Privacy Policy

1. Who We Are

RightKnock is a personal job-search and referral-outreach assistant that helps job seekers in India discover job openings, identify relevant decision-makers, and send personalised referral emails through their own Gmail account.

RightKnock is operated by: [LEGAL ENTITY / REGISTERED NAME REQUIRED], with its registered address at [REGISTERED ADDRESS REQUIRED].

For all privacy-related questions or requests, contact us at: [PRIVACY CONTACT EMAIL REQUIRED]

2. Information We Collect

2.1 Account and Profile Information

When you sign in with Google, we receive and store:

• Your name and email address as provided by Google OAuth
• Your Google profile picture URL (used only for display purposes)
• A unique user identifier derived from your Google account

2.2 Career Profile and Preferences

You may voluntarily provide:

• Professional headline (e.g. "Backend Engineer")
• Target job titles and locations for your job search
• Skills list used to calculate match scores
• Years of experience per career track
• Work style preference (remote, hybrid, on-site)
• Career tracks — separate configurations for different job-search goals

2.3 Resume Documents

If you upload a PDF resume, it is stored on RightKnock's servers, associated with your account, and isolated per user. We use your resume text to calculate job-fit scores and attach the PDF to outreach emails you approve.

2.4 Job and Opportunity Data

RightKnock discovers job listings from public sources (currently primarily Indeed India) and stores them associated with your account. This includes job title, company, location, salary range where listed, job description text, and the source URL.

2.5 Contact and Referral Discovery Data

For jobs you choose to pursue, RightKnock attempts to identify relevant decision-makers from publicly available information. Data collected may include name, inferred role/department, publicly available LinkedIn profile URL (where found), inferred or verified business email address, and a confidence score. Only contacts with sufficient confidence can receive outreach through RightKnock.

2.6 Gmail / Google API Data

When you connect your Gmail account, RightKnock stores an encrypted OAuth refresh token to send emails and detect replies on your behalf:

• Your Gmail address used for outreach
• An OAuth 2.0 refresh token, stored encrypted at rest using AES-256-GCM encryption
• Thread IDs and message IDs for outreach emails you approve and send
• Brief message snippets from reply threads, used only to detect if a decision-maker has responded

RightKnock does not read, store, index, or analyse the full content of your general inbox. Access is scoped strictly to the outreach threads that RightKnock has sent.

2.7 Outreach and Approval Records

RightKnock maintains a record of every outreach email drafted, approved, and sent, including the draft text, subject, recipient, approval timestamp, and send status. This enables activity tracking and prevents accidental duplicate sends.

2.8 Session and Authentication Data

When you sign in, a session token is stored as an HttpOnly cookie. The session record includes a hashed token, a CSRF token, and an expiry timestamp. Sessions expire and are invalidated on sign-out.

2.9 Billing and Payment Data

If you subscribe to a paid plan, RightKnock records the subscription tier, currency, and status. Payment processing is handled by a third-party payment gateway. RightKnock does not store full payment instrument details on its own servers.

2.10 Audit and System Logs

RightKnock maintains internal audit logs of key actions (emails sent, approvals granted, job discoveries) for reliability, debugging, and security. These logs may reference your user ID, the action taken, and a timestamp.

3. How We Use Your Information

• Providing the service: Discovering jobs, scoring fit, identifying contacts, drafting outreach emails, and sending approved emails through your Gmail account.
• Personalisation: Tailoring job matches and outreach copy to your career profile, target roles, skills, and experience.
• Reply detection: Monitoring thread replies to notify you of recruiter responses.
• Account management: Maintaining your session, preferences, career tracks, and subscription status.
• Safety and abuse prevention: Enforcing daily email limits, cooldown periods, and human-approval requirements to prevent misuse.
• Service improvement: Understanding aggregate usage patterns to improve the product. We do not sell your personal data.
• Legal compliance: Retaining records as required by applicable law.

4. Google API Services — Limited Use Disclosure

Information received from Google APIs is used only to:

• Send outreach emails that you have personally reviewed and approved, from your own Gmail account to recipients you have selected
• Detect replies to those outreach threads, to notify you of recruiter responses
• Identify your name and email address for account creation and display

RightKnock does not use Google user data to:

• Serve targeted advertising
• Train or improve general-purpose AI or machine learning models
• Sell, share, or transfer to third parties for purposes unrelated to providing the RightKnock service
• Read, index, or process inbox messages beyond the specific outreach threads RightKnock has sent

Human access to Google user data is limited to cases where: (a) you have given explicit permission; (b) it is necessary for security or legal compliance; or (c) it is required to diagnose a technical issue you have reported, and only to the minimum extent necessary.

5. Third-Party Services

• Google OAuth 2.0 / Gmail API — for sign-in and email outreach. Governed by Google's Privacy Policy.
• Public job boards (e.g. Indeed India) — job listing data is fetched from public sources.
• Payment gateway — [PAYMENT GATEWAY NAME REQUIRED] — for processing subscription payments.
• Hosting and infrastructure — [HOSTING PROVIDER REQUIRED].

RightKnock does not currently use any third-party AI or large language model services. All job-fit scoring and email template rendering are performed locally and deterministically on RightKnock's own infrastructure.

6. Data Retention

• Account and profile data: Retained while your account exists.
• Resume files: Retained while your account exists. You can delete uploaded resumes from your profile settings.
• Outreach and audit records: Retained to provide activity history and prevent duplicate sends.
• Session data: Sessions expire after a period of inactivity and are deleted on sign-out.
• Gmail OAuth tokens: Deleted from our database when you disconnect your Gmail account. We also recommend revoking access from your Google Account security settings to fully revoke RightKnock's access at the Google level.

7. Security

We take reasonable technical measures to protect your data, including:

• OAuth refresh tokens encrypted at rest using AES-256-GCM with a unique random initialisation vector per token
• Server-managed sessions with HttpOnly, Secure, and SameSite cookie attributes
• CSRF token protection for all state-changing requests
• HTTPS encryption for all data in transit
• Rate limiting on sensitive endpoints
• Parameterised SQL queries to prevent injection attacks

No system is completely secure. While we implement strong protections, we cannot guarantee absolute security against all threats.

8. Your Rights

Under applicable Indian data protection law, you have the right to access, correct, and request deletion of your personal data, and to withdraw consent for data processing at any time.

• Access and correction: View and update your profile information within your RightKnock account settings.
• Gmail disconnection: Disconnect your Gmail account from within account settings at any time.
• Resume deletion: Delete uploaded resumes from your profile settings.
• Account and data deletion: To request deletion of your account and associated personal data, please email [PRIVACY CONTACT EMAIL REQUIRED] with the subject line "Account Deletion Request." We will process your request and confirm completion. Note that some anonymised audit records may be retained for legal and operational integrity purposes after account deletion.

Self-service account deletion is not currently available directly in the RightKnock interface. All deletion requests are handled by our team on written request.

9. Children's Privacy

RightKnock is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal data, please contact us and we will take steps to delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. Your continued use of RightKnock after changes take effect constitutes acceptance of the revised policy.

11. Contact Us

For privacy-related questions, concerns, or requests:

RightKnock Privacy
[LEGAL ENTITY NAME REQUIRED]
[REGISTERED ADDRESS REQUIRED]
Email: [PRIVACY CONTACT EMAIL REQUIRED]

Grievance Officer: [GRIEVANCE OFFICER NAME AND CONTACT REQUIRED — required under Indian IT Rules 2011 Rule 5(9) and the Digital Personal Data Protection Act]