Privacy Policy

This policy explains how Scrapwhiz, a business operating from India, handles personal data across scrapwhiz.com, the Scrapwhiz Shop, Resume Studio, Job Publisher, contact forms, customer accounts, support, sourcing, partnerships and related communications. Scrapwhiz acts as the data fiduciary or controller for the processing described here.

1. Data we collect

• Contact and business data: name, email, mobile number, company, country, role, website, enquiry topic and message.
• Account data: email address, display name, authentication events, OAuth provider and account identifiers. Sign-in may use email, Google or LinkedIn OpenID Connect. Scrapwhiz does not receive your Google or LinkedIn password.
• Resume Studio data: résumé profile, employment, education, skills, projects, certifications, target roles, job descriptions, match reports, tailored versions, letters, portfolio content, public portfolio slug and domain request. Creation, import, editing and export require a separate Resume Studio account. Signing out clears private app state from the current tab.
• AI processing records: the processing choice, notice and policy version, processor and model, file type, file size, one-way file hash, status, timing, token counts and review-warning count. Scrapwhiz does not store the original AI-uploaded file or extracted résumé content in this processing log.
• Job Publisher data: company name, domain and website; poster name, sign-in email and LinkedIn profile; stakeholder work-email or LinkedIn references; job details and official application link; verification route and status; private review notes; and administrator review actions. Recruiter contact data, evidence and review notes are not included in the public jobs feed.
• Order and fulfilment data: selected products, size or option, price, delivery address, order history, supplier route, courier, AWB, tracking link, returns and support records.
• Payment metadata: Razorpay order ID, payment ID, payment status, product entitlement, amount, currency and verification time. Razorpay collects the card, CVV, UPI PIN, bank-login and other payment credentials inside its hosted checkout. Scrapwhiz does not receive or store those credentials.
• Technical and security data: IP address, browser and device information, timestamps, request metadata, rate-limit counters, error records and security events.
• Content you submit: artwork, product links, photographs or documents supplied for custom products, sourcing, returns, recruitment, Resume Studio, Job Publisher or service delivery.

Fields marked required are needed to provide the requested service. Please do not send passwords, API keys, government identifiers, health records or unrelated sensitive data.

2. Why we process data

We process data to answer enquiries, create accounts, import and edit resumes, rank role relevance, create user-requested drafts, publish a portfolio only when instructed, verify job posters, route personal-email requests for manual review, notify the private approval queue, review and publish approved jobs, provide paid entitlements, form and perform contracts, verify payments, prevent fraud, fulfil and track orders, handle returns, deliver professional services, operate security controls, keep accounting and tax records, defend legal claims and meet legal duties. Where GDPR applies, the legal bases are contract, legal obligation, legitimate interests and consent, depending on the purpose. Where India’s Digital Personal Data Protection Act applies, processing is based on consent or a permitted legitimate use. We do not sell personal data or use it for behavioural advertising.

2A. AI résumé parsing notice and choice

AI parsing is optional. If you select it, the uploaded PDF, DOCX or TXT and the résumé information inside it are sent through Scrapwhiz’s authenticated server to OpenAI’s API solely to identify contact, experience, education, skills, projects, certifications, languages and awards and return an editable structure. The request tells the provider not to store the response. Scrapwhiz does not place the original upload in its database or file storage. The private browser reader remains available when you do not want third-party AI processing.

Before an AI upload, Scrapwhiz shows a standalone notice and requires an affirmative processing choice and confirmation that the user is at least 18 and authorised to process the file. Optional product analytics is a separate, unchecked choice. The consent record identifies the purpose, notice version, provider, model and time. You can withdraw future AI processing or optional analytics in Resume Studio’s “Privacy and my data” screen as easily as you granted it. Withdrawal does not undo processing already completed. A later AI upload requires a new affirmative choice.

OpenAI may process technical service and abuse-monitoring data under its API terms, contractual controls and the account’s data-retention settings. Do not upload government identifiers, health data, financial credentials or unrelated sensitive information. AI extraction can be wrong. Review every field before saving, exporting, publishing or applying.

