isHirable Privacy Policy

1.1 Personal Data You Provide

When you register and use our Service, we collect:

• GitHub Account Information: username, profile URL, avatar URL, and GitHub user ID (NO password storage)
• Profile Information: display name or bio if provided
• Contact Information: email address if you choose to provide it
• Communication Data: messages, feedback, or support requests

1.2 Data from Your GitHub Account

With your consent via GitHub OAuth, we access and analyze your public GitHub data:

• Repository Data: names, descriptions, star counts, fork counts, languages, sizes, last push dates
• Contribution Statistics: total commits, PRs, issues, active days, streaks, last activity dates
• Repository Metrics: commit frequency estimates, contributor counts, issue activity scores, recency scores
• Public Profile Information: username, avatar, profile URL

1.3 Information Collected Automatically

We automatically collect certain information about your device and usage:

• Log Data: IP address, browser type, OS, referring URLs, device identifiers, pages visited, timestamps
• Usage Analytics: features accessed, time spent, interaction patterns (via Vercel Analytics)
• Cookies: tracking technologies to enhance experience and improve our Service

1.4 Information from Third-Party Sources

We may receive additional information from third-party sources:

• GitHub API: public data from your GitHub profile and repositories
• Analytics Providers: aggregated usage data from Vercel Analytics

1.5 Sensitive Personal Data

We do NOT collect or process any sensitive personal data:

• Racial or ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Health, biometric, or genetic data
• Sexual orientation or gender identity
• Financial information (payment data)
• Location data (precise GPS coordinates)

2.1 Purposes of Processing

We use your information for:

• Provide and operate the Service: authentication, data sync, scoring, dashboard display
• Improve our Service: analyze usage, identify bugs, optimize performance, develop features
• Personalize your experience: tailored recommendations and insights
• Communicate with you: respond to inquiries, provide support, send announcements
• Security and fraud prevention: monitor suspicious activity, prevent unauthorized access
• Analytics and research: aggregated analysis for trends and algorithm improvement
• Comply with legal obligations: respond to lawful requests, enforce Terms of Service

2.2 Legal Bases (GDPR & Similar Laws)

For users in EEA, UK, or similar jurisdictions, our legal bases include:

• Contract Performance: processing necessary to provide requested Service
• Consent: explicit consent (GitHub OAuth, cookie acceptance)
• Legitimate Interests: improving Service, security, fraud prevention
• Legal Obligation: compliance with applicable laws and regulations

3.1 Service Providers

We may share with third-party service providers who help operate our Service:

• Hosting: Vercel Inc. (application hosting)
• Database: MongoDB Atlas (data storage)
• Authentication: NextAuth.js with GitHub OAuth (authentication handling)
• AI Services: OpenRouter (AI model access, no personal data sent)
• Analytics: Vercel Analytics (anonymized, aggregated data)

3.2 Third-Party Integrations

Our Service integrates with GitHub through OAuth:

• GitHub receives information that you authorized the connection
• GitHub's Privacy Policy applies to data collected by GitHub
• We only access public repository data - NOT private repositories

3.3 Aggregated and Anonymous Data

We may share aggregated or de-identified information that cannot reasonably identify you:

• Public leaderboard rankings with your username and score (if you qualify)
• Anonymous usage statistics and trends for Service improvement
• Aggregated metric benchmarks (e.g., average score across all users)

3.4 Legal Compliance and Required Disclosures

We may disclose your information if required by law or valid legal process:

• Comply with subpoenas, court orders, or other legal processes
• Respond to lawful requests from public authorities (including tax or law enforcement)
• Protect our rights, privacy, safety, or property, or those of others
• Enforce our Terms of Service and other agreements
• Investigate and defend against security threats, fraud, or abuse

3.5 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice before your data becomes subject to a different privacy policy.

3.6 With Your Consent

We may share your information for any other purpose with your explicit consent.

4.1 Retention Period

We retain your data as follows:

• Account Data: retained until account deletion or 12 months of inactivity
• GitHub Data (repos, contributions, metrics): retained until account deletion
• Evaluation Scores and AI Reports: retained until account deletion
• Contact Form Submissions: retained for 6 months after resolution of inquiry
• Log Data and Analytics: retained for 26 months (Vercel Analytics standard retention)
• Ranking Snapshots: anonymized historical data retained indefinitely for trend analysis

4.2 Account Deletion

You can request account deletion at any time:

• Via the account deletion feature in your Account Settings page
• By contacting us at dev@rakeshpatel.me
• Upon deletion, all associated data (repos, metrics, evaluations, AI reports) is permanently removed
• Anonymized ranking snapshot data may be retained for historical reference

5.1 Your Data Rights

Subject to applicable law, you have the right to:

• Access: request a copy of the personal data we hold about you
• Correction: request correction of inaccurate or incomplete data
• Deletion: request deletion of your personal data (subject to legal obligations)
• Portability: request transfer of your data to another service provider
• Restriction: request restriction of processing in certain circumstances
• Objection: object to processing based on legitimate interests
• Withdrawal of Consent: withdraw consent at any time without affecting lawful processing before withdrawal

5.2 Exercising Your Rights

5.3 California Privacy Rights (CCPA)

For California residents, you have additional rights:

• Right to Know: request disclosure of categories and specific pieces of personal information collected
• Right to Delete: request deletion of personal information (subject to exceptions)
• Right to Opt-Out: we do NOT sell your personal information, so no opt-out is needed
• Right to Non-Discrimination: we will not deny service or charge different prices for exercising rights
• We do not sell your personal information as defined under California law

5.4 GDPR Rights (EEA & UK Users)

For users in the European Economic Area and United Kingdom:

• Data Controller: isHirable (dev@rakeshpatel.me) is the data controller
• Legal Bases: contract performance, consent, legitimate interests, legal obligation
• Cross-Border Transfers: your data may be transferred to Nepal and the United States (Vercel servers)
• Supervisory Authority: you have the right to lodge a complaint with your local data protection authority
• Automated Decision-Making: AI recommendations are provided as suggestions and do not constitute automated employment decisions

6.1 Types of Cookies We Use

We use the following categories of cookies:

• Essential Cookies: required for authentication, session management, and Service functionality
• Analytics Cookies: Vercel Analytics cookies for anonymized usage statistics
• Preference Cookies: remember your theme settings and preferences
• We do NOT use advertising or marketing cookies
• We do NOT use third-party tracking cookies for cross-site tracking

6.2 Managing Cookies

You can control cookies through your browser settings. Disabling essential cookies may affect Service functionality.

• Browser settings: most browsers allow you to block or delete cookies
• Do Not Track: our Service does not respond to DNT signals (industry standard not yet established)
• Cookie banners: where required by law, we provide cookie consent options

12.1 Contact Information

12.2 Data Protection Officer

As a small operation based in Nepal, we do not have a formally designated Data Protection Officer. For all privacy-related inquiries, please contact dev@rakeshpatel.me.