Privacy Notice
Version 2026-10-28 · effective 2026-10-28
This notice explains what personal data Zerohunt collects, why, who it is shared with, how long it is kept, and the rights you have over it under India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and its Rules. We ask for your consent to it when you create an account, and again whenever it changes.
1. Who we are
Zerohunt is operated by [Registered company name], [Registered office address, India] (“we”, “us”). We decide why and how your personal data is processed, which makes us the Data Fiduciary under the DPDP Act.
Questions about your personal data, requests to use your rights, and complaints go to our Grievance Officer: [Grievance Officer name], [grievance email address]. We reply within 30 days.
2. What we collect and why
We collect only what we need for the purposes below. Each is processed on the basis of your consent, except where the DPDP Act allows processing without it — for example to comply with a law or a court order.
| Personal data | Why we process it | How long we keep it |
|---|---|---|
| Account: name, email address, password (stored only as a salted hash), role | Creating your account, signing you in, contacting you about your account, reports and payments | While your account is open; erased within 30 days of closure or withdrawal of consent |
| Researcher profile: handle, display name, country, time zone, bio, skills, specialties, experience, languages, links, availability | Crediting your findings, your public profile and leaderboard place (if you choose public visibility), matching you to programs | While your account is open |
| Payout details: payout method, payout country, whether a tax form is on file | Paying bounties you are awarded and meeting tax obligations | While your account is open, and payment records for as long as tax and accounting law requires |
| Company profile: legal and display name, domain, website, industry, size, country, security contact name, email and phone, billing entity, billing email, tax ID | Running your programs, routing reports to your security contact, invoicing | While your account is open, and billing records for as long as tax and accounting law requires |
| Reports, attachments, comments and disclosures you submit (which may contain personal data you include) | Delivering them to the company or organisation concerned, triage, resolution and payment | While the report is open and for the life of the program; your name is removed when your account is erased |
| Community posts, write-ups, Academy progress, job applications and résumés, enquiries | Providing those features — publishing what you choose to publish, tracking your learning, passing your application to the company you apply to | While your account is open, or until you delete them |
| Sign-in records: IP address, browser and operating system, sign-in and last-active times | Showing you where your account is signed in, letting you sign other browsers out, detecting and investigating unauthorised access | 12 months, then deleted |
| Consent records: what you agreed to, when, IP address and browser | Showing that you gave or withdrew consent, as the law requires us to be able to | While your account is open and for as long afterwards as needed to answer a legal claim |
We do not sell personal data, use it for advertising, or use advertising or analytics cookies.
3. Who sees it
- Companies you report to receive your report, its attachments, your handle and the messages on it. A company you apply to receives your application and résumé.
- The public sees what you choose to publish: a public researcher profile, community posts, approved write-ups.
- Our staff — the platform owner and triage analysts assigned to a program — see what they need to run the platform and triage reports.
- Service providers who host and operate the platform for us ([Hosting provider and region]), under contracts that limit them to our instructions.
- Authorities, when a law or a court order requires it.
4. Where it is stored
Your data is stored with [Hosting provider and region]. If it is ever processed outside India, that will only be in a country the Government of India has not restricted transfers to under section 16 of the DPDP Act.
5. How long we keep it
As set out in the table above. When a purpose is served, or you withdraw consent or close your account, we erase your personal data within 30 days — except what a law requires us to keep, such as payment and tax records, which we keep only for that legal purpose. Reports you filed stay with the companies that received them, without your name.
6. Your rights
- See what you agreed to, and withdraw consent — Settings → Privacy & consent shows each version you agreed to and when. You can withdraw there as easily as you agreed. Withdrawing closes your account, since it cannot run without processing its data; it does not affect processing that happened before.
- Access — ask for a summary of the personal data we hold about you, what we do with it, and who we have shared it with.
- Correction and erasure — correct, complete or update your data (most of it directly in Settings), or ask us to erase it.
- Grievance redressal — complain to our Grievance Officer ([grievance email address]). If you are not satisfied with our answer, you can complain to the Data Protection Board of India.
- Nomination — nominate someone to exercise these rights for you if you die or become unable to.
Under section 15 of the DPDP Act you, in turn, must not give us false information, impersonate someone else, or file a frivolous complaint.
7. Children
Zerohunt is for adults. You must be 18 or older to create an account, and we ask you to confirm it. We do not knowingly process the personal data of anyone under 18; if we learn we have, we erase it.
8. How we protect it
Passwords are stored only as salted scrypt hashes. Sessions are signed and can be ended from Settings, and changing your password signs out every other browser. Two-step verification is available to every account; its secrets are encrypted. Access to the console is limited to our staff. If a personal data breach happens, we will tell you and the Data Protection Board as the law requires.
9. Cookies and browser storage
We use only what the site needs to work: a session cookie that keeps you signed in (7 days), a short-lived cookie during two-step sign-in (5 minutes), and your browser's own storage for unsent report drafts and the programs page's filters. None of it is used to track you across sites.
10. Changes to this notice
Every version is dated. When this notice changes, we ask you to read and agree to the new version before you continue using your account.
11. Language
This notice is in English. You can ask the Grievance Officer for it in any language listed in the Eighth Schedule to the Constitution of India.
Read together with the Terms of Service.
See also: Terms of Service · Privacy Notice