Privacy Policy

ReadyForRole positions itself publicly as an assessment-led Talent Intelligence and Enterprise AI SaaS ecosystem, serving enterprise HR and GCC leaders, L&D/delivery/engineering leaders, universities and colleges, students, graduates, and career switchers, with offerings that include enterprise pre-screening and assessment, enterprise upskilling, graduate employability programs, individual skill-enhancement plans, non-IT-to-IT career transition, and IT/ITES workforce-readiness programs, under a broad “Assess, Map, Enable, Deploy, Track” framework.

This Privacy Policy, however, is specifically about the one product currently built and operating as the ReadyForRole web application: an AI-assisted self-assessment platform for graduates and early-career candidates. You pick a target job role, tell us how confident you feel in the skills that role needs, then take a role-specific assessment. We compare your self-rated confidence against your demonstrated performance, module by module, and give you an honest, role-specific readiness report.

Doing that requires us to collect and process personal data about you — starting with your name and email, and extending to the answers you give during an assessment and the scores and classifications we compute from them. This policy tells you exactly what that involves.

This policy applies to:

• anyone who creates a candidate account on the ReadyForRole platform (web application);
• anyone who visits our public pages (such as this one) without creating an account; and
• personal data processed by our backend systems, database, and the AI systems and infrastructure providers described in this policy in order to run the assessment platform.

It does not apply to any other product, website, or service that may in future be offered under the ReadyForRole name unless that product links to this policy directly. As of this policy’s effective date, ReadyForRole offers one product: the candidate-facing assessment platform described above. RFR does not currently operate a separate institution, college-administrator, or employer-facing product — see “Who RFR is” below.

ReadyForRole is operated by [COMPANY_LEGAL_NAME], with its registered office at [REGISTERED_ADDRESS] (“RFR”, “we,” “us”). Under Indian data-protection law, RFR acts as the Data Fiduciary for the personal data described in this policy — meaning RFR decides why and how that personal data is processed.

You can reach us at our publicly listed contact address: No. 1, Sudharsanamma Arcade, 1st Floor, 8th Cross, 24th Main Road, JP Nagar 2nd Phase, Bengaluru – 560078, Karnataka, India, or by phone at +91 89712 46458 / +91 94825 37531. This is the address and phone number ReadyForRole publishes for general correspondence; see “Contact us” below.

A few terms are used throughout this policy in a specific sense:

• “Personal data” means any data about an individual who is identifiable by or in relation to that data — for example, your name, email, phone number, or an assessment score that is linked to your account.
• “Data Principal” is the individual the personal data is about — that is, you, the candidate. This is the term used by the Digital Personal Data Protection Act, 2023.
• “Data Fiduciary” is the entity that determines the purpose and means of processing personal data — that is, RFR, as described above.
• “Processing” means essentially anything done with personal data: collecting, storing, using, analysing, sharing, or deleting it.
• “Data Processor” means a third party that processes personal data on RFR’s behalf and under RFR’s instructions, such as a cloud infrastructure or analytics provider — see “How we share your data” below.
• “Assessment data” means the questions shown to you, the answers you give, and the scores, classifications, and report content generated from those answers.
• “Generated data” means data RFR’s own systems create about you from other data you’ve provided — for example, a readiness score computed from your answers. We treat generated data as personal data whenever it is linked to an identifiable candidate, exactly like data you typed in yourself — see “Personal data we collect” below for why.
• “Technical data” means data about the device, browser, network connection, or session used to access the platform, such as an IP address.
• “Anonymised or aggregated data” means data that has had identifying details removed or combined across many candidates such that no individual can reasonably be identified from it. RFR does not currently have an implemented process for anonymising or aggregating candidate data for any purpose — see the relevant notes in “Data retention” below.

This section lists, specifically, the categories of data the platform actually collects and generates today. We’ve grouped it by where it comes from. Importantly: data RFR’s own AI and scoring systems generate about you — your scores, your readiness classification, the narrative content of your report — is personal data in its own right, because it relates to and is derived about you as an identifiable individual. We do not treat it as something lesser just because a machine, rather than you, produced it.

5.1 Data you give us directly

When you create an account and build your profile, you give us:

• your full name, email address, and the password you choose (we never store your password itself — see “How we protect your data”);
• phone number (optional at signup, used elsewhere on your profile);
• your domain/stream of study, education level, year of passing or graduation, college/university name, CGPA, and years of experience;
• country, state, and city;
• LinkedIn, GitHub, and portfolio URLs, and a free-text skills field, if you choose to add them;
• a resume URL field, if you choose to add a link to your resume (see the note below — RFR does not currently let you upload a resume file directly);
• your date of birth and gender, which are optional profile fields (gender includes a “Prefer Not To Say” option);
• a discount/access coupon code, if you use one.

5.2 Data generated through your assessment

Once you start an assessment, the platform generates and stores:

• Assessment responses — the specific answer you choose or write for each question, and how long you spend on it.
• Assessment scores — marks obtained, percentage scores, and a pass/fail-style result status, computed per module and overall.
• Competency and readiness classifications — a “readiness level” and comparable bands computed from your scores. These are judgments our system makes about you, derived from your answers, and we treat them as your personal data.
• Reports — the full narrative report built from the above: an overall score, module-by-module commentary, and recommended next steps. The report can be downloaded as a PDF or emailed to you.
• The specific questions generated for your assessment (including, internally, the correct answers and scoring rubric — this internal content is never shown to you, only your own responses and results are).

5.3 Data generated by our AI systems

See “How AI is used in your assessment” below for a full explanation. In short: our AI systems help generate role-specific questions, help score your free-text answers, and help write the narrative content of your report. The output of that AI processing — generated questions, scoring results, and report text — is stored in our database and becomes part of your assessment record described in 5.2 above.

5.4 Technical and device information

• your IP address, captured on the server side for most requests you make to the platform;
• your browser’s user-agent string (what browser and, broadly, what device/OS you’re using);
• the specific action you took (e.g., viewing your profile, logging in), the API endpoint involved, and a timestamp.

We do not currently collect more granular device fingerprinting information (such as screen resolution, device model, or advertising identifiers).

5.5 Authentication information

• a short-lived access token, held only in your browser’s memory while you’re using the app (never written to disk);
• a longer-lived refresh token, stored as a secure, HTTP-only cookie your browser cannot read with JavaScript, used to keep you signed in between visits;
• if you use “forgot password,” a one-time password-reset token (we store only a cryptographic hash of it, not the token itself).

5.6 Cookies and similar technologies

RFR sets exactly one cookie: the secure, HTTP-only refresh-token cookie described in 5.5 above, used solely to keep you signed in. It is strictly necessary for the platform to function and is not used for advertising, cross-site tracking, or analytics.

We also use your browser’s session storage (cleared automatically when you close the tab) to remember which assessment attempt you have in progress if you reload the page — this never stores your actual answers, only a pointer to the attempt. We do not use your browser’s longer-lived local storage for anything of our own; the only thing stored there is an internal identifier our analytics provider, Mixpanel, uses for its own operation (see 5.7 and “How we share your data” below).

We do not currently use a cookie-consent banner, because we do not set any non-essential cookies that would require one. If that changes in future, this section — and the consent mechanism on the platform — will be updated accordingly.

5.7 Usage and analytics information

Once you have agreed to our Terms & Privacy Policy via the checkbox on our sign-in/sign-up forms, we begin sending basic product-usage events (such as which page you’re on, or that you submitted a form) to our analytics provider, Mixpanel, tied to your account so we can understand how the platform is used and improve it. Nothing is sent to Mixpanel before that consent is given. We configure this integration to not share your raw IP address with Mixpanel.

We process your personal data for the following purposes, and no others:

• to create and maintain your candidate account, and authenticate you when you log in;
• to run the self-assessment and AI-assisted assessment you request, and to generate your report;
• to personalise question difficulty and context to your stated experience level;
• to process payment for a paid assessment, or apply a valid discount/access coupon;
• to send you a password-reset link when you request one;
• to maintain security logs (sign-in activity, IP address, user agent) to protect the platform against abuse, fraud, and unauthorised access;
• to understand, with your consent, how candidates use the platform, so we can improve it; and
• to respond to support, privacy, and grievance requests you send us.

We do not use your personal data for advertising, and we do not sell your personal data to anyone, in any form.

We aim to collect only the personal data that is actually necessary for the purposes above. Several profile fields (such as phone number, LinkedIn URL, and resume link) are optional, and you are not required to provide them to use the core assessment experience. Where a field is required (such as email, or the education/stream information needed to assign you a relevant role and modules), it is because the platform cannot function for you without it.

Where our processing of your personal data relies on your consent — most notably, agreeing to this Privacy Policy and our Terms & Conditions when you sign up, and consenting to analytics tracking — we ask for that consent through an explicit checkbox before the relevant processing begins.

Withdrawal of consent

You may withdraw your consent at any time by contacting us at [PRIVACY_EMAIL]. Withdrawing consent does not affect the lawfulness of anything we did with your data before you withdrew it.

Consequences of withdrawal

Because creating and using an RFR account is itself built on your agreement to this Privacy Policy and our Terms, withdrawing that consent in full will generally mean we can no longer provide you with an active account or run further assessments for you, and we would proceed to close your account and handle your data as described in “Deletion and erasure” below. Withdrawing consent specifically for analytics tracking, on the other hand, does not affect your ability to use the platform at all — it simply stops future product-usage events from being sent to our analytics provider.

We do not sell your personal data. We share it only with the specific service providers needed to run the platform, each acting as our Data Processor under our instructions, and only to the extent described below.

9.1 AI / LLM providers

RFR uses Amazon Bedrock, a managed AI service from Amazon Web Services, to run the AI models (Anthropic’s Claude, and Amazon’s Titan for search) that power question generation, subjective-answer scoring, and report writing. See “How AI is used in your assessment” below for exactly what data is included in a request to these models.

9.2 AWS infrastructure

Beyond Bedrock, we use Amazon OpenSearch (for searching our own internal knowledge base of role and industry-expectation reference material) and Amazon S3 (for storing that same reference material). Neither of these specifically stores your personal data — see 9.4 below.

9.3 Payment processing

For paid assessments, we use Razorpay as our payment gateway. When you pay, Razorpay’s own checkout interface collects your payment details directly — RFR does not see or store your card or bank details.

9.4 RAG / knowledge-base processing

To generate relevant questions, our AI system searches a knowledge base of approved, non-candidate reference material (job descriptions and industry-expectation documents) stored in Amazon OpenSearch and Amazon S3. This knowledge base does not contain, and our systems are specifically designed never to write, any candidate’s personal data, answers, or scores into it. It is a one-way lookup: our system reads from this knowledge base when assembling your questions, nothing about you is added to it.

9.5 Analytics

With your consent (see “Consent” above), we share limited, account-linked usage events with Mixpanel for product analytics, with IP collection disabled on our side of the integration.

9.6 Legal and safety disclosures

We may disclose personal data where required by law, legal process, or a valid order from a court, regulator, or law-enforcement authority, or where necessary to protect the rights, property, or safety of RFR, our candidates, or others.

9.7 Confirmed processor list

Because AI plays a central role in ReadyForRole, we want to be specific — not vague — about exactly what it does, and what it doesn’t do.

10.1 AI generates your assessment questions

A portion of your assessment is drawn from a pre-written, human-reviewed question bank, and the remainder is generated for you specifically by an AI system. That system retrieves relevant context from our approved knowledge base (see 9.4 above) and uses an AI model (Claude, via Amazon Bedrock) to draft questions grounded in that context. Every AI-drafted question is checked against a structural and content schema before it is used.

10.2 AI evaluates some of your answers

Multiple-choice and multiple-select answers are always scored by deterministic code — never by an AI model. Short-answer and long-answer (free-text) responses are scored with the help of an AI model, which compares your answer against a defined rubric for that question. The AI model is also instructed to flag any answer that appears to be attempting to manipulate the scoring process.

10.3 AI writes the narrative part of your report

The numeric scores in your report (marks, percentages, bands) are calculated by deterministic code, not by an AI model. The AI model is used to write the narrative commentary — the summary, the module-by-module discussion, and the suggested next steps — based on those already-calculated scores, your stated experience level, and your name (so the report can address you directly).

10.4 What is, and isn’t, included in an AI prompt

When our systems send information to an AI model to generate a question, score an answer, or write report narrative, that information is limited to: your stated experience level and self-assessment remarks; the specific question, rubric, and your own answer text (for scoring); and, for report writing only, your display name and your already-computed scores. Your email address, phone number, exact date of birth, gender, college name, CGPA, and other profile details are not included in any AI prompt.

10.5 Profiling and automated processing

Our system does compute an overall readiness classification and result status about you from your assessment performance, using a combination of deterministic scoring code and AI-assisted evaluation of your free-text answers, and this classification is then presented to you in your report. This is a form of automated processing of your personal data, and the resulting classification is itself your personal data (see “Definitions” and 5.2 above). RFR’s report is a self-assessment tool for your own use — it does not automatically report your results to any employer, institution, or third party, and it does not, by itself, make any decision about your employment, admission, or eligibility for anything.

10.6 Human review

AI-generated content, like any automated system, can occasionally be inaccurate, incomplete, or miscalibrated. We do not claim that our AI output is unbiased or always accurate, and we encourage you to read your report as one structured, evidence-based input into your own job-readiness picture — not as an infallible verdict.

10.7 Is AI output stored, and does it become part of my record?

Yes. Generated questions, AI scoring output, and AI-written report text are stored in our database and form part of your assessment record, exactly like any other assessment data described in 5.2 above, and are subject to the same rights, retention, and deletion principles described elsewhere in this policy.

Until defined retention periods are implemented, your data remains stored for as long as your account exists, and we are working to put an automated retention and deletion process in place rather than retain data indefinitely by default.

