What we keep, and why.

Anmoll Wadhwa, sole proprietor, trading as The Wadhwa Ventures (The PM Code), decides what personal data this site collects and why. He is also the person who answers questions about it and the Grievance Officer.

Email: [email protected]. Write from the address you use to sign in, so we can find your records.

• We keep what you give us to run the features you use, and nothing is sold.
• No advertising network sits in the path.
• You can download everything we hold about you, or delete it, from Settings in one step.
• After a delete, Indian law makes us keep a small locked record for 180 days. Section 8 says exactly what.
• Session replay runs only after you sign in, and you can turn it off.

Please do not put health or disability information in a resume you upload. We do not need it.

We use most of this data because you gave it to us to use a feature: your account, resume, answers, tracker, letters, listings and briefs. We use it for that feature and nothing else.

We send the newsletter only if you pressed "Get the newsletter". "Not now" is an equal choice, and we never ask again on our own.

We run analytics to understand and improve the site. You can turn replay off in Settings.

We keep the small legal-hold record in section 8 because Indian law requires it.

These companies process data for us. Each gets only what its job needs.

Some notes you should know:

• Model providers and training. We have set OpenRouter to avoid providers that train on the text we send, and our requests ask for the same. Cloudflare and Groq say they do not train on customer content unless agreed, and TypeSafe says it does not train without consent. TypeSafe does keep telemetry derived from what it processes, under its own terms, to run and protect its service. Once text has gone to a model provider, we cannot recall it.
• Dodo Payments is not our processor. It is an independent seller, and it handles your payment details under its own privacy policy. We receive only ids, amounts and statuses.
• Substack holds your newsletter subscription under its own policy.
• Google explains how it uses data from sites that use its services at www.google.com/policies/privacy/partners/.

We do not sell personal data, and we do not share it with advertisers.

Most of the companies above process data outside India, mainly in the United States. We use them because the site cannot run without them. Each works under its own data processing terms with us. The database itself is in Mumbai.

What the site sets:

• A session cookie that keeps you signed in. It is marked HttpOnly and Secure, and only its hash is stored on our side.
• A short-lived cookie during Google sign-in, to protect the sign-in step.
• An Assessment cookie that remembers a signed-out run in this browser for 7 days.
• A small cookie (pmc_beta) that remembers you closed the beta notice, so it stays closed. It holds no personal data.
• A small cookie (pmc_aoo) that remembers you switched off analytics on this device. It holds no personal data.
• Browser storage that remembers small things, like which daily item you have already seen.
• Google Analytics cookies and Mixpanel storage, for analytics.

Session replay: Mixpanel can record how you move through pages and what you click, so we can play it back and find problems. It runs only after you sign in and confirm you are 18 or older. Text and form inputs are masked by default, and images are blocked. It does not record the resume, Settings, practice answers, cover letters, the Labs brief or checkout pages. Mixpanel keeps replays for 30 days.

To turn analytics and replay off, go to Settings, Privacy and data, and switch off analytics. Clearing your browser data also clears the cookies and storage above.

What "delete" means here. When you choose Settings, Delete everything, we cancel Pro at Dodo first, then remove your account and everything in it at once: resume, answers, results, tracker, letters, listings, critiques, newsletter record and sessions. We also ask Mixpanel to delete your profile.

We keep only what the law requires, locked away from everything else and used for nothing else:

• A registration record (your email, account id, and when you signed up and deleted), because the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 require us to keep registration details for 180 days after an account is closed.
• A consent record (a hashed form of your email and the dates of your consent choices), so we can prove what you agreed to.
• If you posted on Outbid and we had removed something of yours, that removed content and its records, because the same rules require us to keep it for 180 days.

Each is removed automatically when its 180 days end.

Old email addresses. We do not keep a history of email addresses. If you used a different email with us before, write in from it and we will delete those records too.

You can:

• Get a copy: Settings, Privacy and data, Download gives you everything as one file.
• Correct it: edit your skills, resume and preferences in Settings, or write to us.
• Delete it: Settings, Delete everything. Or write to us from your account email.
• Withdraw consent: Settings, Email, Stop the newsletter (section 10).
• Name a nominee: write to us to name a person who can use these rights for you if you die or cannot act.
• Complain: write to our Grievance Officer (section 15).

We identify you by the email address you sign in with. Please write from it.

We reply within 30 days.

Once the relevant parts of the Digital Personal Data Protection Act, 2023 come into force, you may also complain to the Data Protection Board of India after using our grievance process.

Settings, Email, Stop the newsletter takes you off our list at once. You will not be in any list we send to Substack after that.

We cannot unsubscribe you on Substack from our side. If you already get the newsletter, use the unsubscribe link in any issue, or write to us and we will remove you on Substack by hand within 7 days of your request.

The PM Code is for people 18 and older. We ask every new account to confirm it. If you believe someone under 18 has an account, write to us and we will delete it.

• There are no passwords to steal. You sign in with Google or with a single-use link that expires after 15 minutes.
• We store only hashes of sign-in links and session cookies, so a copy of our database cannot sign anyone in.
• The site runs over HTTPS.
• We never store your resume file, only the text read from it, and only if you are signed in.
• We never see your card or UPI details. Dodo handles them.
• AI requests carry the text needed and no name, email or account id.

No system is perfectly secure. If a breach affects your data, we will tell you without delay: what happened, when, what it may mean for you, what we are doing, and who to contact.

We share personal data with a government agency only on a written order that states its purpose, and within the time the law sets. We check each order, keep a record, and tell you about it unless the law stops us.

When this policy changes, we update the date and version at the top. If a change widens what we collect or who sees it, we make it before the collection starts and tell account holders by email.

Anmoll Wadhwa, Grievance Officer, [email protected]. The Grievance Redressal page has the timelines and how to appeal.