Privacy policy

ReferMap decides why and how your personal data is used on this service. That makes us the “data fiduciary” under India's Digital Personal Data Protection Act, 2023, and the controller under the GDPR. To reach us about your data, use the contact page. For a complaint, choose “A complaint” and it goes to our grievance officer.

Operated by

ReferMap

Address

Bengaluru, Karnataka, India

Your sign-in email, a handle you choose, your country and state, and your role on ReferMap. Seekers add a profile and a resume, and can pick target roles. Referrers add the company and city they work in. Messages you send to a referrer or seeker, reports you make, and messages you send us through the contact form are kept too.

If you pay, our payment partner Dodo Payments collects your payment details and billing country. We receive your plan, the status of your subscription, amounts, dates and invoice references. We never receive or store your card number.

We also keep basic technical records so the service works and stays safe: when you sign in, the pages that fail, and a hashed network address used only to limit abuse. We ask for your consent when you sign up and record when you gave it.

To run the service: show you jobs near you, match your resume to a role, let a referrer decide on your request, send you the emails about it, keep the service secure, and answer you. We do not sell your data and we do not use your resume to train models.

You agree to this use when you sign up, by a clear action, for the purposes above and no others. You can withdraw that consent at any time, as easily as you gave it, by closing your account in settings or writing to us. Withdrawing does not undo what we did before, and without it we cannot provide the service. We also use your data where the law requires it, for example to keep payment records or answer a court order.

Seekers only ever see a referrer's handle, company, city, team and years at the company. Never a name, photo, personal or work email, or phone number. Where fewer than three referrers share a company and city, the app shows “1-2” instead of an exact number, so a small count cannot point to one person.

To verify where you work we email a one-time code to your work address. We keep only a salted hash of the address and of the code, never the address itself, and we do not write either to our logs. A hash of the address stops the same work email from verifying two accounts.

We read your resume once, when you upload it, to fill in your profile, and then we throw the file away. We keep only the profile you check and save: skills, work history, education and projects. Before a referrer accepts, they see that profile under your first name and last initial, not your contact details. After they accept a request you sent them, they see the contact details they need to submit you. Hire proof files are kept in private storage, opened only with short lived links, and deleted 30 days after the payout that used them.

Job listings come from public job boards and are about companies, not people. We strip email addresses and phone numbers out of job descriptions before keeping them. How we read job boards is on the ReferMapBot page.

Service providers that run ReferMap for us, who act on our instructions: our hosting provider (Vercel), our database and sign-in provider (Supabase), our email provider (Resend), our payment partner and merchant of record (Dodo Payments), our background job service (Inngest, which sees event identifiers and no personal details), error monitoring and page statistics. A referrer sees what is described above for a request you send. We share data when the law requires it. We do not sell your data.

Some of these providers process data outside India or your country. Our database is in Tokyo, Japan, and some providers work from the United States. We use providers that protect data under written terms, and we move data abroad only as the law allows.

Data is encrypted in transit, the database denies access by default and opens only what each person may see, work emails are stored only as salted hashes, and our staff reach personal data only when their job needs it. No service is perfectly secure. If a breach affects your personal data, we will tell you and the Data Protection Board of India as the law requires.

Your account data is kept while your account is open. When you delete your account we delete your profile, resume and messages, and keep only what the law or a dispute requires, such as payment and tax records, for as long as the law requires. Messages you send through the contact form are kept for up to 24 months. Sign-in and abuse records are kept for a shorter time.

You can export your data and delete your account from settings. Under India's Digital Personal Data Protection Act, the GDPR and California law you may also ask us to correct, limit or erase your data, or withdraw consent. Under the Indian Act you may also name another person to use these rights for you if you die or cannot act for yourself. Use the contact page; we answer within 30 days.

If we do not settle your complaint, you may complain to the Data Protection Board of India once it is open for complaints, after you have used our grievance process. You can ask us for this policy in any language listed in the Eighth Schedule to the Constitution of India.

We use cookies to keep you signed in and to remember your theme and the last city you picked on the map. These are needed for the service to work. We measure page speed and visits without cookies. We also count steps such as how many people finish setting up an account, without cookies and without your name, email or phone. Analytics that follow you across visits only run if you agree.

ReferMap is for people aged 18 and over. We do not knowingly collect data from children.

If we change this policy in a way that matters, we will update the date above and tell you in the app.