Privacy Policy

When you create or use an account, we may collect your name, email, phone number, account role, profile photograph, education, work history, skills, resume and other profile information you choose to submit. We also process job applications, employer or event interactions, messages, course enrollment and progress, and payment order or transaction status where you use those features.

We receive device and service information needed to operate and secure the platform, such as IP address, browser or device information, login activity and essential session cookies. A separate appearance-preference cookie may remember your light or dark theme across TheROAC and Learn.

Payment processing is handled through a payment service provider, such as Razorpay. TheROAC receives information necessary to identify an order, confirm payment status and provide access to purchased services; payment-card entry is handled by the payment provider.

If you choose Continue with Google, we request the Google profile and email permissions needed to sign you in. Google can return your account identifier, email address, name and profile picture. We use these fields to create or find your TheROAC account, confirm your identity, display your profile and manage sign-in. We retain applicable identity and profile fields in your TheROAC account record.

Google Sign-In does not request permission to read your Gmail messages, Google Drive files, contacts or calendars. We do not receive your Google account password. The normal Google Sign-In process does not save a Google access or refresh token in your TheROAC user profile.

Separately, TheROAC may use an authorized Gmail send-only integration to deliver account verification, security and service emails from its sending account. This operational email permission is separate from the permissions requested when a user signs in with Google and does not grant access to the user’s Gmail inbox.

• Create and authenticate accounts, support Google Sign-In and prevent misuse.
• Show user profiles and enable the job, internship, recruiter, event and learning features you use.
• Process applications, communicate application or course updates and provide support.
• Confirm payment status and enable the corresponding service or course access.
• Maintain platform reliability, investigate security incidents and improve the user experience.

We use information received from Google only for the functionality and purposes described here, subject to theGoogle API Services User Data Policy, including its Limited Use requirements. We do not sell Google user data, transfer it to data brokers or advertising platforms, or use it for personalized advertising.

This section includes Google-derived information such as the name, email address, Google account identifier and profile picture obtained during Google Sign-In. Such information is handled as part of your TheROAC account; we do not share your Google password or Google sign-in credentials.

• Infrastructure and data hosting: DigitalOcean and the hosting/database infrastructure used to run TheROAC may process account records, including Google-derived profile data, solely to host and operate the service.
• File storage: Google Cloud Storage processes files you upload, such as resumes, course-related material or profile images. Google-derived profile photographs may be displayed through TheROAC profile features.
• Email delivery: Google's Gmail delivery service may process your name, email address and the content of service messages we send to you, for example verification or application updates.
• Employers, recruiters and other users: Your name and profile information, including a Google-supplied profile photo where used, may appear in TheROAC profile or interaction screens. When you apply to a position or otherwise choose to share information, the relevant recruiter or hiring organization may receive the submitted application and associated candidate information.
• Payment processing: Razorpay may receive transaction and payer details required to process a payment. Google Sign-In account credentials are not sent to the payment provider as part of signing in.
• Legal and security disclosures: We may disclose information when required by applicable law, valid legal process or necessary security investigations, and as part of a business transfer where lawful and subject to applicable notice and consent requirements.

We limit these disclosures to the purpose of providing the requested features, maintaining security or meeting legal obligations. Providers may process information in countries where their infrastructure operates. We do not sell Google user data or share it with advertisers or data brokers.

We use technical and access controls to protect sensitive account and platform data. Our implemented safeguards include:

• Transport security: HTTPS/TLS for browser connections to the production website and API.
• Protected sessions: authentication cookies configured with HttpOnly, Secure on production HTTPS and SameSite restrictions, reducing exposure to client-side scripts.
• OAuth safeguards: a short-lived, browser-bound state value is checked during Google OAuth callbacks to help prevent sign-in request forgery.
• Access controls: server-side authentication, role permissions and ownership checks restrict who can retrieve user, learning and application data; two-factor authentication is supported.
• Password protection: passwords created for email/password accounts are stored using bcrypt hashing, rather than as readable passwords.
• Private documents: uploaded resumes and similar private documents are kept separate from public profile images; private document access uses authorization checks and time-limited signed download URLs.
• Credential handling: cloud-storage service credentials are configured outside the source-code repository, rather than embedded in publicly served site code.

No technical system can guarantee absolute security. We do not claim that every type of data is protected by the same control; for example, a profile image that you choose to display can be publicly accessible, while private resumes require restricted access.

We retain account information, including the fields obtained through Google Sign-In, for as long as needed to provide your account and requested services, keep required transaction or security records, or meet applicable legal obligations. You may stop using Google Sign-In or revoke TheROAC's access in your Google Account settings; this stops future Google authorization but does not automatically delete information already stored in your TheROAC account.

To request access to, correction of, or deletion of your TheROAC personal data, contact query@theroac.com. We may need to verify your identity before acting. Information required for legal, payment, fraud-prevention or dispute purposes may be retained where permitted by applicable law.

You can review or update many profile details through your TheROAC account. You may ask us what personal information we hold, request correction, ask for deletion, or raise a concern about sharing. Applicable rights depend on your location and relevant law.

You can manage permissions granted to TheROAC throughyour Google Account. If you replace a Google-provided profile photograph or change your displayed profile information on TheROAC, those changes affect the platform profile rather than the information in your underlying Google Account.

For questions about Google Sign-In data, service-provider disclosures, security or privacy requests, contactquery@theroac.com.

We update this policy when our handling of personal information changes. Material changes to how we use Google user data will be disclosed and any required consent obtained before using that data for a new purpose.