Privacy Policy

1. Who we are

This policy explains how Gurpreet Singh Juneja (sole proprietor), trading as Invisipilot ("Invisipilot", "we", "us"), Tower S, Flat No. 1402, Paramount Emotions, Bisrakh, Uttar Pradesh 201306, India, handles personal data when you use invisipilot.com, the Invisipilot desktop app and related services. For the purposes of India's Digital Personal Data Protection Act, 2023 ("DPDP Act") we are the Data Fiduciary for this data.

This policy is in English. If you would like it in Hindi or another language listed in the Eighth Schedule to the Constitution of India, email support@invisipilot.com and we will send you a translation.

2. What we collect

• •Account data: your name, email address, password (stored hashed by our authentication provider) or Google sign-in details, and your referral code and payout details if you use the referral program.
• •Interview audio: audio is captured only while a session you started is running, and only from the sources you choose (the meeting tab or system audio, and your microphone). The meeting audio is streamed to our speech-to-text provider for live transcription; your microphone is recorded during the session and sent once at the end, to add your side to the saved transcript and notes. When the session ends, capture stops. We do not store the audio ourselves: only the text transcript is saved (section 7). Our speech-to-text provider processes the audio only to transcribe it and does not keep it afterwards.
• •Other people in your interview: your interview includes other people, such as the interviewer. Their voice in the audio you share is transcribed, and their words appear in your transcript and notes. We process this only to provide the service to you. Please use Invisipilot only where you are allowed to, and tell or ask the other participants where the law or the meeting's rules require it.
• •Transcripts and answers: the live transcript, the questions detected, the AI's answers, screenshots you capture for coding help, and the notes, score and summary created after a session.
• •Resumes and job descriptions: resume files or text, job descriptions and interview profiles you add, and ATS scores and rewrites.
• •AI request records: for each AI request (answers, notes, resume checks and rewrites) we record which AI model answered, how long it took, the size of the request and the reply, a one-way ID of the request (not the text itself), and an error code if it failed, so we can fix problems. The text you send and the text the AI returns are not kept in these records.
• •Purchases: pack, amount, currency, payment ID and status. Card, UPI and bank details are handled by the payment processors; we do not receive or store them.
• •Usage and device data: the pages you view and the buttons, settings and features you use on the website and in the desktop app; the country your IP address points to (we don't store the address itself here); your device type and operating system; and a random ID stored in your browser (or the desktop app's random device ID) so one visit's steps can be joined up.
• •If you are signed in, this usage data is linked to your account.
• •Usage data is designed not to include what was said in an interview, transcripts, answers, notes, resume or job-description text, your name, email or phone number, or passwords. We strip these out in your browser and again on our servers: free text is reduced to a length or a yes/no, and a detected question is kept only as a short code used to count repeats.
• •Where you came from: the campaign tags in the link you arrived on (utm_ parameters), the website that referred you and your landing page, kept in your browser for up to 90 days and attached to events and orders so we know which campaigns work. Ad-platform click IDs (such as gclid or fbclid) are kept only if you accept ad-measurement cookies (see section 6A).
• •Security data: your IP address and browser details, used to keep you signed in securely, to limit repeated requests and block abuse (these address-based counters are deleted automatically within a few days), and by the human check at sign-in (section 4).

3. Why we use it

We rely on: (a) the consent you give by creating an account, for providing the service, your account and payments; (b) your separate choice in the cookie banner, for analytics and ad-measurement cookies from Google and Meta; and (c) the uses the law permits without consent, such as keeping tax records or disclosing data when the law requires it (DPDP Act sections 7 and 8(7)). Basic usage data (section 2) is collected for every visitor, including those without an account, to keep the service working and improve it. You can ask us to stop linking it to you (section 8). We use each kind of data only for the purposes listed here. We never sell your personal data.

• •To provide the service: transcribe the interview, generate answers, notes and resume feedback, and keep your history and profiles.
• •To run your account and payments: sign-in, balances, purchases and referral payouts.
• •To keep the service secure: a human check at sign-in, sign-up and password reset, limits on how often a device can call our servers, and fraud and abuse prevention.
• •To understand how the product is used, fix problems and improve it, including the quality of answers (first-party usage data, section 2).
• •To send service emails, such as sign-up confirmation, sign-in links and receipts. We will only send you offers or product news if you have opted in, and each such email will let you unsubscribe.
• •To measure our advertising, only when ad measurement is switched on and only if you accept it in the cookie banner (section 6A).
• •To meet legal obligations, such as keeping tax records.

