Privacy Policy

1. Data Controller Identity

GCC ERA PRIVATE LIMITED ("GCC ERA", "we", "us") is the Data Controller and Data Fiduciary for personal data processed through gccera.com, gccera.com/products, and the GCC ERA mobile application (Android package com.gccera.app, and the iOS application where published) — together the "Platform" — under:

• Information Technology Act, 2000 (and IT Rules 2021)
• Digital Personal Data Protection Act, 2023 ("DPDP Act")
• Indian Contract Act, 1872

Legal identifiers (Companies Act 2013 §12):

• CIN: U62011AS2025PTC028987
• PAN: AAMCG3895Q
• GSTIN: 18AAMCG3895Q1ZH
• Date of incorporation: 19 September 2025

Regulatory status. The Information Technology Act, 2000 and the rules made under it — including the SPDI Rules, 2011 and the IT Rules, 2021 — apply to us today, and we comply with them now. The DPDP Act, 2023 is being brought into force in phases under rules notified in November 2025, with the principal obligations commencing on the statutory timeline that follows. We do not treat that phase-in as a reason to wait: this policy is written to the DPDP standard already, and we apply those protections to you now rather than from the date they become compulsory. Where the DPDP standard is higher than what current law requires, the higher standard is what we follow.

2. Categories of Data Collected

A. Personal Data

• Name
• Email
• Phone (optional)
• Location (city)

B. Professional & Sensitive Data

• CVs / résumés (full content), if uploaded
• Salary slips, CTC, compensation details, if uploaded
• Employment hierarchy, career history, employer details, if uploaded

C. Voice & Audio Data

• Voice recordings (microphone audio) from mock interview sessions, if you use these services
• Auto-generated transcripts of those recordings, if you use these services
• Session metadata: timestamp, duration, persona chosen, CV+JD context, scoring rubric output, if you use these services

D. Payment Metadata

• Razorpay transaction IDs, amount, tax breakdown
• GST details (where provided)
• We do not store card numbers, CVV, UPI PINs, or netbanking credentials — Razorpay handles those

E. Technical Data

• IP address
• Browser type, OS, screen size
• Cookies and similar identifiers (see Section 3)
• Usage analytics (pages visited, features used, AI prompt counts)
• Session replay — where you have accepted analytics cookies, Microsoft Clarity and Amplitude record an anonymised playback of your interaction with a page (pointer movement, clicks, scrolling, and rendered layout). Text and form inputs are masked, and only a small sampled percentage of sessions is recorded. This is not a screen or camera recording, and it does not run if you decline analytics cookies.

F. Mobile App Data (Android and iOS)

The GCC ERA mobile app is a secure wrapper around the same Platform, so the categories above apply identically. The app additionally involves:

• Push notification token — a device identifier issued by Firebase Cloud Messaging (Android) or Apple Push Notification service (iOS), used only to deliver notifications you have enabled. Revoking notification permission in your OS settings stops this.
• Microphone (RECORD_AUDIO) — requested only when you start a voice mock interview, and used only for that session. We do not record anything other than the session itself: the microphone is not active before you press "Start interview" or after you press "End interview", and the app never records in the background, when minimised, or while you are using other features. See Section 12.
• Biometric app-lock (USE_BIOMETRIC) — optional and off by default. Your fingerprint or face data never leaves your device and is never transmitted to or stored by GCC ERA; the operating system returns only a yes/no unlock result.
• File storage — used to save CVs and reports you choose to download to your device.
• App and device metadata — app version, OS version, device model, and crash diagnostics, used for stability and support.

The app does not collect your advertising ID, contacts, calendar, SMS, call logs, precise GPS location, photo library, or health data, and does not track you across other companies' apps or websites.

3. Use of Cookies & Tracking Technologies

GCC ERA uses cookies and similar tracking technologies to operate, secure, analyse, and improve the Platform. Cookies are small text files stored on a user's device.

Categories used

a. Strictly necessary cookies — required for authentication, security, and fraud prevention. Disabling these prevents the Platform from working.

b. Performance and analytics cookies — help us understand usage patterns. Third-party providers: Google Analytics, PostHog, Amplitude, and Microsoft Clarity (session replay, see Section 2E), plus Sentry for error monitoring.

c. Functional cookies — remember preferences and improve personalization.

d. Advertising & marketing cookies — the Meta Pixel is used for advertising measurement and remarketing. It loads only after you accept cookies.

Third-party cookies

Some cookies are placed by third-party service providers (e.g., Razorpay, Google OAuth). GCC ERA does not control these; they are governed by the respective third party's policies.

