Privacy Policy

Effective Date: June 28, 2026  |  Last Updated: September 16, 2026

Revquix (“we”, “our”, or “us”) operates the website https://www.revquix.comand the Revquix platform (the “Platform”): the career platform for professionals and freshers, with career tools, mock interviews, a 1:1 mentorship marketplace, certifications, a coding workspace, and a tech blog. This policy explains what personal data we collect, why, who we share it with, and the rights you have. It is issued under India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and, where applicable, the EU/UK General Data Protection Regulation (“GDPR”).

We are the Data Fiduciary (controller) for personal data processed on the Platform. If you do not agree with this policy, please discontinue use of the Platform.

1. Who this applies to

• Visitors to our website.
• Registered users (mentees / learners).
• Mentors and service providers who offer paid sessions and receive payouts.

2. Personal Data We Collect

2.1 Account & identity

Name, email address, phone number, username (including username history), and a hashed password. If you sign in with Google, GitHub or LinkedIn, we receive your name, email address and profile picture from that provider - we never receive your social-account password. We also keep email-verification status, one-time-password (OTP) records, login/registration attempt logs, and active session records for security.

Google one-tap sign-in. On some pages, Google may offer to sign you in without leaving the page. That prompt is served and rendered by Google, not by us: loading it contacts Google and lets Google know you are on a Revquix page, and it stores sign-in state in your browser. It appears only if you have accepted functionalcookies, and you can stop it at any time by dismissing it or by turning that category off in Cookie Settings. Declining it does not affect the ordinary “Continue with Google” button.

If the Google account you use carries an email address that already has a Revquix account, and Google confirms that address is verified, we connect the two rather than creating a duplicate account - so you can then sign in either way. We email you whenever that happens, with the time and IP address and a link to review and end your active sessions.

2.2 Profile & career data

Work experience, education, projects, skills, external links, and bio; your profile photo and cover image; and any resume you upload. If you make your profile public, it is viewable at /u/<username>and may appear in our people-search directory. You can control your profile's visibility in your account settings.

2.3 Mentor payout data (financial)

If you become a mentor, we collect the bank account details (account holder name, bank name, account number, IFSC) or UPI ID needed to pay you. Account numbers are encrypted before storage. This is the most sensitive data we hold and access is tightly restricted.

2.4 Payments

When you pay for a session, a service or a pack of tool credits, the payment is taken on a hosted checkout run by Razorpay if you are charged in INR, or by PayPal if you are charged in USD. They receive the card / UPI / net-banking or PayPal-account details you enter there; we do not store full card numbers. We store transaction metadata: amount, currency (INR/USD), order/payment/capture IDs, status, refunds, and any coupons used.

2.5 Sessions & interactions

Bookings, attendance records, mock-interview feedback and scores, hourly-session records, disputes, and the Google Meet room each session is held in. Mock-interview feedback is performance-evaluation data about an identifiable person and is shared with the mentee it concerns. See Section 2.6 below for a detailed explanation of how those meeting rooms work.

2.6 Google Meet rooms for sessions

Paid 1:1 sessions and mock interviews take place in a Google Meet room that Revquix creates on its own Google account. Neither the mentor nor the mentee authorises anything, and no Google account of yours is connected: the room is ours, and the only thing you receive is a link to it. This is separate from - and unaffected by - signing in with Google (Section 2.1).

We no longer ask mentors to connect their own Google Calendar. Revquix previously offered mentors an optional Google Calendar connection, under the narrow https://www.googleapis.com/auth/calendar.events.owned scope, so that a calendar event with a Meet link would be created for each of their bookings. That integration has been removed entirely: we no longer request that scope, no longer hold any mentor's calendar authorisation, and the tokens that were stored for it have been deleted. If you connected your calendar while that feature existed, you may also independently confirm the grant is gone from your own Google Account “Third-party apps & services” page.

• What we create:one Meet room per session, made through the Google Meet API using a Google account Revquix owns and administers. No calendar event is created on anyone's calendar. Where a calendar entry is useful, we send you a plain calendar file (.ics) attached to your confirmation email, which your own calendar app adds locally - nothing is written to a Google calendar by us.
• What we store about attendance:after a session, we read Google's record of that specific room and store, per participant, the display name shown in the meeting, a Google-issued participant identifier for signed-in attendees, and the times they joined and left. We use it for one purpose: settling whether a session took place when a mentor and a mentee disagree. We do not read any other conference, and we cannot see anything outside the rooms we created.
• What we do not access: we hold no authorisation over your Google account. We cannot read your calendar, your contacts, your Gmail, or any other Google Workspace data - not selectively, but structurally: there is no grant from you to us to do so.
• Who can see it: the meeting link is visible to the mentor and the mentee party to that session. Attendance records are visible to those two parties and, where a dispute is raised, to the Revquix staff resolving it. We do not sell or share this data with advertisers or any other third party, and we do not use it to train AI/ML models.
• Retention:attendance records are retained with the booking they belong to and are deleted or anonymised with it (Sections 6/7). The credentials for Revquix's own Google account are platform infrastructure and are stored encrypted at rest with AES-256-GCM (see Section 9).