4. Who processes it for us

We share data with the service providers below, which process it on our behalf to run Invisipilot. The exception is Google and Meta for ad measurement: only if you accept it (section 6A), they use that data under their own terms, not just on our behalf.

• •Supabase — database and authentication.
• •Vercel — website and API hosting.
• •Deepgram — speech-to-text for interview and microphone audio.
• •Anthropic (Claude) and Google (Gemini) — generating answers, notes and resume feedback from transcript, resume and job-description text.
• •Razorpay (India) and Dodo Payments (outside India, as merchant of record) — payments.
• •Resend — sending account and service emails.
• •Cloudflare (Turnstile) — the human check on sign-in, sign-up and password-reset forms. It receives your IP address and browser and device signals in order to tell people from bots.
• •Google (Google Analytics) and Meta (Facebook) — website analytics and ad measurement, only when switched on and only if you accept them (section 6A).

5. Where it's stored

Our database is hosted in India (Mumbai). Several of our providers — including Vercel, Deepgram, Anthropic, Google, Meta, Cloudflare, Resend and Dodo Payments — process data outside India, mainly in the United States. We transfer data to them only for the purposes in section 3, and we follow any restrictions the Government of India sets on transfers to particular countries.

6. Cookies and similar technologies

Always used, because the site needs them or for our own first-party usage data: browser storage that keeps you signed in and remembers settings such as theme and shortcuts; a random ID ("ip_anon") that joins up the steps of a visit; a tab-only flag ("ip_nv"), cleared when you close the tab, so each news post view is counted once; the campaign you arrived from (section 2); your cookie choice; and, at sign-in, the human check described in section 4. We don't send these to advertising platforms. The exception is that, if you accept ad measurement, the address of the page you're on (which can include the campaign tags in it) and the click IDs described in section 2, including Meta's _fbc cookie, go to Google and Meta as described in section 6A.

Only with your consent: Google Analytics and the Meta Pixel, and the advertising cookies they set (such as _ga, _fbp and _fbc). They load only when ad measurement is switched on and you click Accept in the cookie banner. Until then, nothing from Google or Meta loads. They never load inside the desktop app or on sign-in-link, password-reset and payment-handoff pages.

Withdrawing consent is as easy as giving it: open Cookie settings in the footer and choose again. If you had accepted, the page reloads by itself so the tags stop straight away. A Global Privacy Control signal from your browser is treated as a refusal of Google Analytics and Meta tags. You can also clear cookies and site data in your browser at any time, which also resets the random ID; signing in again is all that's needed afterwards. If ad measurement is not switched on, there is no banner and no Cookie settings link, because there is nothing to consent to.

6A. Advertising measurement (only when switched on)

We may run ads on Google and Meta. To learn which ads lead to sign-ups and purchases, and only if you accepted cookies in the banner, we share the data below with them. If you decline, or never choose, none of it is sent and none of it is stored with your order. Google and Meta use it under their own terms and privacy policies; Meta may treat it as "sharing" for advertising (see section 8B). You can withdraw at any time in Cookie settings: that stops future sends but cannot recall what was already sent.

• •From your browser (Google Analytics and the Meta Pixel): the address of the pages you view and the page you came from, and events such as viewing pricing, starting a sign-up, completing a sign-up, starting checkout, purchasing (pack, amount and currency) and downloading the app. The tags never load on sign-in-link, password-reset or payment pages, and we remove sign-in and payment codes from the addresses we send to Google Analytics. Interview content, transcripts and resumes are never sent.
• •From our servers, for a sign-up or purchase you made after accepting (Meta Conversions API): a one-way hash (SHA-256) of your email address, account ID and country, Meta's browser and click cookies, your IP address and browser user agent, and the event details. This lets Meta count a conversion even when an ad blocker stops the pixel. The browser and server copies share one event ID, so Meta counts them once.
• •From our servers, for a purchase you made after accepting (Google Analytics Measurement Protocol): your Google Analytics browser and session IDs, your Invisipilot account ID, and the purchase details (pack, amount, currency, payment method type and payment ID).
• •To make those server-side sends possible, when you accept cookies and then start a checkout, your ad-measurement cookie IDs, IP address and browser user agent are stored with the order at our payment processor (Razorpay or Dodo Payments).

