Privacy Policy

The TopDraft platform is operated by [registered entity name], with its registered office at [registered address] (“TopDraft”, “we”, “us”). For the purposes of India’s Digital Personal Data Protection Act, 2023 (the DPDP Act) we are the data fiduciary for the personal data described in this Policy.

This Policy covers topdraft.co.in and all related dashboards and services (the Platform). By creating an account, applying to join, or otherwise using the Platform, you consent to the collection and use of your information as described here. You can reach us any time at info@topdraft.co.in.

Account information (all users)

• Name and email address. If you sign in with Google, we also receive your Google account identifier and profile photo.
• If you register with an email and password, your password is handled entirely by our authentication provider (Google Firebase Authentication) and is never visible to us in plain text.
• Your role on the Platform (job seeker, startup, or administrator) and account status.

Early access applications

• Job seekers: name, age, city, email, LinkedIn URL, educational qualification, college, graduation year, chosen stream, and your written answers on what you have built, your view on startups, how you use AI, a failure story, and why you want to join a startup.
• Founders: full name, email, city, personal LinkedIn, company website, company name, startup description, current funding stage, team size, hiring timeline, and your written answers on the problem you are solving, why now, current traction, and why people should join you.

Job seeker profile

• Contact and identity: name, city, email, phone number, LinkedIn URL, portfolio URL, profile photograph.
• Background: undergraduate and postgraduate education, work experience, skills, languages, top achievements, and a written bio.
• Preferences: preferred roles, industries, cities, startup stages, work mode, and salary expectations.
• Right-to-work status, as declared by you.
• Files: your CV and your video pitch (a short self-introduction video), stored securely on our infrastructure.
• Availability status — for example, whether you are currently placed and no longer accepting outreach.

Startup profile

• Company details: name, website, company email, founding year, headquarters city, industry, stage, funding and investors, team size, office location, work mode, culture notes, perks, and logo.
• Founder or representative details: name, title, LinkedIn URL.
• Job listings: role details, requirements, compensation information, and any video pitch for the role or company.

Application, interview and placement records

• Your application answers and the outcome of our screening and personal interviews.
• Interests sent and received, application and pipeline status history, interview schedules and meeting links, and placement (hire) records.
• Notes recorded by our team in the course of operating the curated service.

Communications and technical data

• Messages you send us through the contact form, early-access requests, and support correspondence; plus in-app notifications generated by Platform activity.
• Authentication and session tokens, and the essential cookies needed to keep you securely signed in.
• Standard technical logs (such as IP address, browser and device information) generated by our infrastructure provider for security and reliability.
• We do not use third-party advertising trackers or third-party marketing analytics on the Platform.

• Directly from you— when you apply, build your profile, upload files, post roles, send interests, or contact us.
• Automatically— limited technical and session data generated when you use the Platform.
• From Google— if you choose Google sign-in, we receive your name, email address and profile photo from your Google account.

• To operate the curated Platform: reviewing applications, conducting personal interviews, and making admission decisions.
• To provide the core service: showing profiles and job listings to the relevant other side of the marketplace, matching, facilitating interests, scheduling interviews, and recording placements.
• To communicate with you: in-app notifications and transactional emails (application updates, interview scheduled, interest received, placement confirmed). We send transactional email only — we do not send third-party marketing on your behalf.
• To keep the Platform safe: verification, fraud prevention, moderation, and enforcement of our Terms & Conditions.
• To improve the service, using internal and aggregated information.
• To comply with law, and to establish or defend legal claims.

We do not sell your personal data, and we do not share it with advertisers.

Visibility inside the Platform

• Job seekers:once your profile is accepted and published, it — including your photograph, education, experience, skills, bio, CV and video pitch — is visible to verified startups so they can evaluate you for roles. Certain details, such as direct contact information, are surfaced in line with the Platform’s interaction flow, for example after mutual interest.
• Startups: your company profile, job listings and video pitch are visible to accepted job seekers.
• Our administrators access data as needed to run the curated service — screening, scheduling, support and moderation.

Service providers

• Google Firebase / Google Cloud— authentication, database, file storage (photographs, CVs, videos, logos) and application hosting.
• Resend— delivery of the transactional emails sent by the Platform.