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

2.7 User-generated content & social activity

Blog posts, comments, @-mentions, likes, bookmarks, follows, and related engagement.

2.8 Communications

Contact-form and booking-intake messages, support requests, and newsletter subscriptions.

Your email choices. Which kinds of non-essential email you receive (reminders, tips, your progress report and product news, which includes the newsletter), and a record of every choice you make about them: what you chose, when, where you made the choice (for example at sign-up, in Settings, or from a link in an email), which version of our wording you were shown, and the IP address and browser the choice came from. We keep that record so we can show what you agreed to, and when.

2.9 Automatically collected

IP address, device / browser information, pages visited and usage data. With your consent (see our Cookie Policy) we use Google Analytics 4 and Microsoft Clarity (heatmaps and masked session recordings), and Sentry for error monitoring and (consent-gated) session replay. For blog view counts we store a salted, irreversible hash of your IP address - not the IP itself.

2.10 Revquix Tools (resume & job-description analysis)

When you use our career tools - resume readiness scoring, JD-to-resume matching, the resume builder, interview-question generation and similar - we process the resume file or text and any job description you provide, and we store the report we generate for you. To produce these reports we send the relevant text to DeepSeek, a third-party AI provider (see Section 4). Before it leaves our servers we automatically redact it: your name, email address, phone number, postal address, date of birth and web links are replaced with placeholders, and each employer name is replaced with a neutral label. We do this on every such request, without you having to ask.

2.11 Interests we infer about you

To decide which mentors, services and articles to show you, we build a profile of inferred interests from what you do on Revquix. This is the only category on this page that is not something you told us or something we observed directly - it is what we concluded, so we describe it in full.

• What we infer:skills we think you have, skills you appear to be working on, roles you seem to be targeting, your approximate seniority, subject areas, companies and locations that appeared in job descriptions you analysed, topics you read about, and which of our tools you use. We also keep a single summary of where you appear to be in a job search (for example “preparing” or “interviewing”).
• What we infer it from: your tool reports (Section 2.10), the skills and roles on your own profile, your searches and filters in the marketplace, mentor and service pages you open, articles you read on our blog, sessions you book, and job applications you track. Nothing here comes from anything you do off Revquix, and we do not buy or receive interest data about you from anyone else.
• What we never infer: we do not derive or store interests relating to health, religion, caste, sexual orientation, political opinion, trade-union membership, pregnancy or disability. Terms suggesting these categories are discarded rather than recorded.
• What it affects: the order and choice of recommendations shown to you on Revquix, and whether you receive certain optional emails. It has no effect on pricing, on whether a mentor will accept your booking, or on any decision with a legal or similarly significant effect on you. There is no automated decision-making of that kind on the Platform.
• Your control: from Settings → Your interests you can see every inference we hold and why we made it, remove any of them permanently, add your own, switch personalisation off entirely, and download or delete the whole thing. See Section 7.3.

2.12 Code you write, run and share

In the Playground, in Projects and when solving coding problems we store the code you write: your project files, saved snippets, the restore points you create, a recent history of your runs, and the submissions you make against a problem. We also store the output your program produced.

Your code runs on our own servers, in a sandboxed runner we operate. It is not sent to a third-party execution service.

Asking the AI assistant about your code is a separate act, and it does leave our servers. When you press Explain, Fix, Optimise, Review, Document, Generate tests, Write a README or Explain project, the file - or, for the project-wide action, the files - are sent to DeepSeek as written. Unlike resume text (Section 2.10), code is not redacted: we cannot reliably tell a password from an ordinary string. So do not leave passwords, API keys, tokens or customer data in a file before pressing one of those buttons. Your Revquix account identifiers are never sent. We keep a record of which action you ran and what it cost you in credits.

A project, snippet or canvas is private by default. If you choose to share one, you pick between a secret link that anyone holding it can open, and fully public - which is also indexable by search engines and can be opened and copied by anyone. You can move it back to private at any time, which stops the old link working.

2.13 A GitHub account you connect

Signing in with GitHub (Section 2.1) is one thing. Connecting GitHub so that you can push a Revquix project to a repository is a second, separate thing that you do deliberately and can undo. If you do it, we store your GitHub user ID, username and avatar URL, the authorisation GitHub issues us (encrypted - see Section 9), which permissions it covers, and when it was connected, last used, or revoked.

