Privacy policy

1. Who we are

One-Career is operated by Vlightsoft (Vlightsoft, India), the data fiduciary / controller for your personal data. Questions about privacy: privacy@one-career.com. Complaints: our Grievance Officer.

2. What we collect

• Account: name, email, password (stored only as a hash by our authentication provider), country, language, time zone.
• What you add: education, jobs, projects, certificates, skills, resumes, cover letters, offers, payslips, documents and photos, contacts and references, journey goals, notes and tasks.
• Verification: work or college email verification (we keep only a masked email and the domain), identity checks you start, and the evidence you attach.
• Organisations: for recruiter and institute accounts, the organisation's name, verified domain, billing details (such as GSTIN) and team members.
• Interviews in One-Career Meet: only with consent — recordings, transcripts and integrity signals (events such as tab switches; never raw video or audio for monitoring).
• Usage and security: sign-in events, device and browser type, and error logs, so we can keep your account safe and fix problems.
• Payments: handled by our payment provider (Paddle, the merchant of record). We never see or store your card number.

3. Why we use it

• To run the service you asked for: storing your records, building resumes and letters, planning your journey, tracking applications and offers.
• To verify claims you choose to verify, and to show trust labels (for example "Email verified").
• To send the notifications you choose (you control each topic and channel in Settings).
• To keep the service secure, prevent fraud and abuse, and meet legal obligations.
• To improve suggestions using aggregated accept/edit/reject counts — never by selling or sharing your personal data.

Our legal bases are your consent, the contract with you, our legitimate interest in keeping the service safe, and legal obligation.

4. AI features

When you use an AI feature, only the text needed for that task is sent to our AI provider (Anthropic), with ID numbers masked. It is processed to produce your answer and is not used to train the provider's models. AI suggestions are proposals: nothing is sent, accepted or submitted on your behalf without your click.

5. Who can see your data

• You decide. Your vault, documents, payslips and salary are private by default.
• Recruiters and organisations only see what you share or make discoverable, and never your documents or salary. They see verification labels, not the email or document behind them.
• Our staff can only see evidence files you attached to a verification request you made, for as long as the review needs.
• Service providers who process data for us under contract: Supabase (database and file storage, hosted in Tokyo, Japan), Netlify (web hosting), Anthropic (AI), Paddle (payments) and our email delivery provider.
• We share data with authorities only when the law requires it, and we tell you unless we are legally prevented.

We do not sell personal data, and we do not use it for third-party advertising.

6. How long we keep it

We keep your data while your account is active. Interview recordings are kept for 90 days. When you delete your account, it is scheduled for deletion and permanently removed, including your files, after a 14-day cool-off during which you can change your mind. Security logs are kept for up to 12 months. Records we must keep by law (such as invoices) are kept for the legally required period.

7. Your rights

• Access and portability: download all your data any time from Settings → Your data.
• Correction: edit anything in your profile and records.
• Deletion: delete individual records, or your whole account from Settings → Your data.
• Withdraw consent for optional uses (newsletter, promotions, discoverability) in Settings, at any time.
• Nominate someone to exercise your rights if you die or become incapacitated (India, DPDP Act): write to privacy@one-career.com.
• Complain to our Grievance Officer, and if you're not satisfied, to your data-protection authority.

We reply to rights requests within 30 days (15 days for grievances in India).

Your rights where you live

California residents: we don't sell or share personal information for cross-context advertising, and you have the right to know, delete, correct and limit use of sensitive information.

8. Children

School students under 18 need a parent's or guardian's consent, which we collect before their profile can be discovered. We don't knowingly collect data from children under 13.

9. Security

Data is encrypted in transit and at rest; bank and provident-fund details are additionally encrypted and only shown masked. Access is controlled per record (row-level security), files are in private storage reachable only through short-lived links, and every share link can be revoked — or all of them at once with the Panic lock in Settings. Report a vulnerability to security@one-career.com.

10. International transfers

Our main data store is in Tokyo, Japan, and some providers process data in other countries. We use contractual safeguards (such as standard contractual clauses) where the law requires them.

11. Cookies

We use only the cookies needed to sign you in, keep you secure and remember your settings. See the cookie notice.

12. Changes

If we change this policy in a way that matters, we'll tell you in the app before it takes effect.