Legal · DPDP Act 2023

Privacy Notice

Last updated: 12 June 2026. Governing law: India.

This privacy notice describes how Shortlisted (a venture of Gopalsamy Gokulakannan, sole proprietorship) ("Shortlisted", "we", "us") collects, uses and shares your personal data when you use shortlisted.cc, our chat advisor Edi, or our paid programs.

We process your data under the Digital Personal Data Protection Act, 2023 of India ("DPDP Act") as a Data Fiduciary.

1. What we collect

Contact details — name, email, WhatsApp number, country, current role and years of experience — captured via website forms or in conversation with Edi.
Conversation data — full transcript of every chat with Edi, plus a short AI-generated summary used by our team to follow up.
Payment data — name, email, phone number, billing address and transaction identifiers provided to our payment processor (Razorpay). We do not store full card or UPI credentials on our servers.
Program data — your resume, cover letters, target roles, application history, recruiter responses and interview notes, captured while you participate in a paid program.
Technical data — IP address, user agent, referrer URL, UTM parameters and conversation identifier cookies, used for fraud prevention, analytics and personalisation.

2. How we use it

To respond to your inquiries and run the program you have purchased.
To match you with relevant roles and to apply on your behalf where a Done-For-You package is purchased.
To generate progress reports and weekly briefings for you.
To prevent fraud, abuse and unauthorised access.
To improve our service, including by reviewing Edi conversations to refine our guidance.
To comply with our legal obligations and to defend ourselves in legal proceedings.

3. Legal basis (DPDP Act, Section 4)

We process your data on the basis of your consent, given at the point of starting a chat with Edi or signing up for a program. For payment processing and statutory record-keeping, we rely on the "certain legitimate uses" ground under Section 7 of the DPDP Act.

4. Who we share data with

Payment processors — Razorpay, for processing your payment. Razorpay's privacy policy governs their handling.
Communication tools — WhatsApp (Meta), Cal.com, email providers — used only for messages you have asked us to send or receive.
AI providers — Edi conversations are processed by Ollama Cloud (a third-party hosted LLM API) under a data processing agreement. We do not allow training on your data.
Statutory authorities — when required under Indian law or to enforce our rights.

We do not sell your personal data to advertisers or data brokers.

5. Cross-border transfers

Some of our processors (e.g., Ollama Cloud, email providers) may store data outside India. We transfer data only where the destination country is not restricted under the DPDP Act, or under a contractual safeguard. By using the service you consent to such transfers.

6. Retention

Edi conversations: 90 days from last activity if no payment, indefinitely if you become a paying client.
Lead records: 24 months from last contact, then deleted.
Paying client records: 7 years (statutory accounting retention under Indian tax law), then anonymised.
Payment records held by Razorpay are subject to RBI / Razorpay retention rules.

7. Your rights (DPDP Act, Chapter III)

You may, at any time, ask us to:

Confirm what data we hold about you and obtain a copy.
Correct, complete or update inaccurate data.
Erase data we no longer need (subject to statutory retention).
Nominate another individual to exercise your rights in the event of your death or incapacity.
Withdraw consent. Withdrawal will stop future processing but does not affect anything already done lawfully.

To exercise a right, email [email protected] from the email address associated with your account. We respond within 30 days.

8. Grievance officer

Under DPDP Act Section 8(9), our grievance officer is the founder, Gopalsamy Gokulakannan. Reach them at [email protected]. If we cannot resolve a complaint within 30 days, you may approach the Data Protection Board of India.

9. Children

Shortlisted serves professionals with 3+ years of experience and is not directed at children. We do not knowingly collect data of any person under 18.

10. Changes to this notice

We will post any update to this page and, where the change is material, notify you by email. The "Last updated" date at the top reflects the current version.

This notice is provided in English. If you are based outside India and require GDPR-specific terms (data-subject access requests under EU law), email [email protected] and we will respond under those equivalents.