Legal
Privacy Policy
What we collect, why, who we share it with, and the rights you have over your data.
Effective 5 October 2026 · Version 2026-10-05
1. Who we are
SevyDevy (sevydevy.com, the SevyDevy desktop app and related services, together the "Service") is operated by Saket Bhatnagar, trading as SevyDevy ("SevyDevy", "we", "us"), based in India.
For personal data processed through the Service, we are the:
- Data Fiduciary under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the DPDP Rules, 2025;
- Controller under the EU General Data Protection Regulation ("GDPR") and the UK GDPR.
Privacy contact and Grievance Officer: Saket Bhatnagar, [email protected] · New Delhi, Delhi, India. This person can answer questions about how we process your personal data and handles complaints (section 14).
2. Summary
- We collect what we need to run interview practice, resume tools and your account. We do not sell your personal data.
- Our free Learn guides show ads from Google. Ads are personalised only with your consent; nowhere else on SevyDevy runs ad code.
- Your interview answers, code, designs, resume and voice are processed by AI services to give you feedback. We do not use your content to train AI models.
- We do not store your voice recordings. Audio is turned into text and discarded.
- Analytics and session-recording cookies run only if you allow them.
- You can access, correct, download or delete your data by emailing [email protected].
- The Service is for people 18 and over.
3. The personal data we collect
3.1 Data you give us
| Category | Examples | When |
|---|---|---|
| Account | Name, email address, username, password (stored securely in a form no one at SevyDevy can read) | Sign-up |
| Google sign-in | Your Google account ID, name and email address. We do not receive your Google password or contacts. | If you choose "Continue with Google" |
| Profile and onboarding | Headline, intro, location, current title and company, experience, graduation year, target roles, skill self-ratings, weekly study hours, links (GitHub, LinkedIn, X), projects, experience entries, contact details you choose to add | If you fill them in |
| Resume and job descriptions | Resume text, page images of an uploaded PDF, job descriptions you paste, optimised versions | Resume builder, ATS check, optimiser, setup, job applications |
| Practice content | Typed and spoken interview answers (as text), code, system-design answers and diagrams, whiteboard content, Lala chat messages, feedback you send us | When you use the practice features |
| Voice | Short audio recordings of your speech | Only when you turn on the microphone |
| Booked interviews for someone else | The candidate's name and email address, and a note you write about them | If you invite another person to a Lala interview |
| Job applications | The resume snapshot you submit, your application status and notes | If you apply to a referral opening |
| Payments | Order ID, payment ID, amount, pack purchased, and the phone number you enter at checkout. Card, UPI and bank details are collected by our payment processor, not by us. | Purchases |
| Support and communications | Emails and messages you send us, and our replies | When you contact us |
3.2 Data we collect automatically
| Category | Examples |
|---|---|
| Device and connection | IP address, browser type, operating system, device type, approximate location derived from IP (country or city level) |
| Security | Sign-in activity and signals we use to detect abuse and keep accounts safe |
| Usage | Features used, credits spent, pages visited, errors, performance timings |
| Analytics (only with your consent) | Page views, clicks, scrolls, and session recordings with typed text masked. See the Cookie Policy. |
| Storage on your device | Drafts, preferences, theme and recent chat history kept in your browser so your work and settings survive a reload |
3.3 Data from others
- Google, if you sign in with Google.
- Another user who invites you to a booked Lala interview gives us your name and email address. They are responsible for having your permission to share it.
- Our payment processor tells us whether a payment succeeded.
3.4 Data we do not want
Please do not put sensitive information in your resume, answers or profile: health, religion, caste, sexual orientation, political opinions, government ID numbers, financial account numbers, or photos of other people. We do not need it and do not intentionally process it. If it appears in content you upload, we process it only as part of that content, to provide the feature you asked for.
Your voice is not used to identify you. We do not create voiceprints or any other biometric identifier.
4. Why we use your data, and on what legal basis
The GDPR requires us to state a legal basis. Under the DPDP Act, we rely on your consent, given when you create your account and when you choose to use a feature, or on a legitimate use under section 7 of the Act (for example, data you give us voluntarily for a specific purpose, or compliance with law).
| Purpose | Data used | GDPR basis | DPDP basis |
|---|---|---|---|
| Create and secure your account; sign you in | Account, Google sign-in, security | Contract | Consent; voluntary provision (s.7(a)) |
| Provide practice, AI feedback, resume tools and voice features | Practice content, resume, voice, profile | Contract | Consent |
| Tailor Lala's questions using your resume and setup answers | Resume-derived details, onboarding answers | Consent (you choose to import your resume during setup) | Consent |
| Run booked interviews, including invitations to another person | Booking data, candidate name and email, transcripts | Contract with the booker; legitimate interests for the candidate, who can object | Voluntary provision; consent of the candidate when accepting |
| Process payments, issue credits, keep tax and accounting records | Payment data | Contract; legal obligation | Voluntary provision; compliance with law |
| Share your application with a hiring company when you apply to a referral opening | Job application, resume snapshot | Consent (you choose to apply) | Consent |
| Show your public profile | The profile fields you publish | Consent (you choose to publish) | Consent |
| Send service emails (verification, password reset, bookings, application updates) | Email address | Contract | Voluntary provision |
| Send occasional product news and new guides | Email address | Legitimate interests (you can opt out any time) | Consent |
| Prevent fraud, abuse and credit misuse; keep the Service secure | Security, device, usage | Legitimate interests; legal obligation | Legitimate use; compliance with law |
| Understand and improve the Service | Usage data; analytics with your consent | Legitimate interests for aggregated usage; consent for analytics cookies and session recordings | Consent |
| Show ads on free Learn guides | Device, browser, IP address, ad cookies | Legitimate interests for non-personalised ads; consent for personalised ads | Consent |
| Comply with law, respond to lawful requests, enforce our Terms | Any relevant data | Legal obligation; legitimate interests | Compliance with law |
Where we rely on legitimate interests, we have weighed them against your rights, and you can object (section 10).
Where we rely on consent, you can withdraw it at any time by emailing [email protected], or for cookies through the cookie settings. Withdrawing does not affect processing that already happened. If you withdraw consent a feature needs, we may not be able to provide that feature.
5. AI processing
Lala, SevyDevy's interview partner, and our review tools are powered by artificial intelligence. When you use them:
- The content needed for the request (for example your answer, the conversation so far, your code, your resume text or page images, or your recording) is sent to AI processing providers, who generate the response or transcription and return it to us.
- We do not use your content to train AI models.
- AI output can be wrong, incomplete or biased. Lala's reviews and scores are practice feedback, not a judgement of your ability and not a hiring decision. See the AI Use Notice.
- No automated decisions with legal or similarly significant effects. We do not make decisions about you, such as hiring or eligibility decisions, based solely on automated processing. If you disagree with an AI review, email us and a person will look at it.
6. Who we share data with
We do not sell personal data. Apart from Google's ads on Learn guides (below), we do not share it for targeted advertising. We share it only with:
| Recipient | What and why |
|---|---|
| Infrastructure providers (hosting, edge network, database, file storage) | To host and serve the Service and store your data |
| AI processing providers (language, vision and speech AI) | To generate feedback, transcribe speech and produce Lala's voice (section 5) |
| Payment processor | To take payments, prevent payment fraud and issue receipts |
| Email delivery providers | To send service emails and product news |
| Bot-protection provider | To tell real people from bots at sign-up, login and credit redemption |
| Analytics providers (only with your consent) | To measure usage and record sessions with typed text masked |
| Only if you choose Google sign-in | |
| Advertising provider (Google AdSense) | Only on our free Learn guides: your IP address, device and browser details and ad cookies, to show and measure ads and prevent ad fraud. Personalised ads only with your consent. See the Cookie Policy. |
| The person who booked your interview | If you sit a Lala interview someone else booked for you, they can see the transcript and Lala's review, unless they chose not to share them with you |
| Hiring companies, and their employees who refer candidates | Only when you apply to a referral opening, and only your application and the resume you submitted |
| The public | Only profile information you choose to publish |
| Authorities and advisers | When required by law, court order or a lawful government request; to protect rights, safety and security; and our professional advisers, under confidentiality |
| A successor business | If SevyDevy is merged, acquired or its assets transferred. We will tell you before your data becomes subject to a different privacy policy. |
You can ask us for the current list of our service providers by category and country at [email protected].
7. International transfers
We are based in India. Our providers operate globally, so your data may be processed in India, the United States, the People's Republic of China, the European Union and other countries where our providers or their infrastructure are located.
- From the EU/EEA, UK or Switzerland: where a country has no adequacy decision, we rely on the safeguards our providers offer, such as the European Commission's Standard Contractual Clauses (with the UK Addendum) or the EU–US Data Privacy Framework. You can ask us for details at [email protected].
- From India: we transfer personal data abroad in line with section 16 of the DPDP Act and any restrictions notified by the Government of India.