Control & consent

We display a consent banner on your first visit to the Platform. Analytics and advertising technologies — Google Analytics, PostHog, Amplitude, Microsoft Clarity, and the Meta Pixel — are not loaded at all until you affirmatively accept. Declining, or simply ignoring the banner, means those scripts are never fetched and those third parties receive no data about your visit. Only strictly necessary cookies operate before you choose.

Your choice is stored on your device and can be changed at any time by selecting Cookie Preferences in the footer of any page, which reopens the banner so the decision can be reversed in one click. You may also manage or disable cookies through your browser settings.

For the complete cookie-by-cookie inventory — every cookie name, who sets it, what it does and how long it lasts — see our Cookie Policy.

Server-side advertising measurement. Where you have accepted advertising cookies, we may also send conversion events to Meta (Conversions API) and Google Ads directly from our servers, so that advertising we pay for can be measured accurately. Any email address or phone number included in these events is irreversibly hashed (SHA-256) before transmission — the recipient cannot read the underlying contact details, and can only match against people it already knows. This is measurement, not a sale of your data, and it does not occur if you decline advertising cookies.

Mobile app

The mobile app presents the same consent banner and honours the same choice. In addition, your operating system controls notification and microphone permissions independently, and you may revoke either at any time in your device settings without losing access to the rest of the Platform.

4. Purpose & Legal Basis

We do not sell personal data. We do not use your CV or interview content to train AI models without your explicit opt-in.

5. Data Sharing & Third-Party Processors

Each processor below is contractually bound to handle your data only on our instructions.

This list is kept current. Where a processor is marked "only if you consent", no data reaches it unless you have accepted the relevant cookie category.

We may also share with:

• Employers and recruiters — only as described in Section 5A below
• Government / legal authorities — when legally compelled
• A successor entity in the event of a merger, acquisition, or restructuring — in which case we will notify you and the successor remains bound by this policy until you are given notice of any change

5A. Sharing With Employers and Recruiters (Talent Desk)

Where you apply to a role or join a recruitment desk on the Platform, your candidacy may be shared with the employer or recruitment consultancy handling that role. This sharing is governed by two independent gates, and both must be satisfied before an employer can see a given item:

1. Your consent, per item. Consent is recorded separately for each category of insight. Consenting to share one category does not release any other. You can see and change what you have consented to, and withdrawing consent stops further disclosure.
2. The employer's unlock. Employers pay per insight. Payment alone grants nothing — an insight you have not consented to remains invisible regardless of what the employer has paid for.

Employers never receive bulk exports of candidate data, and cannot browse candidates who have not engaged with their roles. Documents are served through short-lived signed links rather than transferred wholesale. Assessment and strengths outputs generated on the Platform are GCC ERA's own instruments and are not affiliated with, derived from, or equivalent to any third-party psychometric product.

Employers act as independent Data Fiduciaries for what they lawfully receive. Their subsequent handling of your data is governed by their own privacy policies, which we require them to maintain but do not control.

5B. Automated Processing and AI-Assisted Scoring

Several features analyse your data automatically — CV and job matching, readiness and career reports, mock interview scoring, and skills assessments. You should understand the following:

• These outputs are advisory, not determinations. A score produced on the Platform is guidance to help you prepare. It is not a hiring decision, an eligibility ruling, or a professional certification, and GCC ERA does not decide whether any employer hires you.
• AI output can be wrong. Scores and generated text may contain errors or omissions. You should review anything generated for you before relying on it or sending it to an employer.
• Human review is available. If you believe an automated output about you is materially inaccurate or unfair, email [email protected] with the subject "Review my result". A person will re-examine it and correct or withdraw the output where warranted.
• No adverse profiling. We do not use these outputs to deny anyone access to the Platform, to set different prices for different people, or to build assessments of your character, health, finances, or political or religious views.

We do not use your CV, transcripts, or interview content to train AI models, and our AI processors are contractually barred from doing so with data we send them, unless you have given explicit opt-in consent.

6. Data Retention

When you delete your account, all categories above are purged on the stated timeline, except payment records (legally retained).

How the two timelines interact. The retention periods above are maximums that apply while you take no action. If you delete your account, the 30-day grace period and permanent deletion in Section 7 override them — we do not continue holding your CV for 36 months after you have asked us to delete it. Conversely, if you simply stop using the Platform without deleting your account, the periods above apply from your last login, after which the data is deleted automatically.

Mobile app. Uninstalling the app does not delete your account or your data — it only removes the app from your device. To delete your data you must use the in-app or web account deletion described in Section 7. Push notification tokens are invalidated when you uninstall or revoke notification permission.

