Privacy policy

1. The short version

This policy explains how we handle personal data. Here is what matters most:

You sign in with your mobile number. We do not ask for your name.
Verification documents are deleted as soon as we decide, and never kept more than 72 hours.
We keep only a one-way fingerprint of your work email, never the address itself.
Your contributions are stored under a pseudonymous key, not your account.
We never sell personal data, and we do not use advertising or tracking cookies.
You can see, correct and erase your data, nominate someone, and complain to us.

2. Who we are

BeforeJob is run by To be published before launch. For the personal data described here, we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”). That means we decide why and how your data is processed, and we are responsible for it.

This policy covers the BeforeJob website and app. It sits alongside our terms of use. Questions about privacy, and requests to use your rights, go to our Grievance Officer through the grievance page.

Operated by: To be published before launch
Registered address: To be published before launch
Courts with jurisdiction: To be published before launch

To be published before launch

We will publish the company's legal name, registered address and city whose courts hear disputes here before BeforeJob opens to the public. Until then, write to the Grievance Officer through the grievance page for any legal notice.

3. What we collect

When you sign in

Your mobile number, to send you a sign-in code on WhatsApp and to keep your account secure.
An optional personal email address, only if you add one for alerts.
Your alert settings, when you accepted our terms, and when you last signed in.

When you verify your employment

The company you say you work or worked at, and the method you choose.
Work email: we use the address once to send a code. We keep only a one-way hash of it, a fingerprint that cannot be turned back into the address, so the same inbox cannot verify many accounts.
EPF passbook, payslip or offer letter: we hold the file only until we decide, and never more than 72 hours. From it we keep whether the employer matches, whether you are a current or former employee, your tenure band, coarse start and end months, and a confidence score. We do not keep your name, UAN, PAN, salary figures or bank details from the document.

When you contribute

Reviews, salaries, interview experiences, discussion posts and comments, layoff and appraisal reports, and survey answers.
These are stored under a pseudonymous key, a code calculated from your account with a secret that only our servers hold. Contribution records never contain your name, phone number or account id.
Please do not put personal data in a contribution, yours or anyone else’s. Our screening looks for names and contact details and asks you to remove them.

Employer accounts

The work email address on the company’s domain that the employer verified, the job title they give us, and the company they manage.

Grievances and reports

For a grievance: your name, email, and optionally phone number and organisation, plus what you tell us.
For a report on a contribution: the reason and any details you add. If you are signed in, the report carries your pseudonymous key, not your account.

Technical data

Your IP address and basic request details, used for security, to stop abuse and to limit how often forms can be sent.

We do not collect your Aadhaar number, precise location, contacts, photos from your device, or biometric data. Please do not upload Aadhaar as a verification document.

4. Why we use it

We use personal data only to:

sign you in and keep your account secure;
check that you work or worked at a company before you contribute about it;
publish contributions anonymously, and calculate ratings, salary ranges and other aggregates;
screen contributions for personal details, abuse and other problems before they go live;
send you the codes and alerts you ask for;
handle reports, disputes, grievances and legal requests;
prevent fraud, such as one inbox or one document verifying many accounts;
understand how BeforeJob is used, using counts and totals that do not identify anyone.

We do not sell or rent personal data. We do not use it for advertising, and we do not build profiles of you for anyone else.

5. Why we are allowed to use it

We rely on your consent under section 6 of the DPDP Act. We ask for it when you sign up, and again when you start a verification, with a clear notice of what we will do. You can withdraw consent at any time, as easily as you gave it, from your settings or through the grievance page. If you withdraw it, we stop the processing that depended on it. That may mean closing your account. It does not affect what we did before.

For a few things we rely on the legitimate uses in section 7 of the DPDP Act, mainly to comply with a law, or with a judgment, order or lawful request from a court or an authorised government agency.

6. Automated checks and AI

We use AI services for two jobs:

Screening: the text of a contribution is checked for personal names, contact details, threats, hate, confidential information and similar problems before it goes live.
Reading documents: an uploaded verification document is read to find the employer name and dates, and to spot signs of editing.

These services receive only what the job needs: the contribution text, or the document. They never receive your phone number. They process it on our instructions to return a result to us.

Automated checks do not have the final word on anything serious. When screening is unsure, a moderator decides. When a document check is unsure, a person on our verification team looks at it. If you think an automated check got it wrong, raise a grievance and a person will review it.

