Statutory Framework & DPDP Act 2023 Roles
This Privacy Policy governs the processing, protection, and governance of digital personal data by DheePath Technologies Inc. in strict conformity with The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) enacted by the Parliament of India and published in the Gazette of India by the Ministry of Electronics and Information Technology (MeitY), the Information Technology Act, 2000, and the IT Rules, 2021.
DheePath was originated and engineered at G.H. Raisoni College of Engineering and Management (GHRCEM), Jalgaon, Maharashtra, India. Under Section 2 of the DPDP Act 2023, the legal entities and designations are defined as follows:
Determines the purpose and lawful means of processing student academic telemetry, skill verification badges, and recruiter radars.
The student, academic scholar, job applicant, or verified corporate recruiter to whom the digital personal data relates.
Supabase PostgreSQL (AWS Mumbai/Frankfurt), Render Cloud, Groq LPU API, and Google Cloud, processing data solely on behalf of DheePath under zero-training covenants.
Enables Data Principals to give, review, audit, modify, and withdraw consent through granular settings in the Student Dashboard.
Statutory Notice & Consent Architecture (Sections 5 & 6)
In strict accordance with Section 5 (Notice) and Section 6 (Consent) of the DPDP Act 2023, DheePath processes digital personal data only following clear, transparent, and affirmative user authorization:
- Prior Itemized Notice (Section 5(1)): Every consent request is accompanied by an itemized disclosure identifying the specific personal data collected, the exact technical purpose of processing, and instructions on how to exercise Data Principal rights under Section 12 or submit grievances under Section 13.
- Affirmative & Unconditional Consent (Section 6(1)): Consent is collected through affirmative action (an explicit opt-in checkbox). We never use pre-ticked checkboxes, dark patterns, or bundled permissions.
- Eighth Schedule Language Availability (Section 5(3)): In accordance with statutory mandate, this notice and consent request is provided in clear English, with the option for Data Principals to view or request copies in any of the 22 official languages specified in the Eighth Schedule to the Constitution of India (including Hindi, Marathi, Gujarati, Tamil, Telugu, Kannada, Bengali, and Urdu) by contacting the Grievance Desk.
- Right to Withdraw Consent with Equal Ease (Section 6(4)): Data Principals possess the statutory right to withdraw consent at any time with the same ease as granting it. Withdrawing consent triggers immediate cessation of processing and optional one-click account scrubbing from the Student Dashboard.
Personal Data Collected & Purpose Specification
Under the principle of data minimization, we collect only digital personal data necessary to evaluate technical competencies, construct roadmaps, and facilitate verified hiring:
| Data Category | Data Points Collected | Purpose & Legal Basis |
|---|---|---|
| Student Academic Profile | Degree/Course (e.g. BCA, B.Tech, MCA, B.Sc), academic department/branch, college name, year of study, self-declared technical interests, and self-rated skill proficiencies. | Calculation of the transparent 60/25/15 Career Match Score and personalized roadmap generation. |
| Account Authentication | Full name, personal or institutional email address, hashed passwords (salted bcrypt, 10 rounds), and optional Google OAuth 2.0 identifiers. | Account creation, multi-device session authorization, and access control. |
| Communication Telemetry | E.164 normalized mobile phone number (+91), WhatsApp message delivery tokens, and 6-digit OTP verification records. | Simultaneous dual verification (Option A gate), fraud prevention, and automated delivery of weekly roadmap study PDFs. |
| Recruiter Credentials | Work email address (`@company.com`), full corporate name, job title, official company website, and LinkedIn professional profile URL. | 4-tier corporate legitimacy verification (DNS MX check, HTTP domain probe, webmail blacklist filtering). |
| Assessment & Milestone Telemetry | Groq/Gemini micro-quiz responses, weekly 30-minute proctored exam answers, tab-focus visibility switch counts, and mock interview speech audio recordings. | Issuance of tamper-proof `[✓ Quiz-Verified]` badges and SHA-256 cryptographic certificates. |
Protection of Personal Data of Children & Minors (Section 9)
In strict compliance with Section 9 of the Digital Personal Data Protection Act, 2023, DheePath enforces rigorous protections for individuals below the age of eighteen (18) years:
Students under 18 years enrolling in roadmap milestone testing must furnish verifiable consent from their parent or lawful guardian prior to the processing of any digital personal data.