7. Data Security

We protect your data with:

• HTTPS for all traffic (HSTS enforced; locked-in for 1 year)
• Row-level security on our Supabase database
• Hashed passwords / OAuth tokens — we never see your account password
• Razorpay-tokenised payments — we never touch card numbers
• DOMPurify-sanitised AI output — defends against script injection
• Defensive HTTP headers: X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
• Voice audio encrypted at rest (Supabase Storage AES-256)
• Quarterly access-log + processor-terms review

Breach notification

In the event of a personal data breach affecting your data, we will notify affected users and the Data Protection Board of India within 72 hours of discovery, as required by DPDP §8.

Account deletion mechanism

When you request deletion via the dashboard, we stop using your data for marketing straight away and your request is logged for our Grievance Officer. Your data stays intact for a 30-day grace period so you can change your mind — email [email protected] before then to cancel. After those 30 days we permanently delete your personal data (profile, CVs, reports, transcripts, voice audio, and payment metadata other than records we are legally required to keep). We complete every request within 30 days of receiving it.

8. Your Rights under the DPDP Act

We will not refuse, delay, or condition any of these requests on payment.

8A. Communications

We send two different kinds of message, and they follow different rules.

Service and transactional messages — payment receipts, invoices, report-ready notifications, security alerts, and account or subscription notices. These are part of the service you asked for, so they are sent to every registered user and cannot be switched off while your account is active.

Marketing messages — career tips, job-market updates, product news, and offers. These are sent only to users who have given specific marketing consent, by any of the following affirmative actions:

• Ticking the marketing opt-in when creating an account, or later in your preferences
• Subscribing to our newsletter
• Opting in to marketing or career insights

Creating an account, logging in, purchasing a product, or using the Platform does not by itself constitute consent to marketing messages. Marketing consent is off by default: unless you have taken one of the actions above, we treat you as not having consented and you receive no marketing.

Job alerts are treated separately. If you subscribe to job alerts, you are asking for a specific service, and we send you matching roles on that basis. Job alerts are not general marketing, and subscribing to them does not opt you in to product news or offers. You can stop job alerts at any time without affecting your other preferences, and stopping marketing does not stop job alerts.

Channels. Marketing may reach you by email, SMS, WhatsApp, or voice call. WhatsApp, SMS, and voice calls are used only where you have given consent for that channel, and any marketing to your phone number is additionally subject to your registration on the National Customer Preference Register (DND). You can opt out of any single channel without opting out of the others.

Withdrawing. Every marketing email carries a one-click unsubscribe link that takes effect immediately, with no login required. WhatsApp and SMS marketing stop when you reply STOP. Voice-call marketing stops on request during the call or by writing to us, and you may register your number on the National Customer Preference Register (DND) at any time. You may also email [email protected] to withdraw from any or all channels. Withdrawing marketing consent does not affect service and transactional messages, and does not affect the lawfulness of anything sent beforehand.

Personalisation. Marketing messages may be personalised using information you have given us or generated on the Platform — your name, city, listed skills, and the scores from any CV or readiness report you have run. We do not use special-category data for marketing, and we do not sell your data or share it with advertisers.

Record-keeping. We record, for each marketing message, which consent we relied on and when it was given, so that any message we have sent can be traced back to a specific consent. You may request that record at any time.

9. Children's Data

The Platform is intended for working professionals and is not directed at children. Under DPDP §9, anyone below 18 is a child, and we do not knowingly process a child's personal data without verifiable consent from a parent or lawful guardian.

We also do not undertake tracking or behavioural advertising directed at children, and we do not serve targeted advertising to any user we know or believe to be below 18, as DPDP §9(3) requires. Our app stores list the app as intended for a general adult professional audience.

If you believe we have collected data from a person below 18 without proper consent, email [email protected] and we will verify and delete it promptly.

10. International Data Transfers

Several of our processors operate outside India:

• Supabase, OpenAI, Anthropic, ElevenLabs, Deepgram, Nomic, PostHog, Twilio, SendGrid — primarily USA
• Google, Microsoft, Meta, Apple, LinkedIn, Cloudflare — global

Legal basis. Section 16 of the DPDP Act permits transfer of personal data outside India except to territories that the Central Government has notified as restricted. We do not transfer personal data to any territory currently on that list, and we will cease any transfer that becomes restricted by notification.

Contractual safeguards. Independently of Section 16, each processor is bound by a data-processing agreement requiring it to process data only on our instructions, apply appropriate security, and delete or return data on termination. Where the processor offers standard contractual clauses, we have executed them. We review these terms periodically and will discontinue any processor that ceases to maintain DPDP-aligned safeguards.

