Privacy Notice

NOTAGHOST.JOBS (OPC) PRIVATE LIMITED, Bengaluru · effective 6 November 2026 · replaces the notice of 2 November 2026

1. Who is responsible

The data fiduciary is NOTAGHOST.JOBS (OPC) PRIVATE LIMITED (CIN U78100KA2026OPC229345), 303, Kemps Avenue, Vidya Nagar, Pai Layout, Krishnarajapuram R S, Bengaluru 560016, Karnataka, India — human@notaghost.jobs. This notice covers notaghost.jobs, the Ghosted Chrome extension, our WhatsApp number +91 88679 06787 and our Telegram channel (the "Service").

2. What we collect, why, and for how long

We do not collect your name unless it appears in your résumé; we do not collect email for sign-in; we do not read your contacts, location, calendar, photos, or anything on your device beyond what you give us; and we do not profile you for advertising.

3. Consent and purpose

We process your personal data on your consent, given when you sign in, message us on WhatsApp, upload a résumé, answer a question, or make a purchase — each for the specific purpose stated at that moment and in the table above. We do not use your data for any purpose beyond those without asking first. You may withdraw consent at any time by removing your résumé in the product or deleting your account (section 14); withdrawal does not affect processing already done, and we keep what the law requires us to keep (payment records). Where the law permits processing without consent — for example to comply with a legal order, or to respond to a request you make — we rely on that instead.

4. What we never do

• We never share your résumé, your answers, your number or your messages with employers, recruiters, job boards, advertisers, data brokers, or anyone else, except the processors in section 5 who act only on our instructions.
• We never sell personal data, and never will.
• We never apply, message or act on your behalf anywhere.
• We never use your résumé to train a model. The language model we use is an API service contractually prohibited from training on our data.
• We never publish anything that identifies a person: counts and anonymised examples only. The one employer example on our site is a real check of a real posting, named only because the role was hiring.
• We never send marketing messages on WhatsApp without a separate opt-in, and never message anyone who has not messaged us or signed in first.

5. Who processes data for us

These providers handle data on our instructions, under contracts that limit use to our purposes:

6. Where data is stored

Our database and files are stored on Supabase infrastructure in the Asia-Pacific region, and processed by our servers on Render. The language model, payment and messaging providers above process data on servers that may be outside India for the duration of each request. Such transfers are to countries not restricted by the Central Government under the DPDP Act, under contracts that require protection equivalent to this notice.

7. Cookies and browser storage

We do not use advertising or analytics cookies and we do not use third-party trackers. The site stores in your browser: the anonymous identifier (section 2); the source tag of the link you arrived on; and, after sign-in, a session token. These are first-party, are not shared, and are cleared when you clear site data. The site is installable as a home-screen app; installing it stores nothing additional about you.

8. The Chrome extension

The Ghosted extension runs only on job-posting pages of the boards it supports (LinkedIn Jobs, Naukri, Indeed, Shine, iimjobs, hirist, Foundit, Michael Page, Glassdoor, Instahyre, Wellfound, Cutshort). It reads only the posting you are looking at — its text and address — and sends that to our service to produce the verdict. It never reads your profile, messages, connections, feed, other tabs or browsing history; nothing runs in the background; it automates nothing and acts for no one. It stores two things locally: the anonymous identifier, so your free checks can be counted without a sign-in, and, if you sign in from its panel, your session token. Neither is shared with anyone. Removing the extension deletes both. The extension does not sell or transfer user data, does not use it for advertising or creditworthiness, and uses it for no purpose other than the check you asked for, in line with the Chrome Web Store User Data Policy and its Limited Use requirements.

9. WhatsApp and Telegram

WhatsApp. Our number is a verified business account on Meta's WhatsApp Business Platform. When you message it we receive your number, your profile name as WhatsApp shows it, and the message. Your number becomes your Ghosted account under this notice. We reply to what you send; we send sign-in codes, receipts and document-ready notices because you asked for them; and we may send one follow-up within an hour of a first message that contained no job link. We send no marketing without a separate opt-in. Reply STOP to stop everything except messages you expressly request. Meta processes WhatsApp messages under its own terms; messages between you and us are end-to-end encrypted in transit to the platform and visible to us as the business you messaged.

Telegram. Our channel is one-way. We see only the public subscriber count. We never collect Telegram usernames or message Telegram users first.

10. Job postings and employer data

Our reader collects publicly available job postings from employers' own careers systems every day, and from job boards only when a user hands us a posting. We read openly under an identified user agent, honour robots rules and rate limits, never sign in anywhere, and store posting data only: title, employer, location, dates, text, and whether the posting is still present. This is information about roles, not about people. If a posting contains personal data (a recruiter's name or email, say), we do not extract or publish it. Recruiters or site operators who want to discuss our reading of their pages can write to human@notaghost.jobs.

11. What we publish

Every figure on our site, in our Telegram channel and in our posts is a count from our database — number of postings, employers, roles live, roles vanished — and never identifies a person. Reply-rate signals used in verdicts are aggregated across many users and never attributable to one. We never name an employer as ghosting.

12. Security

Data is encrypted in transit (TLS) and at rest. Access to production data is limited to the people who operate the Service and is logged. Sign-in uses one-time codes; we hold no passwords. Résumé files are stored in private storage reachable only through signed, expiring links. Secrets are held in the hosting platform's secret store, never in code. We review access and dependencies regularly. No system is perfectly secure; section 16 says what we do if ours fails.

13. Your rights

Under the Digital Personal Data Protection Act, 2023 you may, at any time and free of charge:

• Access — ask what personal data we hold about you, what we do with it, and who has processed it.
• Correct and update — fix anything inaccurate; your résumé and answers can be changed in the product at any time.
• Erase — have your personal data deleted (section 14), subject to what the law requires us to keep.
• Withdraw consent — as easily as you gave it, by removing your résumé or deleting your account.
• Grievance redressal — raise a complaint with our Grievance Officer (section 17) and, if unresolved, with the Data Protection Board of India.
• Nominate — name a person to exercise these rights for you if you are unable to.

Write to human@notaghost.jobs or message our WhatsApp number from the number on your account. We verify requests against the account's number and respond within 30 days, usually much sooner.

14. Deleting your data

You can remove your résumé from inside the product at any time, which deletes the file, its text, the profile, previews and delivered documents within 24 hours. You can ask for your whole account to be deleted by email or WhatsApp from the number on the account; the number, messages, events and anonymous identifier are then deleted or irreversibly detached within 24 hours. Payment records remain for 8 years as accounts and tax law require, and are used for nothing else. Posting data is not personal data and is not deleted. Deletion ends any active plan without refund of its unused part, as the Terms explain, so delete after your shots are used.

15. Children

The Service is for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has used the Service, write to us and we will delete the data.

16. If something goes wrong

If personal data is ever lost, exposed or accessed without authority, we will tell every person affected and the Data Protection Board of India without delay and within 72 hours of becoming aware, in plain words: what happened, what data, what we did, and what you can do.

17. Grievance officer and the Board

Karthikeyan Ramakrishnan, Grievance Officer
NOTAGHOST.JOBS (OPC) PRIVATE LIMITED, 303, Kemps Avenue, Vidya Nagar, Pai Layout, Krishnarajapuram R S, Bengaluru 560016
human@notaghost.jobs · WhatsApp +91 88679 06787

We acknowledge every grievance within 48 hours and resolve it within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India under the DPDP Act, 2023.

18. Changes to this notice

We will update this notice as the Service changes. The effective date at the top changes when we do, and we announce material changes in the product or on WhatsApp before they take effect. Earlier versions are available on request.