Privacy Policy

Who we are

INTERNSHIFT operates an early-career hiring platform that connects candidates, employers, and institutions.

For privacy questions, contact privacy@internshift.in.

Data we collect

• Account data: email address, name, hashed password, role, account status, and verification state.
• Candidate profile data: biography, education, skills, projects, availability, work preferences, and visibility settings that you choose to provide.
• Application data: the opportunities you apply to, your answers, submitted evidence, stage history, and withdrawal records.
• Hiring interaction data: messages with employers, assessment responses, interview details, requested actions, and recruiter feedback.
• Security data: device sessions, sign-in timestamps, coarse device descriptions, and hashed identifiers used for rate limiting.
• Audit data: records of material hiring, permission, consent, and account changes.

Why we process it

• To create and secure your account and keep sessions bounded and revocable.
• To show relevant opportunities and explain why they were matched.
• To deliver your application to the employer you chose and to keep you informed about its progress.
• To let employers evaluate applications they legitimately received, using non-protected criteria.
• To detect abuse, fraud, and automated attacks against accounts.
• To meet record-keeping obligations through audit logs.

Who can see your data

Your contact details are hidden by default. An employer can see your profile evidence only after you submit an application to that employer's opportunity, or where you explicitly grant visibility.

Recruiter access is scoped to their own company membership and is checked on every read and write.

• Employers: only for applications you submitted to them, and only the fields required to review you.
• Service providers: our managed database host and our transactional email provider, which sends verification and password-reset messages.
• Authorities: only where we are legally required to disclose, and only to the extent required.

What we do not do

• We do not sell personal data.
• We do not use protected characteristics for ranking or recommendations.
• We do not reject candidates automatically without human review.
• We do not publish your resume, private answers, or contact details in public search.

Retention

We keep account and application records for as long as your account is active. When you delete your account, profile and identifying data are removed or irreversibly anonymised.

Some records are retained longer where we must: audit entries, moderation evidence, and security logs are kept for a limited period to meet safety and record-keeping obligations, and are then deleted.

Your controls

Export, deletion, and consent controls are available in your account privacy settings.

• Access and export: request a machine-readable copy of your account, profile, and application data.
• Deletion: request account deletion and see what is removed and what is retained.
• Correction: edit your profile, evidence, and preferences at any time.
• Visibility: control employer discovery and matching from your profile settings.
• Consent withdrawal: withdraw a consent you previously granted, without affecting processing already carried out.
• Sessions: review and revoke devices from your security settings.

Security

Passwords are stored using salted scrypt hashing and are never recoverable in plain text. Sessions are bounded, server-validated, and revocable. Authentication endpoints are rate limited.

Report a suspected vulnerability to security@internshift.in.

Changes

We will publish any material change to this policy on this page and update the effective date. Continued use after a change means you accept the updated policy.