Privacy notice · Dreambud

1. Who we are

Dreambud (“Dreambud”, “we”, “us”) operates the Dreambud website and app. For the personal data described here we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”): we decide why and how it is processed. You are the Data Principal.

2. What we collect and why

We collect personal data only for the purposes listed next to it. We don't use it for anything else without telling you and, where required, asking first.

Account data: email address, password (stored only as a secure hash by our sign-in provider) or Google sign-in. Purpose: to create your account, sign you in and keep it secure.
Profile data: name, headline, city, role, years of experience, company, skills, work history, education, goals, answers to profile questions, an optional photo and project. Purpose: to show your profile to people who fit what you're looking for. Your company is used to hide you from colleagues when stealth mode is on.
Private matching data: the pay you expect or offer, and similar answers marked private. Purpose: matching only. Nobody else ever sees them.
Work email (optional): to verify where you work. We keep the domain to show a Verified mark, and so that only verified people earn credits for referrals.
Resume (optional): one private PDF. Purpose: to share it in a chat when you choose. It's never shown on your card or used for matching, and only the person in a chat you shared it in can open it, while that chat is open.
Opportunity cards: when a hiring team's card picks you, we record that it did and what you decide (claim or pass), your optional note, and whether they contacted you. Purpose: to run the card, move it on to the next person in line, and keep hiring teams accountable.
Waitlist: when you joined, your place in line and when you were let in. Purpose: to let people in gradually and fairly.
Activity: who you connect with or skip, connections, messages, reports, blocks, referral steps and credits. Purpose: to run the service, show your activity, keep the community safe and measure whether introductions work.
Messages: stored so you and the other person can read them. Messages that look like scams or abuse may be held and reviewed by a person to protect users.
Automated safety checks: profiles, Opportunity cards and messages are checked automatically for words that aren't allowed, contact details or fees in cards, and signs of scams. Repeated problems, or reports from several different people, put an account under review by a person; a photo reported by two people is hidden until a person checks it. No decision to ban an account is made by software alone.
Device and technical data: sign-in cookies, IP address and basic browser information. Purpose: security, preventing abuse and keeping the service working. We don't use advertising cookies or third-party trackers.
Optional, with consent only: anonymous usage analytics (which screens are used), personalised sponsored cards, email alerts and device push alerts.

We don't collect government ID numbers, bank details, health data or anything about your caste, religion, politics or sexual orientation, and we ask you not to share them on Dreambud.

When you create an account we ask for your consent to process the data above for the purposes described, with a clear choice for each optional use. Consent is free, specific and informed, and you can withdraw it as easily as you gave it, in Settings. Withdrawing consent doesn't affect processing already done, and if you withdraw consent needed for the core service (for example, showing your profile for matching) we'll ask whether you want to pause or delete your account. Some processing doesn't rely on consent where the law allows it, such as complying with a legal obligation or responding to a lawful request from authorities.

Other members: see your public profile only when you appear in their Discover or Requests, or when an Opportunity card picked you and you claimed it (the hiring team then sees your profile and your note, and can contact you if they accept), never your private answers, pay or contact details. A hiring team doesn't learn that their card picked you unless you claim it. Contact details are shared only when you both choose to share them in a chat. People at your own company don't see you while stealth mode is on.
Service providers (Data Processors): companies that process data on our behalf under contract and only on our instructions: hosting and database (Supabase, servers in Mumbai, India), website delivery (Vercel), email delivery (our email provider), Google (only if you choose Google sign-in) and Cloudflare Turnstile (bot protection on sign-up).
Authorities: only when required by Indian law, a court order or a lawful request, and only what is required.
If Dreambud changes ownership: your data would move only under the same protections, and we'd tell you first.

We never sell or rent your personal data, and we never let advertisers see who you are. Sponsored cards and the one sponsored chat at the top of Chats are shown using only your goal, city and experience level unless you opt in to personalisation; advertisers see only rounded totals of 100 people or more.

5. Where your data is stored

Our main database is hosted in India (Mumbai). Some service providers may process limited data outside India, for example to deliver an email. Any such transfer follows the DPDP Act and is never to a country restricted by the Government of India.

6. How long we keep it

While your account is active, we keep the data needed to run it.
When you delete your account, we erase your profile, photo, resume, goals, answers and private data straight away, and close any Opportunity cards you created. Messages you sent show as “deleted account” to the other person. Backups are overwritten within 30 days.
Before we ever delete an inactive account, we'll email you at least 48 hours in advance so you can keep it.
Reports you made or received are deleted with your account, except where Indian law requires us to keep a record, and then only for as long as it requires.

7. Your rights

Under the DPDP Act you have the right to:

Access: a summary of your personal data and how we process it, and who we've shared it with. Download everything in Settings → Download my data.
Correction and erasure: correct, complete or update your data in your profile, and delete your account in Settings → Delete my account.
Grievance redressal: raise a complaint with our Grievance Officer (below). We acknowledge within 24 hours and aim to resolve within 15 days.
Nomination: nominate someone to exercise these rights for you in the event of death or incapacity. Write to the Grievance Officer to set this up.
Complain to the Data Protection Board of India if you're not satisfied with our response.

You also have duties under the Act: please don't give false information, impersonate anyone or file frivolous complaints.

8. Children

Dreambud is only for people aged 18 and over. We ask for confirmation of age when you sign up and we don't knowingly process the data of anyone under 18. If you believe a child has an account, tell us and we'll delete it.

9. Security and breaches

Data is encrypted in transit and at rest. Access inside our database is limited by row-level security, staff access is restricted and logged, and passwords are never stored in readable form. If a personal data breach affects you, we'll tell you and the Data Protection Board of India without undue delay, as the DPDP Act requires, including what happened, the likely impact and what you can do.

10. Changes to this notice

If we change this notice in a way that matters, we'll tell you in the app before it takes effect and, where needed, ask for your consent again.

11. Contact and Grievance Officer

Grievance Officer: name, email and postal address will be published here before public launch. You can ask for this notice in English or any language listed in the Eighth Schedule to the Constitution of India.

See also our Terms of use and Community guidelines.

In short