Privacy Policy

Master Jobs ("we", "us", "our") is the operating brand of East-West Business Solutions, a company registered in India. We operate a global jobs platform connecting candidates with employers across India, North America, and the Middle East. This Privacy Policy applies to our website, mobile experience, and related services (the "Services").

We comply with the following data protection regimes depending on your location:

• India — Digital Personal Data Protection Act (DPDPA) 2023 and the DPDP Rules 2025.
• United States — CCPA/CPRA (California) and other applicable state privacy laws.
• Canada — PIPEDA and provincial statutes (e.g. Quebec Law 25).
• UAE — PDPL (Federal Decree-Law No. 45/2021).
• Saudi Arabia — PDPL 2023.
• Qatar — Law No. 13 of 2016 on personal data protection.
• European Economic Area — GDPR, where we serve candidates or employers established in the EEA.

We collect three broad categories of data.

2.1 Data you provide directly

• Account details: name, mobile number or email, password-less login verification records.
• Profile details: headline, summary, skills, work experience, education, certifications, preferred roles, desired salary, location preferences, work-style preferences.
• Resume content: PDF or DOC resumes, parsed structured fields, cover letters.
• Application content: cover letters, answers to screening questions, messages with employers.
• Employer data (for recruiter accounts): company name, industry, size, team members, job postings, campaign settings.
• Payments: billing contact and invoice data processed by our payment providers (we do not store full card numbers).
• Support interactions: the content of tickets, feedback, and survey responses.

2.2 Data generated by your use of the Services

• Behavioural: pages you visit, jobs you view, jobs you save, filters you apply, searches you run.
• Device and connection: IP address, user agent, OS/browser, approximate location derived from IP, referring URL.
• Cookies, local storage, and equivalent identifiers — see §12.

2.3 Data from third parties

• Aggregated job listings from public job-board sources where the listing is publicly posted and the source permits redistribution.
• Verification signals (e.g. SMS delivery status from our SMS providers, email bounce status).
• Company review data from public aggregators where integrated.

We process your data for the following purposes:

• Provide the Services — create and authenticate your account, render your dashboard, send the OTP codes you request.
• Match and recommend — compute job recommendations and candidate match scores based on the attributes you declare.
• Enable applications — share your profile and resume with an employer when you apply to one of their postings.
• Communicate — send transactional notifications (application status, interview invites, OTP codes). Marketing notifications are separate and consent-gated.
• Moderate — detect fraud, spam, abuse, and duplicate listings.
• Improve — understand aggregate usage to prioritise features, fix bugs, and refine search relevance.
• Comply — meet legal, tax, and audit obligations.

Under GDPR and DPDPA, we rely on one or more of the following legal bases for each processing activity:

• Contract performance — delivering the Services you signed up for.
• Legitimate interests — improving and securing the platform, preventing fraud. Where relied upon, balanced against your rights.
• Legal obligation — tax, audit, and regulatory requirements.
• Consent — for optional processing (marketing, cross-service sharing, non-essential analytics). You can withdraw consent at any time from Consent settings.

4.1 Specific consent purposes

We ask for granular consent before processing data for any of the following optional purposes. Each can be granted or withdrawn independently from Consent settings.

• analytics — aggregate platform usage measurement.
• marketing_email — product updates and tips by email.
• marketing_sms — product updates by SMS.
• employer_visibility — recruiters can find your profile in candidate search.
• recommendations — personalised job recommendations.
• education_recommendations — recommend education / certification programmes that match your career goals from our education-vertical partners (e.g. Coursera, upGrad, Scaler, Internshala) when our education vertical launches.
• immigration_recommendations — recommend immigration consultants, study-abroad programmes, and relocation services from our immigration-vertical partners when our immigration vertical launches.
• affiliate_group_offers — share relevant offers from our affiliates and group companies (insurance, fintech, HR-SaaS partners) where you have opted in.

We share data only with the parties and purposes set out below.

