Privacy Policy

Last updated: May 2026 · Effective from launch date

1. Data Controller

ACED ("we", "us", "our") is the data fiduciary for all personal data processed through this platform at aced.to. For questions about this policy or your data rights, contact us at nu.acedit@gmail.com.

2. What Data We Collect

We collect only what is necessary to provide the service:

• Identity data: Your name and email address, obtained via Google OAuth when you create an account.
• Resume content: The PDF or DOCX file you upload, and the structured text parsed from it.
• Score data: The 5 diagnostic scores generated for each resume you upload, including gap analysis.
• Generated resumes: The AI-engineered resume we produce if you purchase a credit.
• Payment data: Razorpay order and payment IDs for transaction records. We do not store card numbers or bank details — these are handled entirely by Razorpay.
• Usage data: Credit transaction history, referral code activity, and session tokens.

3. How We Use Your Data

• To score your resume and generate diagnostic reports.
• To produce AI-engineered resumes when you request them.
• To process payments and maintain your credit balance.
• To authenticate your account via Google OAuth.
• To aggregate anonymised score statistics for platform-wide percentile calculations.

We do not sell your data. We do not use your resume content to train AI models. We do not send marketing emails.

4. Data Retention

• Uploaded resume files: Permanently deleted after 30 days from upload date. This runs automatically via a nightly cron job on our servers.
• Parsed resume text and scores: Retained until you delete your account.
• Generated resumes: Retained until you delete your account.
• Payment records: Retained for 7 years to comply with Indian financial regulations (GST Act).

5. Third-Party Services

• Google OAuth: Used for authentication. Google's privacy policy applies to data Google collects.
• Razorpay: Processes all payments. Card and bank data never touches ACED servers. Razorpay's privacy policy applies.
• Anthropic Claude API: Your resume text is sent to Anthropic's API for scoring and generation. Data sent via API is not used to train Anthropic models per their API terms.
• Vercel: Hosts our Next.js application. Resume files are never stored on Vercel — they are forwarded to our VPS.

6. Your Rights Under the DPDP Act 2023

As a data principal under the Digital Personal Data Protection Act, 2023, you have the following rights:

• Right to access: Request a complete copy of all personal data we hold about you.
• Right to correction: Request correction of inaccurate personal data.
• Right to erasure: Request deletion of your account and all associated data (except payment records retained for legal compliance).
• Right to grievance redressal: Lodge a complaint with our grievance officer if you believe your rights have been violated.

You can exercise these rights directly from your dashboard, or by emailing nu.acedit@gmail.com.

7. Security

All data is transmitted over HTTPS. Resume files are stored outside web-accessible directories with UUID-based naming to prevent enumeration. API routes are protected with session-based authentication and HMAC signature verification for payment webhooks. We apply rate limiting on sensitive endpoints.

8. Grievance Officer

As required under the DPDP Act, 2023, you may raise a grievance with:

9. Changes to This Policy

We will notify registered users by email of any material changes to this policy at least 7 days before they take effect.