7. How long we keep it

We keep your account data, session history (transcripts and notes), interview profiles, resumes and resume scores for as long as your account exists, unless you delete them sooner (sessions and profiles can be deleted in the app). If you are not signed in, your session history is kept only in your browser. When you ask us to delete your account, we erase this data, except payment, payout and tax records we must keep by law.

Anonymized payment and money records are kept for 8 years from the end of the relevant financial year, as required for GST and income-tax records.

Usage events (section 2) are kept for as long as they help us run and improve the service. When your account is deleted, they are unlinked from it and no longer identify you through your account. Address-based request counters used to block abuse are deleted automatically within a few days. Our hosting and authentication providers keep their own request and sign-in logs (which include IP addresses and browser details) for a limited time under their own retention rules. Your browser keeps the campaign you arrived from for up to 90 days, and the random ID until you clear site data. Data held by Google, Meta, our speech-to-text and AI providers, or a payment processor is kept under their own retention rules.

7A. If there is a data breach

If personal data we hold is affected by a security breach, we will tell affected users without delay, by email or in the app, explaining what happened, what it may mean for you, what we are doing about it and what you can do. We will also report it to the Data Protection Board of India as the law requires. Questions: support@invisipilot.com.

8. Your rights

Under the DPDP Act you can ask for a summary of the personal data we hold about you and how we use it, have it corrected, completed or updated, have it erased, and withdraw your consent at any time. Withdrawal is as easy as giving consent: cookie consent through Cookie settings in the footer; sessions and interview profiles by deleting them in the app; and anything else, including deleting your account, by email. Withdrawal doesn't affect what we did before it, and withdrawing consent for the core service may mean we can no longer provide it. You can also nominate someone to exercise these rights for you if you die or become incapacitated. To make a request, email support@invisipilot.com from your account email (so we can confirm it's you), or tell us the random ID or details that identify you if you have no account. We will reply to rights requests within 30 days, and within 90 days at most for complex requests. If you are not satisfied, you can complain to the Data Protection Board of India (section 9).

8A. Children

Invisipilot is only for adults aged 18 or over. Please don't create an account or use the service if you are under 18. We don't offer accounts for children, so we don't collect parental consent. If we learn that someone under 18 has given us personal data, we will delete it and close the account. If you think this has happened, email support@invisipilot.com.

8B. Visitors outside India (EU, UK and US)

If you use Invisipilot from the European Union or the United Kingdom, we process your data on these legal bases under the GDPR and UK GDPR: to perform our contract with you (providing the Service and your account), our legitimate interests (keeping the Service secure, preventing fraud and fixing problems), your consent (analytics and ad-measurement cookies, which you can withdraw at any time), and legal obligations (such as keeping tax records).

You have the right to access, correct, erase or export your personal data, to restrict or object to how we process it, and to withdraw consent. Email support@invisipilot.com from your account email to make a request. You may also complain to your local data protection authority (for example the ICO in the UK).

Your data is processed in India and by the providers listed in section 4, some of which are in the United States and other countries. Where the law requires it, these transfers rely on safeguards such as the providers' standard contractual clauses.

California residents: we do not sell your personal information. If the Meta Pixel is enabled and you accept it, it may count as "sharing" for cross-context behavioural advertising under the CCPA/CPRA. You can opt out by declining in the cookie banner or through Cookie settings, and a Global Privacy Control signal is honoured as an opt-out. You can also ask us what personal information we hold about you and ask us to delete it.

9. Grievance officer

If you have a concern about how we handle your data, contact our Grievance Officer: Gurpreet Singh Juneja, support@invisipilot.com, Tower S, Flat No. 1402, Paramount Emotions, Bisrakh, Uttar Pradesh 201306, India. We will acknowledge your complaint within 48 hours and resolve it within one month. If it is complex, we will tell you why and resolve it within 90 days at most. You must try this route first; if you are not satisfied with our response, you may complain to the Data Protection Board of India through the online complaint facility it provides.

10. Changes

We will post any changes to this policy on this page and update the date below. For significant changes we will also tell you by email or in the app.

11. Governing law

This policy is governed by the laws of India. The courts at Noida (Gautam Buddh Nagar), Uttar Pradesh, India have exclusive jurisdiction over any dispute arising from it.