DheePath strictly prohibits tracking or behavioral monitoring of children, student psychological micro-targeting, or surveillance across any portion of the platform.
We never direct targeted commercial advertisements or marketing promotions to children or students under any circumstances.
No algorithmic evaluation, milestone exam time limit, or score calculation shall be conducted in a manner that causes any detrimental effect on the physical or mental well-being of a child.
GitHub AST & Code Telemetry Scope
DheePath features a specialized Two-Factor Skill Verification Moat. When students link their GitHub profile or click “Auto-Detect Skills”, our backend inspects code repositories to substantiate claimed proficiencies.
- Public repository metadata (names, primary language tags, stars, forks).
- Public commit timestamps and commit frequency to verify continuous learning.
- Abstract Syntax Tree (AST) structure of public code to verify framework usage (e.g. React components, Express routes, SQL queries).
- NO access to private repositories or organization memberships.
- NO reading or logging of sensitive files (`.env`, private keys, secrets, credentials).
- NO source code cloning or persistent retention of repository source files on our servers.
GitHub authentication uses scoped OAuth tokens or public REST API endpoints with the minimum necessary read-only permissions. You can disconnect your GitHub sync at any time from the Student Dashboard.
Single Resume & Document Storage
DheePath maintains an architectural principle of One Dedicated Resume per Student Account to prevent resume duplication, stale document versions, and cloud storage leakage.
- Binary Magic-Byte Inspection: Uploaded files are inspected in-memory for signature bytes (`%PDF-`, `PK\x03\x04` for DOCX) to reject disguised binary executables or malicious payloads.
- Cloud Storage & Asset Destruction: Resume files are stored in an encrypted Cloudinary container. When you upload a replacement resume, our server issues a transactional destruction call (`cloudinary.uploader.destroy`), permanently wiping the previous document from the cloud.
- Strict Non-Sale Covenant: Your resume, contact details, and academic transcripts are never sold, leased, or monetized with data brokers, marketing agencies, or unauthenticated aggregators.
BYOK (Bring Your Own Key) Isolation Guarantee
For advanced users who prefer to use their personal API keys (such as custom Groq, OpenAI, or Google Gemini credentials) in the AI Career Mentor Drawer or Mock Interview Chamber:
Client-Side Isolation Guarantee
User-supplied API keys are stored strictly within your local browser storage (`window.localStorage`). They are NEVER transmitted to, received by, stored in, or logged on DheePath backend servers. When in BYOK mode, requests dispatch directly from your client browser to the respective LLM provider endpoint.
AI Data Processing & Zero Model Training
DheePath harnesses enterprise artificial intelligence to deliver sub-300ms skill evaluations and realistic voice mock interviews. We uphold strict AI ethics and data boundaries:
We utilize the Groq Cloud API (running Meta Llama 3.3 70B Versatile on high-speed LPUs) and Google Gemini API (Gemini 2.5 Flash as multi-cloud failover) for ephemeral inference.
Under enterprise API terms, your prompts, interview speech transcripts, and skill inputs are never used to train, retrain, or improve third-party AI models.
Furthermore, career matching and score calculations are 100% deterministic. We do not use LLMs to guess career matches; all scoring is computed via the transparent, mathematical 60/25/15 formula.
Recruiter Talent Radar & Candidate Consent
The Recruiter Talent Radar is an enterprise feature allowing corporate employers to discover pre-assessed, proof-of-work engineering candidates:
- Explicit Consent Required: Your profile and verified skill badges are visible to recruiters only if you have opted in via your Dashboard posture selector or submitted a 1-click application to an active job opening.
