Global Privacy Policy

This Global Privacy Policy (“Policy”) outlines how Domain Expansion (“Company”, “we”, “us”, or “our”), operating the Jinzai (人材)AI Resume & Talent Platform (“Platform”, “Service”), collects, uses, protects, and discloses your personal data. This policy is formulated in compliance with worldwide data protection frameworks including:

• European Union & UK: General Data Protection Regulation (GDPR / UK GDPR)
• United States: California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), VCDPA, CPA
• India: Digital Personal Data Protection Act, 2023 (DPDPA) & Information Technology Act, 2000 (IT Act)
• Canada & Brazil: Personal Information Protection and Electronic Documents Act (PIPEDA) & Lei Geral de Proteção de Dados (LGPD)

1. Scope and Identity of the Data Controller

Domain Expansion acts as the Data Controller for personal data collected through Jinzai. If you use Jinzai through an institutional license (such as a university or college placement portal), Domain Expansion acts as the Data Processor, while your educational institution is the primary Data Controller.

2. Information We Collect

We collect information strictly necessary to provide our resume building, AI rewriting, and job-matching services:

• Account & Identity Data: Full name, email address, encrypted authentication credentials, role (individual user, student, placement coordinator), and institutional student ID numbers where applicable.
• Resume & Professional Profile Data: Work experience, job titles, employer names, education history, GPA, degrees, certifications, technical skills, portfolio links (GitHub, LinkedIn, website), profile photos (optional), and custom resume sections entered or uploaded by you.
• Document Uploads: Original PDF, DOCX, TXT, or image files uploaded for resume parsing and text extraction.
• Billing & Transaction Records: Transaction IDs, payment amounts, subscription plans, and timestamps. Note: We do not store raw credit card numbers or banking PINs; all payments are processed through PCI-DSS certified payment processors (e.g., Cosmofeed, UPI payment providers, Stripe/Razorpay).
• Technical & Telemetry Data: IP address, device type (desktop, mobile, tablet), browser user-agent, operating system, session identifiers, and aggregated page navigation statistics.

3. How We Process & Use Your Data

Your data is processed for specific, explicit, and legitimate purposes:

• Generating, formatting, and rendering vector A4 resumes across 78 engineered templates.
• Powering AI features: bullet rewriting, STAR quantification, ATS similarity scoring, skill extraction, and cover letter synthesis.
• Facilitating secure user authentication, password resets, and session management.
• Managing subscription entitlements, payment verifications, and institution seat allocations.
• Detecting, preventing, and mitigating fraudulent transactions, account abuse, and security vulnerabilities.
• Fulfilling legal, statutory, and tax compliance obligations worldwide.

4. AI & Large Language Model (LLM) Processing Guarantees

5. Legal Bases for Processing (GDPR / UK GDPR)

For individuals located in the European Economic Area (EEA) and the United Kingdom, our processing is grounded on:

• Contractual Necessity (Article 6(1)(b)): To deliver the Jinzai platform, resume editor, and export services requested by you.
• Legitimate Interests (Article 6(1)(f)): To maintain platform security, prevent unauthorized account sharing, and enhance user experience.
• Consent (Article 6(1)(a)): When you explicitly opt into AI automated analysis, resume parsing, or direct email notifications.
• Legal Compliance (Article 6(1)(c)): To maintain statutory accounting and transaction audit records.

6. Your Worldwide Privacy Rights

Regardless of your geographic location, Jinzai provides the following core privacy rights:

• Right of Access & Portability: You can download a complete JSON copy of your resume data at any time directly from the editor.
• Right to Rectification: You may edit and update your personal and professional profile details 24/7 in real time.
• Right to Erasure (“Right to be Forgotten”): You can request permanent deletion of your account and all associated resumes by contacting our support team.
• Right to Restrict or Object to Processing: You may object to automated evaluation or request human review of support tickets.
• Right to Withdraw Consent: Where processing is consent-based, you may withdraw consent without affecting prior lawful processing.

7. California Privacy Notice (CCPA / CPRA)

For California residents under the CCPA/CPRA:

• We DO NOT Sell or Share Personal Information: Jinzai has never sold, rented, or monetized personal user data to third-party data brokers or advertising networks.
• Right to Non-Discrimination: We will never deny services, charge different prices, or provide a lower quality of service if you exercise your CCPA rights.
• Authorized Agent: You may designate an authorized agent to submit requests on your behalf with written authorization.

8. India DPDP Act 2023 & IT Rules Compliance

Under the Digital Personal Data Protection Act, 2023 and Information Technology Act, 2000:

• Personal data is collected with clear, unambiguous, itemized consent notices.
• Data Principals enjoy full statutory rights to access, correct, update, and erase their personal data.
• We enforce Section 43A reasonable security practices including end-to-end HTTPS, bcrypt password hashing, and encrypted database connections.

9. Data Retention & Deletion Schedule

• Active Accounts: Resume drafts and profile information remain stored securely until you delete them or delete your account.
• Deleted Accounts: Upon an account deletion request, personal profile data and resumes are permanently purged within 30 days.
• Financial Audit Logs: Transaction ledgers and invoice metadata are retained for 7 years solely to satisfy statutory taxation and corporate accounting laws.

10. International Data Transfers

Jinzai operates globally utilizing cloud infrastructure hosted in tier-3 and tier-4 data centers (e.g., AWS Neon PostgreSQL in us-east, Vercel edge networks). When transferring data across borders, we implement recognized transfer mechanisms such as Standard Contractual Clauses (SCCs) approved by the European Commission.

11. Children's Privacy (COPPA / GDPR Art. 8)

Jinzai is intended for job seekers, university students, and professionals aged 16 and older. We do not knowingly collect personal data from children under 16. If we become aware that a child under 16 has created an account without parental consent, we will promptly delete the data.

12. Data Protection Officer & Grievance Redressal

For inquiries, data subject access requests (DSAR), or privacy complaints, please contact our designated Privacy and Grievance Officer: