Privacy Policy

This Privacy Policy explains how BrainUp (“BrainUp”, “we”, “us”, or “our”), owned and operated by Velqonix AI Labs LLP, collects, uses, stores, processes, and protects personal data when you access or use our websites, applications, and services (including brainup.in and related products, collectively the “Site” or “Service”).

1. Controller & Scope

BrainUp (“we”, “us”) controls data processing for brainup.in. This policy covers personal data collected through the Site and services. In Europe, GDPR/UK GDPR apply; in India, the DPDP Act 2023 applies to Indian personal data. Contact: contact@brainup.in or contact@velqonix.in. If applicable, BrainUp will appoint a data protection representative (e.g. an EU/UK representative). BrainUp may be a “Significant Data Fiduciary” under DPDP (if user data of Indians is large-scale), in which case a DPDP grievance officer or DPO will be designated.

2. Data Collected

We collect:

• Account Information: name, email, username/password;
• Resume/Content Data: information you enter into the resume builder (work history, education, skills, uploaded files or images);
• Usage Data: browser/device info, IP address, session logs and cookies;
• AI Interaction Data: prompts/queries you give to AI features and the AI’s outputs (see below);
• Communications: any messages, feedback, or support requests you send.

We do not collect sensitive special categories unless you explicitly provide them in your resume content.

3. Use of Data (Purposes & Legal Basis)

We use personal data to provide and improve our services. Typical legal bases (GDPR Art.6) include:

• Performance of contract: to create resumes you request (processing your input).
• Consent: for optional marketing communications or use of certain cookies; you may withdraw consent anytime (without affecting past processing).
• Legitimate interests: e.g. fraud prevention, security, and service improvements.
• Legal obligations: e.g. compliance with tax or consumer laws.

Under DPDP, processing is lawful if it meets similar grounds (consent, contract, or government regulations). We require explicit consent for any processing of children’s data as per DPDP (verifiable parental consent).

4. AI Prompts and Outputs (Logging)

To improve our resume-AI features, we log all user inputs (“prompts”) and resulting AI-generated outputs.

Retention: These logs are stored in our secure servers.

AI Training: Where BrainUp uses logged data to improve AI models, we will anonymize or aggregate that data before any model training where practicable, or seek opt-in consent for use in machine-learning training where required by law. We advise and aim to anonymize inputs/outputs to avoid storing personal identifiers if used for model improvement.

5. Cookies and Tracking

We use cookies and similar tech to enhance functionality and security. By default, necessary cookies operate for login and session maintenance. We may offer analytics or “performance” cookies (to improve UX) and “marketing” cookies (subject to consent). Your browser settings can control or disable cookies, but may affect Site features.

6. Data Sharing and Transfers

We do not sell your personal data. We share data only with trusted service providers under contract: e.g. cloud hosting, email/SMS services, AI model providers, and payment processors. All such providers must implement robust security.

EU/UK Transfer: BrainUp’s data storage or processors might be outside the EEA/UK. In such cases we use Standard Contractual Clauses or rely on an adequacy decision (where applicable). For Indian data, DPDP requires that cross-border transfer follow specified conditions; we may, for example, ensure equivalent safeguards (the DPDP Rules may prescribe guidance). Any transfers outside India will comply with DPDP Section 15 (e.g. using notified data countries or contractual safeguards).

7. Retention

We retain your personal data no longer than necessary for each purpose: e.g. resume data and account details are kept as long as your account exists, unless you delete it. Usage logs (including AI logs) may be kept for a period (e.g. 1–2 years) to analyze service performance and detect abuse; after that, data are deleted or anonymized. Specific retention schedules (e.g. DPDP Second Schedule) will be respected: personal data needed for legal compliance or dispute resolution may be kept longer, per law.

8. Security

We implement industry-standard measures (encryption in transit, access controls, firewalls) to protect data. Under GDPR/DPDP we must ensure security by design. In case of a breach, we will notify affected users and authorities as required by law (within 72 hours under GDPR and DPDP Rules).

9. User Rights

You have the following rights (as applicable by law) with respect to your personal data:

• Access: You can request confirmation and obtain a copy of your data.
• Rectification/Correction: You may ask us to correct inaccurate or incomplete data about you.
• Erasure: You can request deletion of your personal data in certain circumstances (e.g. withdrawn consent, data no longer needed).
• Restriction/Portability: You can ask to restrict processing in limited cases and to receive a machine-readable copy of data you provided (GDPR Art.20).
• Objection: You may object to processing based on legitimate interests or direct marketing.
• Withdraw Consent: Where we rely on consent, you may withdraw it anytime (does not affect past processing).
• Lodge Complaint: If unsatisfied, EU/UK users may file a complaint with their Data Protection Authority. Indian users may approach the DPDP grievance officer or the DPDP Board.

We will respond to any privacy request within the statutory time (typically 30 days under GDPR/DPDP), possibly extendable by 2 more months if complex.

10. Contact / Privacy Officer

For questions or to exercise rights, contact us at contact@brainup.in or contact@velqonix.in. If BrainUp qualifies as a ‘Significant Data Fiduciary’ under DPDP, we will register a Data Protection Officer with DPDP and publish contact details. For EU/UK residents, a local representative (or BrainUp itself) can be contacted for data requests. We will also designate a grievance officer for India as required by DPDP.

11. Children’s Data

BrainUp does not knowingly process personal data of children under 16 without verifiable parental consent. If you are under 18, do not use this Site or submit personal data.

12. Updates to Privacy Policy

We may update this Policy (for example, when laws change) and will post the new version with a “last updated” date. For major changes, we will provide prominent notice. Please review periodically.

Data Flow Overview

flowchart LR
    A[User] -->|creates resume / uses AI tools| B[BrainUp Web App]
    B --> C[AI Provider]
    C -->|AI-generated suggestions| B
    B --> D[Storage & Database]
    D -->|stores user data & resume logs| E[Secure Data Storage]
    E -->|backup/compliance| F[Off-site Backup]

Figure: User interactions flow through BrainUp’s web app, which may call an AI provider for certain features and stores data in secure storage. Personal data (inputs, AI prompts, outputs) flow through BrainUp’s servers; backup and audit logs may be retained securely.

Please keep a copy of this Privacy Policy for your records.