What this means for you. Data stored outside India may in principle be subject to lawful access requests by authorities in that jurisdiction. We disclose data to any authority only where legally compelled, and we resist requests that appear overbroad or unlawful.

11. Grievance Officer

In accordance with the Information Technology Rules 2021 and DPDP §13:

• Name: Ms. Priya
• Designation: Grievance Officer
• Email: [email protected]
• Acknowledgement: Within 24 hours of receiving your complaint (IT Rules 2021, Rule 3(2)(a))
• Resolution: Within 15 days under those same Rules, and well inside the 90-day maximum the DPDP Rules allow. In practice we aim to respond substantively within 7 calendar days.

For unresolved concerns, you may escalate to the Data Protection Board of India at the address published on its official website.

12. Voice & Audio Data — Mock Interview Features

Our mock interview features (voice mocks, Premium GCC Grade) record your microphone audio. By starting any voice session, you provide explicit consent under DPDP §6 for:

What is recorded

• Your spoken responses (raw audio)
• Auto-generated transcript of your responses
• Session metadata (timestamp, duration, persona, CV + JD context, scoring output)

What is NOT recorded

• Video or camera feed
• Screen contents
• Audio from before "Start interview" / after "End interview"
• Any other application's audio playing on your device

Why we need it

• Run the interview (the AI needs to hear you to respond)
• Score the session (scoring rubric needs the transcript)
• Deliver your report (your PDF references specific transcript moments)
• Improve scoring AI — only with explicit opt-in via email

Who processes voice data

• GCC ERA (storage on Supabase)
• ElevenLabs (USA) — voice synthesis + transcription
• OpenAI / Anthropic (USA) — scoring rubric on transcript

Retention

• Voice audio: 12 months from session date, then auto-deleted
• Transcript: 12 months (referenced by your scored report)
• Session metadata: 36 months or until account deletion

Withdrawal & deletion

• End any session at any time — partial recording is processed only for the portion you completed
• Delete a specific session via dashboard → past sessions
• Delete all voice data via "Delete my account"
• Opt out of AI training via email to [email protected] — your transcripts are excluded from future model improvements

Security

Voice audio is encrypted at rest (AES-256). Transit is HTTPS only. Access is restricted to the account owner via row-level security. In the event of a breach affecting voice data, we notify affected users + DPB within 72 hours.

12A. Mobile Applications — Android and iOS

The GCC ERA mobile app (Android package com.gccera.app, and the iOS application where published) delivers the same Platform in a native shell. Everything in this policy applies to it. The points below are specific to the app and are provided to meet Google Play and Apple App Store requirements.

Permissions we request, and why

Every permission is optional except as needed for the feature it powers. Declining a permission disables only that feature — the rest of the app continues to work. You may revoke any permission at any time in your device settings.

Deleting your account from the app

You can request deletion of your account and associated data from inside the app, without contacting support, at Dashboard → Helpful Links → More → "Delete my account", or on the web at gccera.com/products. The 30-day grace period and permanent-deletion process in Section 7 then apply. Uninstalling the app on its own does not delete your data.

Payments in the app

Purchases are processed by Razorpay, the same as on the web. We never receive or store your card number, CVV, UPI PIN, or netbanking credentials.

Data safety declarations

Our Google Play Data Safety declaration and Apple App Privacy ("nutrition label") disclosures are derived from this policy and are kept consistent with it. The app does not collect an advertising identifier, does not track you across other companies' apps or websites, and does not share data with data brokers.

Platform providers

Google (Android, Firebase Cloud Messaging) and Apple (iOS, Apple Push Notification service) process device and push-token data as part of distributing and running the app. Their handling is governed by their own privacy policies.

13. Policy Updates

We may update this policy. The "Last updated" date at the top reflects the latest revision. Material changes will be emailed to all account holders 30 days before they take effect.

Where a change materially reduces your rights or broadens how we use your data, we will seek fresh consent rather than rely on notice alone. Mobile app users will additionally see the updated policy on next launch.

Revision history

• 10 January 2026 — first published, covering the website, the products app, and the GCC ERA mobile applications for Android and iOS.

14. Contact

• Entity: GCC ERA Private Limited
• Email: [email protected]
• Grievance Officer: Ms. Priya (see Section 11)
• Registered office: 11, Niribili Path, R G Baruah Road, Zoo Road, Kamrup Metropolitan, Guwahati, Assam – 781024, India
• Customer care: +91 75007 09210 · [email protected]

For unresolved concerns, write to the Data Protection Board of India at the address on their official website.

GCC ERA Private Limited · CIN U62011AS2025PTC028987 · GSTIN 18AAMCG3895Q1ZH