We share personal data only with service providers that process it for us (Data Processors under the DPDP Act), under contract:

Cloud hosting: runs our servers, database and file storage.
WhatsApp messaging gateway: delivers sign-in codes and alerts. It receives your mobile number and the message.
Email provider: delivers the emails you ask for. It receives your email address and the message.
AI processing: screens contribution text and reads verification documents, as described above.

Employers never receive personal data from us. They see published contributions and aggregates, like everyone else, plus survey and analytics results that never include groups of fewer than 5 people.

We share data with courts, regulators or law enforcement only when the law requires it, and only what a valid order covers. If BeforeJob is ever merged or sold, your data would move to the new owner only under this policy, and we would tell you first.

8. Where your data is processed

Some of our service providers may process data outside India. Section 16 of the DPDP Act allows this, except to countries the Government of India restricts. We do not transfer personal data to any restricted country, and we require our providers to protect it as this policy does.

9. How long we keep it

We keep personal data only as long as we need it for the purposes above, or as the law requires:

Mobile number and account settings: While your account is open. Wiped when you delete your account, unless a law or a lawful order requires us to keep it longer.
Sign-in codes: Stored only as a hash. They expire within minutes and cannot be reused.
Sessions: Up to 60 days, or until you sign out.
Verification documents: Until we make a decision, and never more than 72 hours after upload.
Verification record: Company, method, current or former, tenure band and coarse start and end months. While your account is open; deleted or anonymised when you delete it.
Work email fingerprint: Kept with the verification record it belongs to, so one inbox cannot verify many accounts, and deleted with it.
Contributions: While they are published. Removed content is hidden from everyone and kept for at least 180 days, as the IT Rules require for investigations.
Employer account details: While the employer account is active, and for as long as we need records of what the account did.
Grievances and reports: For as long as we need to handle them and to show that we handled them properly.

10. Cookies

We use only three cookies, all set by BeforeJob itself:

Session cookie (beforejob_session): keeps you signed in for up to 60 days. Scripts on the page cannot read it.
Theme cookie (theme): remembers whether you chose the light or dark look.
Deletion confirmation cookie (beforejob_account_deleted): set for 10 minutes after you delete your account, so we can confirm what happened to your contributions. Scripts on the page cannot read it.

We do not use advertising, analytics or third-party tracking cookies.

11. How we protect it

All traffic to BeforeJob is encrypted in transit.
Sign-in codes and session tokens are stored only as hashes.
Identity records and contribution records are kept apart, linked only through a key that needs a secret held on our servers.
Verification documents are deleted after a decision, and staff access to them is limited to the verification team.
Staff actions in our admin tools are recorded in an audit log.

No system is perfectly secure. If a personal data breach happens, we will inform the Data Protection Board of India and the people affected, as the DPDP Act requires.

12. Your rights

Under the DPDP Act you have the right to:

Access a summary of the personal data we hold about you, how we process it, and who we have shared it with (section 11).
Correct, complete or update data that is wrong or out of date (section 12).
Erase data we no longer need, or that you no longer consent to us keeping, unless a law requires us to keep it (section 12). This includes your contributions, which you can remove yourself.
Grievance redressal: a quick, fair answer to any complaint about how we handle your data (section 13).
Nominate someone to use these rights for you if you die or become unable to (section 14).
Withdraw consent at any time (section 6).

The Act also asks you not to impersonate anyone, not to hide information when giving data, and not to file false or frivolous complaints (section 15).

13. How to use your rights

In your settings: download a copy of what we hold about you, see your account details and verifications, change alert settings, and delete your account.
In My contributions: remove any of your contributions yourself. You can do this at any time, so we never need to know which ones are yours.
Through the grievance page: choose “Privacy or personal data” or “My account” for anything else, such as corrections, nominations or questions about how we use your data. We acknowledge within 24 hours and reply within 15 days.

Please do not tell us in a grievance which contributions you wrote. A grievance about your account is linked to your account, so naming your contributions there would connect them to you. Remove them yourself instead.

Because contributions are not stored against your account, only you can find yours, and only while you can still sign in. To erase them, remove them in My contributions, or choose “Delete them too” when you delete your account. After that, nobody can tell which contributions were yours.

If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

14. Children

BeforeJob is only for people aged 18 and over. We do not knowingly process the personal data of children. If we learn that an account belongs to someone under 18, we will close it and delete its data. If you are a parent or guardian and think your child has signed up, tell us through the grievance page.

15. Changes to this policy

We may update this policy as BeforeJob or the law changes. The date at the top shows the latest version. If a change affects how we use your data in a significant way, we will tell you before it takes effect and, where the law requires, ask for your consent again.