Security & privacy

Where your files go.

Six steps, four separate consents, and a list of what you can ask for at any time.

Book My Appointment Read the FAQ

Six steps Four consents Six rights

AccessConsents POLICY

CareerOS delivery teamACCESS

YouACCESS

EmployersNO ACCESS

Recruiters and search firmsNO ACCESS

Never sold or brokeredNo exceptions

The journey

Six steps, no detours.

Your materials stay with the CareerOS delivery team and are never shared with employers or recruiters.

Confidential Human-reviewed

01You sendOver a single-use link we email you. Never an email attachment.

02Stored in the delivery workspaceAccess limited to the people working on your engagement.

03A reviewer readsOne named reviewer, who stays with the engagement throughout.

04Drafts return to youNothing leaves the workspace except back in your direction.

05You approveYour sign-off closes each file. Unapproved drafts are not delivered.

06Handover and closeFiles come to you. The document you sent deletes itself 30 days after you sent it.

A quiet, softly lit meeting room ready for a confidential conversation — TrustYour career record is handled like the confidential document it is.

Consents

Four separate switches.

Each one is independent. Turning one off never turns another off.

These are the four consents you will be asked for by email before anything is processed. Nothing is switched on here — this is the screen, shown early.

Checkable facts

What your IT reviewer will ask.

Every line below is a fact about how this actually runs, not a posture. Where we have not done something, it says so.

Who holds the data

TALPRO INDIA PRIVATE LIMITED, CIN U74999KA2020PTC135946, Bengaluru, India. We are the Data Fiduciary under the Digital Personal Data Protection Act, 2023.

Where it is hosted

A dedicated virtual server operated by Hostinger International Ltd, hosted in the European Union. Not a shared platform, not a third-party document service.

Encryption in transit

TLS 1.2 and TLS 1.3 only. Older protocols are refused at the edge. HSTS is enforced with a one-year max-age. Your upload travels over this, not as an email attachment.

How the file reaches us

After you enquire, you receive a single-use link signed with HMAC-SHA256, valid for fourteen days and bound to your reference. It accepts four files. The file type is verified by reading the file's own leading bytes, not by trusting its name.

Storage and access

Written to a directory the operating system permits only the service account to open (0700 directory, 0600 file), under a random filename. There is no public database port, no object-storage bucket and no shared drive. Server access is by SSH key only — password logins are disabled.

What software reads it

Nothing automated. No parser, no scorer, no summariser and no language model runs against your file on our servers. It is opened by the reviewer assigned to your case. The one named exception is a CareerOS agent build (Executive or Professional edition): only with your separate consent in the written scope, CVPRO’s in-house CareerOS agents read your material on OpenAI’s ChatGPT platform, and a named reviewer checks every output. See the CareerOS agents.

Who else touches it

Four sub-processors, and only these (a CareerOS agent build you consent to adds a fifth, OpenAI, the ChatGPT platform the agents run on): Hostinger (hosting, EU), Google Workspace (the email we reply from), Cloudflare (name resolution only — it never receives your documents), HubSpot (the customer record system Talpro India Private Limited uses to track your enquiry — it holds the details you typed, never your uploaded documents). We add none without updating the Privacy Policy first.

How long we keep it

Uploaded documents are deleted automatically 30 days after you send them — measured from the moment the file arrives, not from delivery or handover, so the window cannot quietly stretch. Enquiry records are deleted automatically 90 days after the last message between us. If an enquiry never becomes an engagement, both clocks run anyway. A scheduled process performs all of it — you do not have to ask, and nobody has to remember. Ask sooner and we do it the same working day.

What we measure

One first-party beacon, on this site's own server. No cookie, no third-party script, no advertising pixel, no cross-site identifier — ten named events, ten named fields, and any value containing an @ discarded twice over. A random per-tab identifier in sessionStorage is erased when you close the tab. Records are deleted after 180 days. Section 11 of the Privacy Policy lists the lot.

If something goes wrong

We will tell you within 72 hours of becoming aware of any breach affecting your data, and notify the Data Protection Board of India as the Act requires. You will hear it from us, in writing, naming what was affected.

For organisations

A mutual NDA and a data-processing agreement are available on request before any cohort work begins. Email privacy@talproindia.com.

What we do not claim. The disks are not encrypted at rest. We could say "enterprise-grade security" and most sites would; instead here is the actual position: the protection on your file is operating-system access control on a server only we can reach, plus deletion on a short clock. If at-rest encryption is a requirement for you, tell us before you upload and we will handle your case differently.

We hold no ISO 27001, no SOC 2 and no certification of any kind, and we will not imply otherwise. When we earn one, it will appear here with its certificate number.

Your rights

What you can ask for.

Ask what is held about you, and why

Get a copy of everything we hold

Correct anything recorded wrongly

Withdraw any one consent on its own

Have your files deleted on request

Take every handover file with you

Requests go to the delivery team through the contact form. We do not claim any certification we have not been awarded.

Handling

How your record is handled

A one-to-one working session over documents and a laptop — **Handled under written consent**What is processed, and by whom, is set out before work starts.

A boardroom table with a conference microphone in the foreground — **Deleted on a schedule**Uploaded documents are removed 30 days after they arrive.

A senior woman executive leads a boardroom discussion with colleagues — **Never shared with employers**Your materials do not go to recruiters or hiring companies.

Illustrative photography. People shown are not CVPRO clients or coaches.

FAQFour more answers on handling. For organisationsConsent when a sponsor is paying. About CVPROThe refusals behind this policy.

Next steps

AI providers: no AI provider receives records submitted for CareerOS 360 packages. For coaching programmes, where you consent in writing to AI-assisted evidence preparation, the tool and provider will be named here before first use. No coaching engagement uses one yet. See where AI is used, and where it is not.