Candidate Privacy Policy

1 Our Privacy Philosophy

At Karvaan Labs, we believe engineering evaluations should evaluate your code, not monetize your personal profile. We collect only the essential candidate data required to verify identities, run rubric evaluations, issue cryptographically verifiable credentials, and schedule hiring partner interviews.

We do not sell, rent, or trade candidate personal data to advertisers, data aggregators, or unauthorized commercial brokers under any circumstances.

2 Candidate Data We Collect

We process the following categories of candidate information:

• Identity & Account Data: Full legal name, verified email address, phone number, encrypted password hash (bcrypt), and account creation timestamp.
• Professional Profiles: Chosen engineering discipline, GitHub profile username, LinkedIn profile URL, and portfolio website link.
• Deliverable Records: Public GitHub project repository links, pull request URLs, commit history timestamps, and submission architectural write-ups.
• Evaluation Telemetry: Rubric category scores (concurrency, unit test coverage, architectural modularity), reviewer remarks, and final qualification grade.
• Billing Transactions: For optional administrative attestations or physical credential dispatch, we retain payment gateway transaction references, dates, and order IDs (credit card and banking credentials are handled exclusively by PCI-DSS Level 1 compliant processors).

3 Codebase Submissions & Repositories

When you submit repository URLs for evaluation:

Our automated evaluation infrastructure and human technical evaluators inspect code modules, run automated testing suites, and verify adherence to track guidelines. Repositories submitted must be publicly accessible on GitHub. Karvaan Labs stores evaluation logs, automated test results, and rubric audit trails to maintain credential proof-of-work integrity.

4 Public Verification Hashes vs Private PII

When a certificate is cryptographically ratified, only the following minimal public metadata is accessible via the verification portal (/verify.html):

• Certificate ID (e.g. KL-8F3K9P2M)
• Candidate Legal Name as registered
• Completed Engineering Track & Qualification Grade
• Issue Date & Cryptographic Seal Status

Your phone number, residential address, email address, and raw transaction records remain private and are never surfaced on public verification interfaces.

5 Data Security & Storage Standards

Karvaan Labs implements industry-grade technical and organizational safeguards to protect candidate records:

• Encryption in Transit: All HTTP interactions are enforced over TLS 1.3 encryption with strict HTTP Strict Transport Security (HSTS).
• Encryption at Rest: Database volumes and candidate data stores are encrypted at rest utilizing AES-256 bit encryption.
• Access Controls: Evaluators and administrative personnel access candidate records strictly on a role-based, least-privilege necessity basis with multi-factor authentication (MFA).

6 Third-Party Service Providers & Sharing Rules

We only disclose candidate data to third parties under the following strict conditions:

• Hiring Partners (Explicit Candidate Consent): For candidates qualifying for Honors (score 90+) or fast-track interviews, we share your evaluation dossier, scorecards, and portfolio links with prospective employers only after receiving your affirmative consent.
• Payment Processors: Transaction tokens are processed via secure payment gateways (e.g. Razorpay/Stripe) solely to process authorized charges.
• Transactional Email Services: We use authorized email delivery gateways to dispatch verification tokens, evaluation scorecards, and certificate PDFs.
• Legal Mandates: Where required by valid court order or statutory Indian regulatory authority.

7 Candidate Data Retention & Deletion Rights

Candidate account information is retained for as long as your account remains active. Cryptographic certificate verification indexes are retained indefinitely to guarantee that employers can authenticate your credentials throughout your professional career.

You retain the right to request a copy of your personal data or request the deletion of your account and private contact info by emailing our Data Protection team at privacy@karvaanlabs.in. Upon account deletion, private contact records are purged; however, if you hold an active certificate, the anonymized cryptographic verification record remains queryable to preserve credential authenticity.

8 Cookies & Session Telemetry

We utilize strictly necessary session cookies and local storage tokens to maintain authenticated login states for candidate dashboards and evaluator portals. We do not use intrusive cross-site behavioral tracking cookies. Anonymous aggregate site analytics may be collected to monitor server uptime and page responsiveness.

9 Regulatory Compliance (DPDP Act)

Karvaan Labs operates in full alignment with the Digital Personal Data Protection (DPDP) Act, 2023 of India and standard international data privacy principles. We process personal data solely for specified, legitimate candidate evaluation purposes based on explicit candidate consent.

10 Data Protection Officer & Grievance Desk

For inquiries regarding our privacy standards, data portability requests, or privacy concerns, contact our designated Data Protection Officer: