Privacy Policy

1. Who we are

Vrrity (vrrity.com) is operated by VritiCraft India, a sole proprietorship based in Gurugram, Haryana (no-944, sushant lok 1, C block,6,Gurugram, Haryana, 122001). For this policy, we are the “Data Fiduciary” under the Digital Personal Data Protection Act, 2023 (“DPDP Act”). We decide why and how your personal data is processed.

Questions about this policy: support@vrrity.com, or use our contact form.

2. What we collect

• Account details: name, email address and password (stored only as a secure hash by our authentication provider). If you sign in with Google, we receive your name, email and profile picture from Google.
• Your documents: everything you type into resumes, CVs, cover letters and the job tracker. That includes work history, education, skills, contact details, and anything else you choose to include.
• Profile photo, if you upload one, and any AI-edited version you choose to keep.
• Files you import: a resume you upload (PDF, Word or image) is read once to fill in your resume. We don't keep the file itself.
• Student verification, if you apply for student pricing: your institution details, a verification email address, and an image of your student ID. The ID image is deleted as soon as it has been reviewed.
• Payments: what you bought, the amount, GST, and the payment reference. Card, UPI and bank details are entered on Razorpay's secure checkout and never reach our servers.
• Support and reviews: messages you send us, and reviews you submit.
• Technical data: IP address and basic request information, used for security and abuse prevention (for example, limiting repeated sign-in attempts).

We don't use advertising trackers, and we don't sell or rent your personal data.

3. Why we use it

We process your personal data only for these purposes, on the basis of your consent and to provide the service you asked for:

• To create your account, save your documents, and let you edit, preview and download them.
• To run the AI features you choose to use (see the next section).
• To take payments, issue receipts and invoices, and meet tax and accounting obligations.
• To verify student status when you apply for student pricing.
• To answer support requests and send essential account emails (confirmation, password reset, receipts).
• To keep the service secure: preventing fraud, spam and abuse, and enforcing fair-use limits.

4. Information from Google sign-in

If you choose “Continue with Google” (or Google one-tap sign-in), Google shares only your basic profile with us: your name, email address and profile picture. We ask for no other Google permissions, so we can't see your Gmail, Google Drive, contacts or calendar.

• How we use it: to create your Vrrity account and sign you in, to show your name and picture in your account, and to send you service emails such as sign-up confirmations and payment receipts.
• Sharing: we don't sell it, use it for advertising or share it with anyone else. It's stored by our authentication and database provider (Supabase), listed above, only to run your account.
• Storage and deletion: it's kept for as long as you have an account. Delete your account in Account settings, or ask us at support@vrrity.com, and it's removed. You can also remove Vrrity's access at any time from your Google Account's security settings.

Vrrity's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

5. How AI features handle your content

AI features (writing help, job tailoring, cover letters, interview-prep kits, proofreading, smart import and photo enhancement) only run when you use them. When you do, the text or image needed for that request is sent to an AI model through OpenRouter, which routes it to the model provider (currently Anthropic for text and Google for images).

We send only what the feature needs. We don't use your documents to train AI models, and our AI account is set to exclude providers that train on or retain request data. AI output can be wrong, so always review it before you use it.

6. Who processes your data for us

We use these service providers (“Data Processors”) to run Vrrity. Each one only processes data on our instructions and under its own security commitments:

Some of these providers may process data outside India. Where they do, it is done under their contractual safeguards and only as allowed under the DPDP Act. We may also disclose data where the law requires it, for example to comply with a lawful order.

