Privacy Policy

Account data: Name, email address, username, and hashed password when you sign up.

Profile data: Bio, college, skills, city, GitHub/LinkedIn/website URLs, profile picture, and banner image — all provided voluntarily.

Content: Posts, comments, projects, hackathon registrations, and job applications you create.

Usage data: Pages visited, features used, IP address, browser type, and device type — collected automatically for security and analytics.

Cookies: Session tokens (required for login), CSRF tokens (required for security), and an optional analytics cookie. See Section 8.

Service delivery: To provide your account, feed, project showcase, search, hackathon listings, and job board.

Security: To prevent fraud, spam, and abuse; to enforce our Terms of Service.

Communications: To send transactional emails (email verification, password reset). We do not send marketing emails without your consent.

Improvement: Aggregated, anonymised usage data helps us improve features and performance.

Legal basis (DPDP Act 2023): Processing is based on your consent given at signup and our legitimate interest in providing a secure, functional platform.

We do not sell your personal data to third parties.

We share data only with:

• Infrastructure providers: Hostinger (VPS hosting), Cloudflare (CDN/DDoS protection), Cloudinary (image storage) — bound by data processing agreements.
• Authentication providers: Google/GitHub OAuth, used only if you choose social login.
• Law enforcement: When required by a valid legal order under Indian law.

We retain your account data for as long as your account is active. If you delete your account, we delete your personal data within 30 days, except where retention is required by law.

Server logs containing IP addresses are retained for 90 days for security purposes.

Under the DPDP Act 2023, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data (via Settings → Edit Profile).
• Erase your account and associated data.
• Withdraw consent at any time (which may mean we can no longer provide the service).
• Grievance redressal — raise a complaint with our Data Protection Officer.

To exercise any right, email us at hello@nbfcjob.in. We will respond within 30 days.

We implement industry-standard security measures including:

• Passwords stored as bcrypt hashes (never in plaintext).
• All traffic encrypted via HTTPS/TLS 1.3.
• Rate limiting on all API endpoints to prevent brute-force attacks.
• CSRF protection on all state-changing requests.
• Content Security Policy headers to prevent XSS.
• Input sanitization before database storage.

No system is 100% secure. If you discover a vulnerability, please report it to hello@nbfcjob.in.

NBFCjob is not directed at children under 18. We do not knowingly collect personal data from minors. If you believe a child has registered, please contact us immediately.

We use the following cookies:

• he.session (essential): Your login session token. Required to use the platform. Expires after 30 days.
• he.csrf (essential): CSRF protection token. Required for security. Session-scoped.

We do not use third-party advertising or tracking cookies.

We may update this policy periodically. We will notify registered users by email and display a notice on the platform for material changes. Continued use after changes constitutes acceptance.

Data Protection Officer / Grievance Officer:
NBFCjob
Email: hello@nbfcjob.in

Complaints can be filed with the Data Protection Board of India once operational under the DPDP Act 2023.