3. Payment and PCI scope

Razorpay hosts the payment-entry interface. Scrapwhiz receives payment tokens and transaction metadata needed to verify an order. Do not send card or banking credentials by email, WhatsApp, support form or any Scrapwhiz field.

4. Sharing and processors

We disclose only the data needed for a defined purpose to hosting and infrastructure providers, Supabase for database and authentication, OpenAI for an AI résumé parse you explicitly request, Razorpay for payment processing, Substack for newsletter signup and delivery, email or messaging providers, print-on-demand and product suppliers, couriers, professional advisers, fraud-prevention providers and authorities where law requires it. Suppliers and couriers receive only the order and delivery data needed for fulfilment. Each provider also applies its own privacy terms.

5. International transfers

Some providers may process data outside your state or country. Where GDPR applies, Scrapwhiz relies on an adequacy decision, approved contractual safeguards or another lawful transfer mechanism. Transfers from India remain subject to restrictions notified under Indian law.

6. Retention schedule

We may shorten these periods when data is no longer needed. A legal hold, chargeback, fraud investigation, tax duty or court process may require longer retention.

7. Your rights and choices

Depending on the law that applies, you may request access or a summary, correction, completion, erasure, restriction, portability, objection, withdrawal of consent and information about recipients. You may nominate another person where Indian law provides that right and complain to the Data Protection Board of India or an EU/EEA supervisory authority. Withdrawal does not affect processing already completed or records we must keep.

Resume Studio users can download an account export, withdraw optional processing choices and submit an erasure request from “Privacy and my data”. You may also send a request from the email linked to the record. We may verify identity and ask for the order or enquiry reference. We target a response within 30 days and will communicate any lawful extension.

8. Children

Resume Studio and AI résumé parsing are for people aged 18 or older. A person under 18 must not create a Resume Studio account or upload personal data. Other website and shop use by a child requires a parent or lawful guardian where permitted by law. Tell us if you believe a child’s data was submitted without proper authority.

9. Cookies and browser storage

Scrapwhiz currently uses only storage needed for the bag, account session, security and requested features. Resume Studio uses session storage for private in-tab workspace state and Supabase for the signed-in account. Public website footers load a Substack signup frame; Substack receives the technical request data needed to display and operate that frame and applies its own privacy terms. Scrapwhiz does not run cross-site behavioural advertising. Optional product analytics remains off unless selected separately. If other non-essential analytics or advertising technology is added, consent controls will be introduced where required.

10. Security and incident handling

Controls include encrypted transport, restricted administration, row-level database permissions, server-side price and payment verification, signed webhooks, rate limits, input limits, content security policy, backups, logging and vendor review. Access is limited by role and business need. No online service can promise zero risk. When a personal-data breach requires notice, Scrapwhiz will notify affected people and the competent authority within the period required by applicable law.

11. Automated decisions

Scrapwhiz does not make solely automated decisions that produce legal or similarly significant effects. Resume scores, keyword comparisons, job-match rankings and draft suggestions are decision-support outputs, not hiring decisions or guarantees. A domain check routes job posters into either the business-domain flow or a mandatory manual-review flow; a Scrapwhiz administrator decides whether a poster or job is approved. Users choose what to apply, publish or send. Fraud and security signals may pause a transaction for manual review.

12. Job links and external websites

Job listings link to official employer or authorised applicant-tracking pages. Scrapwhiz does not receive an application submitted on those external sites unless you separately provide it to Scrapwhiz. External sites control their own processing.

13. Grievance and privacy contact

Scrapwhiz Privacy and Grievance Desk
Shakti Corner Apartments, 8th Cross, 5th Main, Malleshpalya
New Thippasandra Post, Bengaluru, Karnataka 560075, India
hello@scrapwhiz.com
+91 88613 36782

Email is the primary channel for rights requests. Put “Privacy Request” or “Grievance” in the subject and include only the information needed to locate the record.

14. Changes

Material changes will be posted on this page with a new effective date. When law requires fresh consent, Scrapwhiz will request it before the new processing begins.