7. Cookies and storage on your device

• Sign-in cookies keep you logged in. They're essential and can't be switched off while you use an account.
• Referral cookie: if you arrive through a friend's invite link, we remember the code for 30 days so they get credit.
• Your browser's local storage keeps a draft of a resume you build before signing up, so your work isn't lost, plus small editor preferences (such as preview zoom) and your cookie choice. It stays on your device until you sign up or clear it.
• Draft handover: when you move a resume from the Resume Checker, an import or the guided builder into the editor, or into a new account, we hold that draft on our servers for up to 24 hours so it arrives intact. It's deleted as soon as the editor opens it. A cookie (vr_gd) ties the draft to your browser, so nobody else can open it.
• Google one-tap sign-in (optional): only if you choose “Allow Google sign-in” in our cookie notice, we load Google's sign-in script so Google can offer “Continue as …”. Google may then set its own cookies under its privacy policy. If you choose “Essential only”, the script isn't loaded. The regular “Continue with Google” button works either way.
• Analytics (optional): only if you tick “Analytics” in our cookie notice, we load Google Analytics to count which pages are visited and how people find us. It sets Google Analytics cookies (_ga) on our site. We don't send your name, email or resume content, we strip codes and tokens from the page addresses we report, and advertising features and Google signals are switched off. Untick it at any time and it stops, and its cookies are removed.
• Fonts are served from our own site, so loading a page doesn't contact Google Fonts.

We don't use advertising or cross-site tracking cookies, and analytics runs only if you allow it. You can change your choice at any time with Cookie settings at the bottom of every page.

8. Job Clipper browser extension

The optional Vrrity Job Clipper extension for Chrome and Edge saves a job you're viewing to your job tracker.

• What it reads: only the page in the tab you click it on, and only when you click it. It reads the job title, company, location, description and the page's link, plus any text you've selected. It doesn't run in the background, read other tabs or access your browsing history.
• What it sends: only the job details you choose to save, shown to you first, which are added to your tracker like any job you add yourself.
• Connection code: the code you create in Account is kept in the extension's storage in your browser. On our side we store only a scrambled (hashed) copy, with the browser name and when it was created and last used. A code can only add jobs; it can't read your resumes or account. Disconnect any time from Account or the extension.

We don't use job data from the extension for advertising, and we don't sell it.

9. How long we keep it

• Account and documents: until you delete them or delete your account.
• Student ID images: deleted as soon as they've been reviewed. We keep only the outcome and dates.
• Imported files: not stored. They're read once and discarded.
• Payment and invoice records: kept for as long as Indian tax and accounting law requires (currently up to 8 years), even after you delete your account. These records are no longer linked to your account.
• Support tickets: kept so we can handle follow-ups and disputes. Your name and email are removed from them when you delete your account.
• Security logs: kept for a short period, then deleted.

10. Your rights

Under the DPDP Act you can:

• Access a summary of the personal data we hold about you and how it's processed.
• Correct or update your data. Most of it you can edit yourself in your account and documents.
• Erase your data. Delete any document at any time, or delete your whole account from Account settings. This removes your documents, photos and profile immediately.
• Withdraw consent at any time by deleting your account. This doesn't affect processing that already happened.
• Nominate someone to exercise these rights on your behalf if you die or become unable to act.
• Raise a grievance with us (below). If you're not satisfied with our response, you can complain to the Data Protection Board of India.

To make any request, contact us from the email linked to your account. We may need to verify that the request comes from you.

11. How we protect your data

Data is encrypted in transit (HTTPS) and at rest. Every user's documents are kept separate at the database level, so one account can't read another's. Photos and ID images sit in private storage. Access to the admin tools is restricted and checked on every request. Sign-in, uploads and AI use are rate-limited to stop abuse.

No system is perfectly secure. If a personal data breach affects you, we will tell you and the Data Protection Board as the DPDP Act requires.

12. Children

Vrrity is meant for people aged 18 and over, and for students who are at least 18. We don't knowingly process personal data of children (under 18) without verifiable parental consent. If you believe a child has signed up, contact us and we'll delete the account.

13. Grievance Officer

As required by the Information Technology Act, 2000, its Rules, and the DPDP Act, you can contact our Grievance Officer:

• Name: Ms Nidhi Rani
• Email: support@vrrity.com
• Address: no-944,sushant lok 1, C block,6, Gurugram, Haryana, 122001

We acknowledge grievances within 24 hours and aim to resolve them within 15 days.

14. Changes to this policy

If we change this policy, we'll update the date at the top. For significant changes, we'll also tell you by email or in the app before they take effect.