These providers process data on our behalf under their own security and data-protection commitments. Interviews may take place over third-party video-meeting tools, which are governed by their own privacy policies.

Legal and business transfers

• We may disclose information where required by law, court order, or a competent authority, or to protect the rights, safety or property of TopDraft or others.
• If TopDraft is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction. This Policy will continue to apply, and we will give notice of any material change.

We use only essential cookies and browser storage — primarily those set by Firebase Authentication to keep you securely signed in and to protect your session. We do not use advertising or cross-site tracking cookies. You can control cookies through your browser settings, but blocking essential cookies will prevent you from signing in.

We retain your personal data while your account is active and for as long as needed for the purposes described in this Policy. If you delete your account or ask us to erase your data, we will delete or anonymise it within a reasonable period, except where we are required or permitted by law to retain it — for example, records needed for legal compliance, dispute resolution, or fraud prevention. Residual copies in secure backups are purged on our backup rotation cycle.

The Platform runs on Google Cloud infrastructure with encryption in transit (HTTPS). Access to personal data is restricted by role-based controls — job seekers, startups and administrators each see only what their role permits — and all sensitive operations are authorised on our servers. No method of transmission or storage is completely secure, but we protect your data using appropriate technical and organisational measures.

In the event of a personal data breach, we will notify affected users and the Data Protection Board of India as required by applicable law.

Where we notify you, we will describe, to the extent known at the time:

• the nature and extent of the breach;
• the personal data likely affected;
• the likely consequences;
• the measures we have taken or propose to take to mitigate risk; and
• steps you can take to protect yourself,

along with contact details for any further questions you may have.

Subject to applicable law — including the DPDP Act — you have the right to:

• Access— request a summary of the personal data we hold about you, how it is processed, and the identities of the third parties (including our service providers and, where applicable, other users) with whom it has been shared, along with a description of the data shared with each.
• Correction and updating— most of your profile is self-serve: you can review and edit it from your dashboard at any time. You may also ask us to correct inaccurate data.
• Erasure— request deletion of your account and personal data.
• Withdraw consent— where processing is based on consent, you may withdraw it at any time through your dashboard settings or by emailing info@topdraft.co.in, as easily as you gave it. Withdrawing consent does not affect the lawfulness of any processing carried out before withdrawal. Depending on what you withdraw consent for, this may mean you can no longer maintain a profile, appear to the other side of the marketplace, or use the Platform at all — we will tell you the specific consequence when you make the request.
• Grievance redressal— raise a complaint with our Grievance Officer (see below) and, if it remains unresolved, with the Data Protection Board of India.
• Nominate— nominate another individual to exercise your rights in the event of your death or incapacity, as provided by the DPDP Act.

To exercise any of these rights, use your dashboard settings or email info@topdraft.co.in. We will respond within the timelines prescribed by applicable law.

The Platform is intended for users aged 18 and above. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us personal data, contact us and we will delete it.

Your data is stored on Google Cloud infrastructure. Depending on the cloud regions used, data may be stored or processed on servers located outside India.

The Government of India may, from time to time, notify countries or territories to which transfer of personal data is restricted or prohibited under the DPDP Act. We will comply with any such restriction. Subject to that, wherever your data is processed, we protect it in accordance with this Policy and the contractual data-protection commitments of our infrastructure providers.

In accordance with applicable Indian law, our Grievance Officer’s details are:

• Name: [grievance officer name]
• Designation: [designation]
• Email: info@topdraft.co.in
• Address: [registered address]

We will acknowledge your grievance promptly and endeavour to resolve it within the timelines prescribed by applicable law.

Profiles and listings may contain links to third-party sites — for example LinkedIn profiles, portfolio sites, or company websites. Those sites are governed by their own privacy policies, and we are not responsible for their practices.

We may update this Policy from time to time. The “last updated” date at the top shows the current version. If we make material changes, we will notify you by email or through the Platform before they take effect. Your continued use of the Platform after the effective date constitutes acceptance of the updated Policy.

For any questions about this Policy or our data practices, email info@topdraft.co.in.