Privacy Policy

This Privacy Policy explains how Apna Vikas Online Services Private Limited (“Apna Vikas”, “we”, “us”, or “our”) processes personal data when you use RDY2WRK (the “Service”). RDY2WRK is owned and operated by Apna Vikas. Apna Vikas® is a registered trademark in India.

We are the data controller (and, where Indian law uses that concept, a Data Fiduciary) for personal data described in this policy. Our registered office is at 5, Golden Woods, 1st Cross Road, CSB Layout, Bangalore, Karnataka, India.

In plain terms (summary only — the full policy controls): we use documents you upload, your chat context, and personality insights from your assessment so our AI can respond in context; that material (together with our prompts and research-derived coaching context) may be sent to large language models hosted by cloud providers; and we may update this Privacy Policy at any time by posting a revised version.

1. Who this policy applies to

This policy applies to users of the RDY2WRK mobile application, related websites, registration and marketing flows, and any support or data-request channels we operate. The Service is intended for adults aged 18 and over and is not directed at children.

2. Personal data we collect

Depending on how you use the Service, we may collect the following categories of personal data:

• Account and identity — name, email address, password (stored in hashed form), profile details, login and session identifiers.
• Assessment data — Enneagram assessment responses, scores, completion status, derived personality-related insights, and related timing metadata.
• Project and document data — project names, uploaded files (for example CVs and job descriptions), text extracted from documents, and URLs you submit for fetching.
• AI interaction data — chat messages, voice interaction metadata, tool usage, system and coaching prompts we assemble, and AI-generated responses connected to your account and projects.
• Credits and usage — credit grants (including bonus / promotional grants), consumption, budget-related records, and feature usage needed to operate the Service.
• Payment-related data — purchase references and billing metadata from Google Play (Android) or Razorpay (web / alternative billing, where enabled). We do not store full payment card numbers.
• Device and technical data — device type, operating system, app version, browser type (where applicable), time zone, IP address, referrer URLs, and similar technical identifiers.
• Product analytics (Android app) — aggregated app usage via Google Analytics for Firebase: screen views, session events, sign-in method (guest, Google, email, or password — not your password), assessment and coaching funnel events, in-app purchase outcomes (SKU and status, not payment card data), and device/OS metadata. We use an opaque analytics identifier — not your email or internal account id.
• Security and fraud-prevention data — reCAPTCHA signals, authentication events, rate-limit records, and security logs.
• LinkedIn-related data (if you use it) — LinkedIn profile identifiers, name, and business email submitted during registration or beta flows, as permitted by your LinkedIn authorisation.
• Communications — messages you send us through our data-request or support channels.

3. How we use personal data

We use personal data to:

• create and manage your account and authenticate you;
• provide personality-aware career coaching, assessments, and AI tools;
• store and process your projects, documents, and conversations;
• operate credits, usage limits, promotions, and paid features;
• process payments through app stores and payment providers;
• maintain security, prevent abuse, and troubleshoot errors;
• comply with law and respond to lawful requests;
• improve reliability, performance, and product analytics (see Firebase below);

3.1 Documents, assessment personality context, and cloud AI

A core purpose of the Service is to help AI coaching respond in a way that is relevant to you and to the materials you choose to provide. To do that, we may combine and process:

• Documents and project materials you upload or fetch (for example CVs, job descriptions, and related text);
• your chat and coaching conversation history within a project or session;
• personality-related insights derived from your Enneagram assessment (and related profile signals we generate from that assessment); and
• our own system instructions, prompts, and research-informed coaching / personality frameworks (including customised and fine-tuned research materials we develop or license), which are not your personal data but are used together with your data to shape responses.

That combined context may be transmitted to large language models (LLMs) and related AI services operated by cloud providers (see Section 6) so that the model can generate coaching replies, summaries, interview practice feedback, document review suggestions, and similar outputs. The purpose of this processing is to provide maximum practical coaching value back to you within the Service — not to sell your documents or assessment answers as a standalone product.

You should avoid uploading content you are not entitled to share, and you should minimise unnecessary sensitive third-party personal data in documents or chats. AI outputs remain coaching assistance and require your judgment.

We do not use your assessment answers or documents to make solely automated decisions that produce legal or similarly significant effects about you without appropriate safeguards under applicable law.

4. Lawful bases for processing (GDPR)

If you are in the European Economic Area (EEA) or the United Kingdom, we process personal data on these bases:

Where we rely on legitimate interests, we balance those interests against your rights. You may object to certain processing as described in Section 10.

5. India (Digital Personal Data Protection Act)

If you are in India, we process personal data in accordance with applicable Indian law, including the Digital Personal Data Protection Act, 2023, where it applies. This notice is intended to help you understand the purposes for which personal data may be processed, including AI-assisted coaching that uses your documents, chat context, and assessment-derived personality signals, and the involvement of cloud service providers as described in Sections 6 and 7. You may contact our grievance officer Sumitha Venkatesh using the data-request channel in Section 11.

6. How we share personal data

We do not sell your personal data. We share data only as needed to run the Service:

• Cloud infrastructure providers — including Microsoft Azure and Amazon Web Services (AWS) (and similar providers we may engage from time to time) for hosting, storage, networking, and related infrastructure.
• Cloud AI / large language model providers — including AI services hosted on or accessed via Microsoft Azure, Amazon Web Services, and other cloud AI platforms we engage from time to time, to generate coaching responses. Categories of data that may be included in a model request include relevant document excerpts, chat turns, assessment-derived personality context, and our system prompts / research-informed coaching instructions. Providers may change as we improve the Service.
• Voice / avatar infrastructure providers — where you use talking-head or speech features, related audio/video and session metadata may be processed by specialised cloud services.
• Google — for reCAPTCHA, Google Play billing, and Google Analytics for Firebase on the Android app (usage and funnel analytics; advertising ID collection is disabled in our app build).
• Razorpay — for web / alternative billing payments where enabled.
• LinkedIn — if you choose LinkedIn-related sign-in or registration flows, subject to LinkedIn’s own terms and privacy policy.
• Email delivery providers — to send account, security, payment-related, and support messages.
• Professional advisers or authorities — where required by law or to protect rights, safety, and security.

These recipients act as processors or independent controllers according to their role. We require processors to protect personal data under contractual terms appropriate to the processing.

7. International transfers

Personal data may be processed in India and in other countries or regions where our service providers operate, which may include (without limitation) regions in the United States, the European Economic Area, and other locations used by Microsoft Azure, Amazon Web Services, Google, Razorpay, and other providers listed in Section 6. When document text, chat content, or assessment-derived context is sent to a cloud LLM for inference, that transmission may constitute an international transfer if the provider processes the request outside India.

Where required by applicable law (including for EEA and UK users), we rely on appropriate safeguards for international transfers, such as standard contractual clauses approved for international data transfers and comparable protections in our agreements with cloud and AI providers. For users in India, cross-border transfers are handled in line with applicable Indian law (including any governmental restrictions that may apply from time to time).

8. Retention

• Active account data — kept while your account is active so we can provide the Service.
• After a verified deletion request — we aim to erase personal data within one (1) week, including from backups where practicable.
• Security, traffic, and error logs — kept for up to one (1) week, then deleted or anonymised.
• Payment and billing records — retained for as long as required by applicable tax, accounting, and payment law (which may be longer than one week).

9. Security

We use administrative, technical, and organisational measures designed to protect personal data, including access controls, encryption in transit where supported, and monitoring for abuse. No method of transmission or storage is completely secure; please use a strong, unique password and keep your login credentials confidential.

10. Your rights

EEA and UK users (GDPR)

Subject to applicable law, you may have the right to:

• Access personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase personal data in certain circumstances;
• Restrict processing in certain circumstances;
• Data portability — receive certain data in a structured, commonly used format;
• Object to processing based on legitimate interests;
• Withdraw consent where processing is based on consent (without affecting prior lawful processing);
• Lodge a complaint with a supervisory authority in your country of residence, place of work, or place of alleged infringement. A list of EU data protection authorities is published by the European Data Protection Board.

India

Where applicable under Indian law, you may have rights to access, correction, erasure, and grievance redressal. Contact our grievance officer: Sumitha Venkatesh

All users

We respond to verified rights requests within approximately one month, unless a longer period is permitted by law. Normal access, correction, deletion, and portability requests are handled free of charge. We may charge a reasonable fee or refuse requests that are manifestly unfounded, excessive, or repetitive, as permitted by law.

11. How to contact us and exercise your rights

To exercise privacy rights, request account deletion, or ask questions about this policy, use our secure data-request form:

Submit a privacy or data request

For deletion and sensitive requests, we use two-step verification (for example confirming control of your registered email or account) before completing the request.

We do not publish a public email address for privacy requests on this website to reduce spam.

12. Cookies and similar technologies

Our marketing site may use essential cookies or local storage needed for security (for example CSRF tokens) and basic functionality. If we introduce non-essential analytics or marketing cookies in the future, we will update this policy and, where required, ask for consent before using them.

13. Changes to this Privacy Policy

We may amend, replace, or withdraw this Privacy Policy at any time, in our sole discretion, including without prior notice to the fullest extent permitted by applicable law. The current version will be posted on this page with an updated “Last updated” date.

Your continued use of the Service after an updated Privacy Policy is posted constitutes your acceptance of the revised policy, except where mandatory applicable law requires a different form of notice or consent. We may, but are not obliged to, provide additional notice of material changes through the app, email, or other channels. If you do not agree to a change, you must stop using the Service and may use our data-request form to exercise applicable rights (including deletion, where available).

14. Related documents

Please also read our Terms of Service, which govern credits, payments, promotions, and your use of RDY2WRK.