8. How long we keep data
We keep personal data only as long as the purposes in section 4 need it, then delete or anonymise it.
| Data | How long |
|---|---|
| Account and profile | While your account is active. Deleted within 30 days of a deletion request. |
| Inactive accounts | If you do not sign in for 3 years, we email you, and delete the account 30 days later unless you sign in |
| Voice recordings | Not stored. Processed in memory for transcription only, then discarded. |
| Interview transcripts, reviews, Lala sessions, practice content, resumes | Until you delete them or your account |
| Lala Navigator requests (the text of the request, the page chosen, usage counts) | About 3 months |
| Booked-interview candidate name and email | With the session, until it is deleted or the account is deleted |
| Job applications | Up to 12 months after the opening closes. The hiring company keeps what it received under its own policy. |
| Payment and invoice records | 8 years, as Indian tax and accounting law requires |
| Security and access logs | Up to 1 year |
| Verification and password-reset links | Expire within 24 hours |
| Support emails | 2 years after the conversation ends |
| Analytics (with consent) | Analytics events up to 14 months; session recordings up to 30 days |
| Backups | Overwritten on a rolling basis by our database provider |
We may keep data longer where the law requires it, or to establish, exercise or defend legal claims, and only for that purpose. Aggregated statistics that cannot identify you may be kept indefinitely.
9. Security
We use industry-standard technical and organisational measures proportionate to the risk, including encryption in transit and at rest, secure password storage, access controls, and protection against automated abuse. Access to personal data is limited to what is needed to run the Service.
No system is perfectly secure. If a personal data breach affects you, we will tell you and the authorities as the law requires: under the DPDP Rules, the Data Protection Board of India within 72 hours and affected users without delay; under the GDPR, the supervisory authority within 72 hours where required, and affected users without undue delay where the risk is high.
10. Your rights
Depending on where you live, you have the rights below. We honour the core rights for every user, wherever you live.
| Right | What it means |
|---|---|
| Access | A summary or copy of your personal data, how we process it, and who we shared it with |
| Correction and completion | Fix inaccurate or incomplete data. Most fields are editable in your profile. |
| Erasure | Delete specific data or your whole account |
| Portability (GDPR) | Receive the data you gave us in a machine-readable format |
| Restriction and objection (GDPR) | Limit processing, or object to processing based on legitimate interests or to marketing |
| Withdraw consent | At any time, without affecting past processing |
| Nominate (DPDP Act) | Nominate someone to exercise your rights if you die or become incapacitated |
| Grievance redressal | Complain to us and get a response (section 14) |
| Complain to a regulator | India: the Data Protection Board of India, after first using our grievance process. EU/EEA: your local data protection authority. UK: the Information Commissioner's Office. |
How to use them: email [email protected] from your account email address. Many items, such as resumes, Lala sessions and interview content, can also be deleted directly in the product. We may ask you to confirm your identity. We reply within 30 days. For complex GDPR requests we may extend this by up to two further months and will tell you why. Requests are free unless they are clearly unfounded or excessive.
11. Children
The Service is only for people aged 18 or over. We do not knowingly collect personal data from anyone under 18, and if we learn we have, we delete it. If you believe someone under 18 has given us data, email [email protected].
12. Cookies and similar technologies
We use strictly necessary cookies and browser storage to run the Service, and analytics cookies and session recording only with your consent. On our free Learn guides, Google AdSense sets advertising cookies; ads are personalised only with your consent. We treat a Global Privacy Control signal as a refusal of analytics. Details: Cookie Policy.
13. Public profiles
New profiles are private until you choose to publish them. If you publish your profile, anyone can see what you publish, search engines may index it, and others may copy it. You can unpublish your profile, or turn off search indexing, at any time in your account settings. Search engines may take some time to drop cached copies.
14. Grievances and contact
- Grievance Officer: Saket Bhatnagar
- Contact: [email protected] · New Delhi, Delhi, India
We acknowledge complaints within 48 hours and aim to resolve them within 30 days. Personal-data grievances are resolved within 90 days at most. If you are not satisfied, you can escalate to the Data Protection Board of India or your local regulator. See Grievance Redressal & Contact.
15. Changes to this policy
We update this policy when our practices change. For material changes, we tell you by email or in the product at least 15 days before they take effect, and ask for fresh consent where the law requires it. The date at the top shows the current version.
16. Language
This policy is written in English. If a translation differs from it, the English text prevails, except where the law requires otherwise.