Data Retention, Deletion and Backups
Lifecycle policies for original CVs, OCR text, candidate snapshots, and database records.
This policy draft is tailored to AI Tathastu's verified architecture and engineering practices. Under India's phased legal framework (Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025), substantive obligations commence in scheduled tranches.
Any item labelled with an [Awaiting Verification] tag designates operational data (such as formal legal entity name, designated grievance officer contacts, or vendor contractual tiers) reserved for verified business confirmation. This platform makes no unverified certification claims.
1. Principle#
We keep information only as long as appropriate for documented service operations and applicable legal or security obligations. A file being stored for technical processing does not mean it is permanently part of a confirmed student profile. We do not guarantee instant removal from logs, backups or independent third-party systems.
2. Categories to be disclosed before publishing#
| Category | Why held | Retention trigger and verified period |
|---|---|---|
| Original CV upload and copies | Parsing/retry/user evidence | Awaiting Verification: retention from upload, deletion and retry flows |
| OCR text, page layouts, raw extracts | Structure extraction and review | [VERIFY] |
| Suggested/profile review candidates | Student verification and provenance | [VERIFY] |
| Confirmed profile records | Continuing profile function | [VERIFY] |
| Evidence/verification and audit records | Integrity and legal/security accountability | [VERIFY] |
| External integration tokens | Authorized integrations | [VERIFY; immediate access revocation handling] |
| Sync results/cache | Connector operation | [VERIFY] |
| AI inference prompts/outputs | Enrichment/tutoring where authorized | [VERIFY app logs + contract/provider tier] |
| Sessions and browser state | Security and preferences | [VERIFY actual cookie/storage lifetimes] |
| Security/incident logs | Incident response and legal duties | [VERIFY CERT-In applicability and India log-storage requirement] |
| Backups and archives | Disaster recovery | [VERIFY rotation and expiry] |
3. User controls#
A user can use supported controls to delete a CV, edit accepted claims, disconnect sources, request correction or close an account. These actions have different scope and may not automatically erase all derived or independently verified records. See Your Rights.
4. Exceptions#
Some records may need to be preserved for legal, security, contractual or dispute-resolution purposes with access restrictions. The current DPDP Rules and commencement dates must be evaluated by counsel for log/data retention and erasure obligations; these are not an instruction to preserve full resumes for any general fixed number of years.
5. Deletion requests#
Send to Awaiting Verification: contact. We will verify the requester, identify affected stores/providers, document actions and explain exceptions. Do not promise a precise service-level deadline until it is implemented and legally reviewed.