When an account is deleted, your profile, assessment history, payment records, and related data linked to your account are removed from our active systems. Certain security log entries may be retained in a form that no longer identifies you, to help us maintain the security and integrity of the platform for other users.

We apply the following safeguards today:

• passwords are never stored in readable form — they are hashed using bcrypt, a one-way, industry-standard algorithm, before being stored;
• sign-in uses short-lived access tokens and a secure, HTTP-only refresh-token cookie, with automatic rotation and detection of token reuse (a signal of a possibly compromised session);
• repeated failed sign-in or sign-up attempts from the same source are automatically rate-limited;
• every request to our systems is validated against a strict schema before being processed, to guard against malformed or malicious input;
• our database is accessed through parameterised queries, which protect against SQL-injection attacks;
• security-relevant activity is logged, with known-sensitive values (such as passwords or tokens that might otherwise appear in a log) automatically redacted before storage;
• content retrieved from our knowledge base, and instructions given to our AI models, include specific safeguards against prompt-injection attempts.

Access controls

Access to the platform today is limited to the single candidate account type described in this policy — RFR does not currently operate any separate internal admin interface with broader data access, and any operational task that touches the database directly is performed by authorised engineering personnel using controlled tools, not through the public-facing application.

Encryption

As noted above, your password is hashed, not merely encrypted, before storage. Traffic between your browser and our platform is intended to run over HTTPS in production, which encrypts data in transit; the exact TLS/HTTPS configuration is managed at our infrastructure/hosting layer rather than in the application itself.

Incident and data breach handling

We do not claim, and you should not assume, that any system is completely secure. We take security seriously and continue to invest in it, but we cannot guarantee that unauthorised access, loss, or misuse of data will never occur.

Your core account and assessment data is stored in a PostgreSQL database operated for RFR. The AI processing described in this policy (question generation, answer scoring, report writing, and knowledge- base search) currently runs on Amazon Web Services infrastructure configured in the United States (AWS region us-east-1) at the time of writing. This means that, when your assessment answers are sent for AI-assisted scoring, or your name is sent for report writing, that specific processing currently happens outside India.

Where we do rely on the transfer of personal data outside India, we do so on the basis permitted under applicable Indian law, and we expect our processors to maintain appropriate safeguards — subject to the confirmation described in “How we share your data” above.

ReadyForRole is built and positioned for graduates and early-career adult candidates. We do not currently have a confirmed, published minimum-age requirement or an age-verification step in our sign-up process.

Under the Digital Personal Data Protection Act, 2023, you — as the Data Principal — have a number of rights over your personal data. We explain each one below in plain language, together with how you can exercise it on ReadyForRole today. Where a right is not yet supported by a self-service feature in the product, we say so honestly, and tell you how to exercise it manually in the meantime.

16.1 Right to access information about your data

You can ask us to confirm what personal data we hold about you and how we’re processing it.

16.2 Right to correction and updating

You can update most of your own profile information directly from your Profile page while logged in. For anything you can’t change yourself there, email [PRIVACY_EMAIL].

16.3 Right to erasure

You can ask us to delete your personal data — see “Deletion and erasure” above for how this works today.

16.4 Right to withdraw consent

See “Consent” above for how to withdraw consent and what that means for your account.

16.5 Right to grievance redressal

If you’re unhappy with how we’ve handled your personal data or any request you’ve made under this policy, you have the right to raise a grievance with us, and to escalate it further if we don’t resolve it satisfactorily. See our dedicated Support & Grievance page for the full process.

16.6 Right to nominate

Indian law recognises a right for you to nominate another individual to exercise your rights over your personal data in the event of your death or incapacity.

16.7 How to exercise your rights

For any of the rights above, write to us at [PRIVACY_EMAIL] (or use our Support & Grievance page), from the email address associated with your RFR account where possible, so we can verify it’s you.

We may update this policy from time to time — for example, as we close the implementation gaps noted throughout this document, add new features, or change service providers. When we make a material change, we will update the effective date at the top of this page, and where appropriate, notify you directly (for example, by email or an in-app notice). We encourage you to review this page periodically.

If you have questions about this Privacy Policy or how we handle your personal data, contact us at:

• General support: support@readyforrole.com
• General privacy questions: [PRIVACY_EMAIL]
• Grievances: [GRIEVANCE_EMAIL]
• Public contact address: No. 1, Sudharsanamma Arcade, 1st Floor, 8th Cross, 24th Main Road, JP Nagar 2nd Phase, Bengaluru – 560078, Karnataka, India
• Phone: +91 89712 46458 / +91 94825 37531
• Registered office (for statutory/legal purposes): [REGISTERED_ADDRESS]

For account, login, or technical issues rather than privacy questions specifically, please see our Support & Grievance page instead.