- Search Posture Controls: You can modify your visibility at any time between:
actively_seeking: Full profile and resume visible to verified recruiters.open_to_learning: Anonymized skills visible; contact details withheld until you approve outreach.interviewing: Highlighted as in active discussion with recruiters.
- Verified Recruiters Only: Recruiters must pass our 4-tier validation pipeline (corporate domain check, MX record probe, live website validation, and OTP verification) before accessing candidate radars.
WhatsApp Automation & Mobile Communications
To ensure mobile accessibility across Indian technical colleges, DheePath integrates official WhatsApp automation:
- Service Drivers: Messages are dispatched via the Meta WhatsApp Cloud API (Graph API v21.0) or authorized gateway runners.
- Transactional Use Only: We send only requested authentication OTPs, weekly milestone PDF study notes, and critical inactivity streak alerts. We do not send marketing spam or unsolicited broadcast ads.
- E.164 Normalization: Phone numbers are sanitized to standard international format (e.g. `+919876543210`) and stored with cryptographic hash indexing.
Statutory Rights of the Data Principal (Sections 11 - 14)
Under Chapter III of the Digital Personal Data Protection Act 2023, you as a Data Principal possess enforceable legal rights regarding your digital personal data:
To exercise any of these statutory rights, use the Data Management controls in your Student Dashboard or submit a formal request to our Grievance Redressal Desk at parthpatil@disheera.site (or WhatsApp: +91 74990 85045).
Statutory Duties of the Data Principal (Section 15)
In accordance with Section 15 of the DPDP Act 2023, every user accessing DheePath is subject to binding statutory duties:
- Compliance with All Laws (Section 15(a)): You must comply with all provisions of the DPDP Act 2023, the IT Act 2000, and rules made thereunder while exercising rights.
- Prohibition on Impersonation (Section 15(b)): You shall not impersonate another individual when providing personal data for registration or credential verification.
- No Suppression of Material Information (Section 15(c)): You shall not suppress any material information when providing your personal data for academic assessments or recruiter applications.
- Prohibition of Frivolous Complaints (Section 15(d)): You shall not register false, frivolous, or vexatious grievances or complaints with the Data Fiduciary or the Data Protection Board of India.
- Authentic Information Guarantee (Section 15(e)): You shall furnish only verifiably authentic information and documents when applying for verification badges, certificates, or recruiter shortlisting.
Security Safeguards & Breach Protocol (Section 8(5) & 8(6))
Under Section 8(5) of the DPDP Act 2023, DheePath implements reasonable security safeguards to prevent personal data breaches:
- Cryptographic Protection: 256-bit TLS/SSL encryption for all data in transit; AES-256 encryption at rest on Supabase PostgreSQL. Passwords hashed using bcrypt with salted 10 rounds.
- Zero-Trust Architecture: Render Cloud containerized deployment with private VPC network boundaries and strict role-based access control (RBAC).
- Mandatory Breach Notification (Section 8(6)): In the event of an identified personal data breach, DheePath intimates the Data Protection Board of India (DPBI) and each affected Data Principal in the form and manner prescribed by statutory rules without undue delay.
Data Retention & Storage Boundaries (Section 8(7))
Pursuant to Section 8(7) of the DPDP Act 2023, DheePath erases digital personal data as soon as the specified purpose of collection is no longer being served, or upon withdrawal of consent:
- Active Accounts: Maintained for the duration of your academic study and active job search lifecycle.
- Inactive Account Scrubbing: Accounts inactive for $>365$ consecutive days receive automated notices before being scheduled for anonymization and database scrubbing.
- Cessation of Purpose: Milestone test answer sheets and temporary proctoring webcam logs are purged within thirty (30) days of certificate issuance.
Grievance Redressal Officer & DPBI Appeal Pathway
In compliance with Section 8(10) and Section 13 of the Digital Personal Data Protection Act 2023 and Rule 3(2) of the IT Rules 2021, the contact coordinates of our designated Grievance Redressal Officer are published below: