Privacy Policy

Last updated: August 28, 2026

What we collect

When you join the waitlist or create an account we collect: your name, email, phone (optional), current employer, salary band, coverage preferences, your tech domain (a curated taxonomy — e.g. "Backend", "ML / AI", "Sales", "HR / People"), and years of experience (banded: 0-2 / 3-5 / 6-10 / 11-15 / 16+); plus — optionally — your LinkedIn URL, GitHub URL, and a résumé file (stored in a private Storage bucket; never published as a public URL). We also collect technical/usage data (pages visited, features used, browser, IP address) for security and platform operation. Sign-ups from known disposable / throwaway email domains are rejected at the API boundary to keep junk out of the user base.

How we use it

To: (1) provide and personalise Gatoms services; (2) verify ownership of the email you submit, via a one-time 6-digit code; (3) match you with opportunities and present you to enrolled employers when you authorise it; (4) verify qualifying layoff events and process income-bridge payments; (5) send transactional and (with consent) marketing email. We do not sell your data.

Data sharing

Your data is processed by: (a) Supabase, our database and private Storage provider; (b) Loops.so, our email-delivery provider — and ONLY after you verify your email via OTP, so unverified contacts are never sent to Loops; (c) employers / recruiters only when you explicitly authorise contact; (d) payment processors for billing; (e) sub-processors under written confidentiality agreements. We never share data with your current or former employer without your explicit consent.

Your rights

Under India's Digital Personal Data Protection Act 2023 (DPDP) you have the following rights over the personal data we hold about you. Exercising any of them is free, and we never ask you to justify the request.

  • Access — ask what personal data we hold about you, who we have shared it with, and why.
  • Correction and completion — have inaccurate data corrected and incomplete data filled in — most profile fields you can edit yourself in your account.
  • Download (portability) — get a copy of the data you gave us in a machine-readable format.
  • Erasure — have your account and personal data deleted. You can start this yourself from account settings (“Delete my account”), or email us. The carve-out below explains what survives deletion and why.
  • Withdraw consent — wherever we rely on your consent, you can take it back — and DPDP s.6(4) requires that this be as easy as giving it was. Analytics and non-essential browser storage:the cookie consent control asks before anything non-essential runs, and “Decline” is a single click of the same size and prominence as “Accept”; your answer is kept in that browser only, and clearing this site's stored data makes the control ask again. The Cookie Policy has the exact steps. Marketing email:turn off “Product updates & news” in your notification settings, or use the unsubscribe link in any marketing email. Recruiter visibility:turn off “Profile visible to recruiters” in the same settings page. Withdrawal takes effect going forward — it does not make processing we already carried out unlawful, and it does not remove records we are legally required to keep. Where consent is what lets us run part of your membership, withdrawing it may limit what we can provide; we will tell you plainly if that happens rather than degrading the service silently.
  • Nominate — name someone who may exercise these rights on your behalf if you die or become incapable of doing so. Email privacy@gatoms.com and we will record the nomination against your account.
  • Grievance redressal — complain about how we have handled your data, and escalate if we get it wrong — see “Grievance redressal” below.

To exercise any of these by email, write to privacy@gatoms.com — we acknowledge within 7 days and complete within 30. Our erasure process removes your Loops contact, your waitlist row, and your résumé file from Storage; where you have no payment, membership or activation history, your account is hard-deleted; where financial records exist and must be retained by law, the personally identifiable fields on those records are anonymised (a unique tombstone email replaces the original) and your résumé file is removed. Every erasure writes an immutable audit-log entry.

Data retention

We retain data for as long as your account is active. On account closure or an erasure request we apply the process above. Financial transaction records (payments, memberships, activations) are retained for the period our regulators require, after stripping personally identifiable fields from those rows. Unverified waitlist sign-ups (those who never completed the email OTP) are held only as anonymised funnel data and are not used for outreach.

Security

Data is encrypted in transit (TLS 1.3) and at rest. Production access is service-role-scoped and audited; every destructive admin action writes an immutable audit-log row. Résumés sit in a private bucket with no public URL. We test for and fix common web vulnerabilities — open redirects, ID enumeration, SQL injection, RLS gaps — as part of our development process. In the event of a breach affecting your data, we will notify you within 72 hours.

Cookies

The only cookies we set are the Supabase Auth sb-* session cookies that keep you signed in. Product analytics is provided by PostHog and stored in your browser's localStorage(not cookies), on PostHog's EU host by default. It does not run at all unless you allow it through the cookie consent control, and declining leaves it uninitialised — no identifier, no page views, no request to PostHog. Your answer is itself stored in localStorage on that device so we do not ask again on every visit. See our Cookie Policy for the full table and opt-out instructions.

Grievance redressal

DPDP s.13 gives you the right to a readily-available means of raising a grievance about how we handle your personal data, and requires us to publish who to contact.

Grievance Officer — the role is held by our Data Protection Officer at Gatoms Technologies Pvt. Ltd., Koramangala, Bangalore 560034, India. Write to privacy@gatoms.comwith “Grievance” in the subject line, or post to the address above. We acknowledge every grievance within 7 days and aim to resolve it within 30. You do not need an account with us to raise one.

If we do not resolve it — if we miss that window, or you are not satisfied with our answer, you may complain to the Data Protection Board of India under the DPDP Act. The Act asks you to raise the grievance with us first; the Board is the next step, not the only one, and nothing on this page limits any other remedy available to you in law.

Contact

For privacy questions or requests, contact our Data Protection Officer at privacy@gatoms.com or write to Gatoms Technologies Pvt. Ltd., Koramangala, Bangalore 560034, India. The same office holds the Grievance Officer role described above.