• Employers you apply to — your profile, resume, and application content. Employers may also see you in recruiter candidate search results if you have not set your profile to hidden.
• Service providers — SMS (e.g. MSG91), email (e.g. Resend), hosting (Vercel, Supabase), analytics (privacy-first providers only), payment processors, customer support tooling. Each operates under a written data processing agreement.
• Verification providers — to validate phone numbers or email deliverability.
• Authorities — when compelled by a valid legal process or to protect the rights, property, or safety of Master Jobs, our users, or others.
• Corporate transactions — if Master Jobs is acquired or merged, your data may transfer with appropriate safeguards.

We do not sell your personal data. We do not share it for third-party advertising without your explicit consent.

We retain data only as long as necessary for the purpose for which it was collected.

• Active account data — for the lifetime of your account.
• Applications — up to 3 years after submission or as required by the employer's record-keeping obligations.
• Logs and audit trails — up to 2 years.
• OTP records — up to 90 days after the code's expiry, then purged.
• Deleted accounts — soft-deleted for 30 days (to allow recovery in case of accident), then hard-purged subject to legal retention obligations.

Your retention summary lives at Privacy settings.

Our infrastructure is primarily hosted in the European Union and the United States. When your data crosses borders, we rely on the legal mechanisms available in your jurisdiction — Standard Contractual Clauses, DPDPA Rule 10 notices, and intra-group data transfer agreements — to provide equivalent protection.

Regardless of where you live, you have the following rights:

• Access — obtain a copy of the data we hold about you.
• Rectification — correct data that is wrong or out of date.
• Erasure — delete your data, subject to legal retention.
• Portability — download your data in a machine-readable format.
• Restriction — limit how we process your data in specific cases.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — at any time, for any processing that relies on consent.
• Complain — to your local supervisory authority (e.g. Data Protection Board of India, your EU DPA, the California Privacy Protection Agency).

You can exercise all of these rights from Privacy settings. We aim to respond within 30 days (or the shorter statutory window in your jurisdiction).

We apply industry-standard safeguards:

• TLS for data in transit.
• Encryption at rest for sensitive fields.
• Principle of least privilege for internal access.
• Audit logs for privileged actions.
• Brute-force, rate-limit, and anomaly detection on authentication paths.
• Vulnerability and dependency scanning.

No system is impenetrable. If we ever suffer a breach that materially affects your data, we will notify you and the relevant authorities within the timelines required by law.

Master Jobs uses AI for job matching, candidate ranking, content moderation, and resume-quality scoring. We commit to the following principles:

• Every AI-generated output is labelled as such in the interface.
• AI recommendations are suggestions — final hiring decisions always involve a human.
• AI decisions do not use protected characteristics (race, gender, age, disability, religion, national origin).
• Match scores are explainable — the factors behind each score are stored alongside it.
• You can opt out of AI-powered features from Privacy settings.

These commitments are codified in our internal AI Constitution and audited via the platform's agent-action log.

The Services are intended for users aged 18 and above. We do not knowingly collect data from children. If you believe a child has submitted data to us, contact us and we will delete it promptly.

We use cookies, local storage, and service-worker caches for:

• Strictly necessary — session tokens, CSRF protection, language and theme preferences.
• Functional — remembering recent searches, dismissed banners.
• Analytics — aggregate usage measurement, subject to your consent where required.

We do not run third-party advertising cookies. You can manage non-essential categories from Consent settings.

We may update this policy when our practices change or laws evolve. Material changes will be announced by in-product notice at least 14 days before they take effect. The date at the top of this page reflects the most recent update.

Privacy questions, access requests, or complaints: hello@masterjobs.com. For all other queries, see our Contact page.

Grievance Officer (India, DPDPA 2023 & IT Rules 2021): Mohan Kancharla, hello@masterjobs.com. Full grievance procedure and statutory escalation routes at /grievance.

Operated by East-West Business Solutions, Bengaluru, Karnataka, India.