retention & Deletion Model:

    • 24-Hour Access Expiration: When a qualifying integrity violation is confirmed, a single still frame is captured onto canvas and compiled into a compact incident PDF stored as secure binary data (PostgreSQL BYTEA). Access to this incident evidence strictly expires after 24 hours (returning HTTP 410 Gone).
    • Payload Removal: Binary evidence payloads stored in the database are removed when cleanup executes (via access-triggered purging, administrator deletion, or scheduled maintenance).
    • Audit Metadata: Incident metadata (timestamps, violation types, severity, and masked candidate identifiers) may remain recorded for administrative review and institutional reporting.
    • Infrastructure Backups: Underlying PostgreSQL storage space is reclaimed per database autovacuum processes, and provider disaster-recovery snapshots cycle per cloud infrastructure SLA.
  • Profile Correction Requests: Candidate requests for verified name or email corrections are logged with the reason provided and stored in our database for administrative audit and approval.
  • Vendor & Staffing Partner Inquiries: Organization and vendor partner requests are recorded with contact details, company information, and candidate volume estimates to provision enterprise workspaces.
  • Support Requests: Support inquiries and contact messages submitted through our portal are transmitted securely to our support desk.

2. Cookies, Consent, and Local Storage

CareerSadhana provides a transparent, granular cookie preference control with three explicit tiers:

  • Essential Cookies (Always Active): Essential HttpOnly, SameSite=Lax session cookies (including cs_token for candidates, cs_admin_token for super administrators, and cs_org_token for organization administrators) are strictly required for authentication, tenant routing, and security. Essential cookies cannot be disabled. Choosing "Accept Essential Only" or "Reject All" preserves these functional cookies while shutting down optional trackers.
  • Performance & Analytics (Optional): Optional performance tracking (such as Vercel Speed Insights for Core Web Vitals) is strictly blocked by default and only activates if you explicitly choose "Accept All".

Your preference is recorded in your browser's local storage (cs_cookie_consent). You can review or modify your cookie preferences at any time by clicking "Cookie Preferences" in the footer of any page.

3. How We Use and Isolate Your Data

CareerSadhana strictly enforces role-based access control (RBAC) and tenant isolation:

  • Candidates: Can only view their own dashboard, assigned tests, profile, and historical scores.
  • Organization Administrators: Can only access, invite, and view reports for candidates belonging to their designated organization. Tenant cross-access is strictly barred at both the middleware and database query layer.
  • Main Administrators: Possess platform-level oversight to administer organizations, review profile correction requests, and maintain platform security.

4. Third-Party Integrations

We partner with reputable infrastructure providers to deliver reliable services:

  • Code Execution: Candidate code solutions in Coding Assessments are compiled in isolated sandbox environments via Judge0 / Wandbox.
  • Email Dispatch: Automated verification emails, password reset links, and assessment access notifications are dispatched via Resend.
  • Support: Help desk ticketing is powered by Zoho Desk.
  • Performance Monitoring: Vercel Speed Insights collects aggregate Core Web Vitals only when optional analytics cookies are accepted. All URLs are sanitized to strip query parameters, tokens, and candidate identifiers before transmission.

5. Contact Us

If you have any questions regarding your privacy, assessment data, or this policy, please reach out to our data protection team at support@careersadhana.in.