What we hold, and what we refuse to

1. Who we are

Deva Defi Private Limited ("we", "us") operates QuratedAI, an automated job-discovery service available at app.quratedai.com. For data protection purposes we are the controller of the personal data described below. You can reach us at hello@quratedai.com or support@quratedai.com, or at Delhi, India.

2. What we collect

We collect only what the service needs in order to work. Specifically:

• Google account data. When you sign in with Google we receive your account identifier, your email address, your display name, and confirmation that the email is verified. Your display name is shown back to you on your own screen only; it is never written into your matching profile.
• Your resume. A PDF you upload. We extract its text on our server to derive skills, industries and your professional field.
• Your stated preferences. Target roles, skills, locations, years of experience, work mode, salary floor, geography rules, and optionally your GitHub and LinkedIn profile URLs.
• Your Telegram chat identifier. Captured when you link the bot, so that alerts can be delivered to you.
• Job-matching history. Which postings have already been shown to you, so they are not repeated.
• Operational logs. Records of pipeline runs, kept for a limited period for debugging and reliability.

We do not ask for your phone number, date of birth, government identifiers, financial details, or any special-category data. Please don't include such information in your resume if you would prefer that we never process it.

3. The PII-free matching profile

This is the central design decision of the service, so it's worth stating precisely. The matching pipeline runs against a profile file containing your roles, skills, industries, experience band, acceptable locations, work mode, salary floor, matching rules, and a Telegram chat identifier. It contains no name and no email address.

That file is named using a one-way hash of your Google account identifier, the hash cannot be reversed to recover the account it came from. The matching pipeline therefore processes your preferences without ever handling your identity.

Your email address is retained separately, in a private account record, so that we can recognise you when you sign back in and contact you about the service. That record is never read by the matching pipeline.

4. Why we process it (lawful bases)

• Performance of a contract. Matching jobs to your profile and delivering alerts is the service you asked us to provide.
• Consent. Uploading a resume and linking Telegram are voluntary acts, which you can withdraw at any time by deleting your account.
• Legitimate interests. Keeping the service secure and working, preventing abuse, and understanding aggregate usage such as the number of active profiles.

5. Who processes your data

We use a small number of third-party providers. Each receives only what it needs to do its job, and none of them receive your data for their own marketing purposes.

• Google: authentication and website analytics. For sign-in it provides us your identifier, email and name. Separately, Google Analytics receives the usual web request data (page visited, referrer, approximate location, device and browser) for visits to this site and the app. The two are not joined together by us.
• Telegram: message delivery. Receives your chat identifier and the content of your alerts.
• Our cloud infrastructure provider: hosts the application and stores your profile and resume in private storage with no public address.
• Our AI provider: receives your resume text and profile details at signup in order to derive your skills and field, and receives your profile alongside job descriptions in order to score them.
• Our search provider: receives search queries assembled from your roles, skills and target cities. It does not receive your resume or your identity.
• Our pipeline compute and logging provider: runs the daily matching job and stores operational logs.
• Our website host: serves this marketing site. It receives no account data of any kind.

We describe the infrastructure providers by the role they play rather than by name. Publishing a full component list of a system mostly helps people attack it, and the protection that gives your data is worth more to you than the trivia of which vendor sits behind which function.

These providers operate in various countries, including outside the United Kingdom and the European Economic Area. Where data is transferred internationally, we rely on the transfer mechanisms set out in those providers' own data-processing terms.

6. Where it is stored, and who can reach it

Your profile and resume are held in private storage that has no public address and is not reachable from the internet, only our application can address it. The application's access is write-oriented; the matching engine holds a separate, read-only credential and can never modify or delete your data. Neither component can do the other's job, which limits how much any single failure could expose.

7. How long we keep it

• Your profile, resume and account record: for as long as your account exists. Deleting your account removes them.
• Your job history: kept while your account is active, so that previously seen jobs are not resent.
• Operational logs: retained for a limited period (currently 30 days), then deleted automatically.

8. Your rights

You have the right to access your data, correct it, delete it, restrict or object to its processing, and request a copy in a portable form. In practice:

• Access and correction: sign in and open your account page. Editing your profile and resubmitting replaces the previous version.
• Deletion: the delete control on your account page removes your profile, your resume and your Telegram link, and stops the daily run. No email to us is required.
• Anything else: write to hello@quratedai.com and we'll action it. If you're unhappy with our response, you may complain to the UK Information Commissioner's Office at ico.org.uk.

9. Security

• API keys and secrets are held server-side only and are never exposed to your browser.
• Session cookies are signed, HTTP-only, secure, and expire after 8 hours.
• Sign-in is protected against cross-site request forgery.
• The Telegram integration is authenticated on every request; link tokens are single-use and expire within 15 minutes. Each Telegram account can be bound to exactly one QuratedAI account, and vice versa.
• Uploaded files are validated by inspecting their actual bytes rather than trusting what your browser claims about them, are size-limited, and encrypted PDFs are rejected.
• The application sends a strict content security policy and related security headers on every response.

No system is perfectly secure, and we won't claim otherwise. If you believe you've found a vulnerability, please write to hello@quratedai.com. We'd much rather hear from you than not.

10. Cookies and tracking

This site and the application at app.quratedai.com use Google Analytics to measure how many people visit, which pages they read, and where they arrive from. It sets its own cookies to tell a returning visit from a new one. We use it to understand traffic in aggregate. It is not wired to any advertising network, and we do not use it to build a profile of you or to follow you around other websites.

The application also sets one essential cookie: your signed session, which is required to keep you signed in.

If you'd rather not be counted, any browser-level tracker blocker or Google's own opt-out add-on will stop it, and the site works exactly the same without it.

11. Children

QuratedAI is not intended for anyone under 16, and we do not knowingly process their data. If you believe a child has signed up, contact us and we will remove the account.

12. Changes to this policy

If we change how we handle your data, we will update this page and revise the date above. Material changes affecting active users will also be announced through the Telegram bot, since that's where we already talk to you.