• What we ask for. By default the connection is granted under GitHub's public_repo permission, which cannot read, write, or even list a private repository. That is a structural limit, not a promise we are asking you to take on trust.
• When we ask for more. The broader repo permission is requested only at the moment you yourself choose to create a private repository from Revquix. If you never do that, we never hold it.
• What we do with it. Create the repository you asked for, and push the project files you chose to push. Nothing else. We do not browse your repositories, read your other code, or act on your behalf in the background.
• How to end it. Disconnect it in Revquix, and independently revoke it from your own GitHub “Authorized OAuth Apps” page.

2.14 Canvas boards

We store the boards you draw, the images you place on them, and whatever you have chosen about sharing - private, a secret link, or public. A public board can be opened, exported and copied by anyone, and may be embedded in an article. Boards you link to a coding project are stored the same way.

2.15 Credits, earning and referrals

Credits are the allowance the AI tools run on. We keep a ledger of every credit granted, earned, spent or reversed, with the reason - which tool run, which bonus, which purchase. Purchases themselves are covered by Section 2.4.

If you invite someone with your referral link, we record the invitation and whether it converted. To stop the programme being farmed, we also record two irreversibly hashed signals about the person who accepted your invite - a hash of their IP address and a hash of a device signature - purely to detect the same person or machine claiming the reward repeatedly. We store the hashes, never the underlying address or device, and they are used for nothing else. A referral that trips these checks may be held for review or refused.

2.16 Messages between you and a mentor

Once there is a booking or order between you, you and the mentor can message each other on Revquix. We store those messages and any files attached to them. They are visible to the two of you, and to Revquix staff resolving a dispute you have raised.

Messages are automatically screened for attempts to move the payment off Revquix - UPI handles and payment links in particular. This is an automated pattern check on the text; no human reads your messages routinely, and the check exists because a payment taken outside the Platform leaves the buyer with no refund right and no dispute process.

2.17 Support requests and tickets

When you contact support or open a ticket we store your message, anything you attach, our replies, and the status of the request. Support staff read these, which is the point of them.

2.18 Two-factor authentication

If you turn on two-factor authentication, we store the shared secret your authenticator app uses - encrypted - along with hashes of your recovery codes and a marker of the last code accepted, so a code cannot be replayed. We never store a recovery code in a form we could read back to you, which is why losing them means re-enrolling rather than asking us for them.

2.19 Searches you run, and appearing in someone else's results

When you are signed in and search for people, we log the query and the filters you used. We also record a profile impressionwhen a profile appears in search results or is visited - which means that when someone finds you, a record of that exists. We use both to detect scraping and quota abuse, to see which searches return nothing useful, and to improve ranking. We do not build a “who viewed your profile” feed out of it.

2.20 Job applications you track

If you use the application tracker, we store the role title, the status you set and when you set it, and the company name only if you type it yourself. We never guess an employer from a job description you analysed - a guessed company name attached to “Rejected” would be a false statement about a real company. What you type here is treated as personal data, is never sent to the AI provider, and is deleted with the row.

2.21 Coding practice

For coding problems and tracks we store your submissions, whether they passed, how long they ran, and your progress through a track, so that your practice history is there when you come back.

3. Why We Use It (purposes & legal bases)

4. Who We Share It With

We do not sell your personal data. We share it only with vendors who process it on our behalf under contract, and every one of them is named - with what it does and exactly what it receives - on our Sub-processor list. That page is kept separately from this one so that adding or removing a vendor is published immediately rather than waiting for the next revision of this policy.

Three points from that page are important enough to repeat here:

• What we send to our AI provider, and what we do not redact. Resume and job-description text is automatically redacted before it reaches DeepSeek (Section 2.10). Source code is not (Section 2.12) - when you ask the code assistant about a file, that file goes as written, so do not leave secrets in it. Your Revquix account identifiers are never sent either way.
• Some things people assume are outsourced are not. Your code runs in a sandbox on our own servers, and the model behind semantic search runs on our own infrastructure. Neither sends your content to a third-party service.
• Analytics and advertising vendors receive nothing until you opt in. See our Cookie Policy.

We may also disclose data to comply with law, enforce our Terms, protect our users, or in connection with a merger or acquisition. Mentors and mentees necessarily see limited profile and booking information about each other in order to deliver a session.

5. International Transfers

We operate from Pune, India, and host our application and databases on cloud infrastructure. Some of the sub-processors listed above process data outside India. Where we transfer EU/UK personal data internationally, we rely on appropriate safeguards such as the Standard Contractual Clauses.

6. How Long We Keep It

• Account & profile: while your account is active. If you request deletion, your account enters a 14-day grace period during which you can cancel the request (a link to cancel is included in the confirmation email). If the grace period elapses without cancellation, your account is anonymized- your name, email, and other identifying profile fields are irreversibly overwritten. We anonymize rather than physically delete every row because some of your data (e.g. completed session records, mentor ratings, blog comments) is also tied to other users' records and cannot be removed without affecting them; anonymization severs your identity from that data instead.
• Transaction & statutory records: retained for up to 8 years, and beyond account deletion, to meet financial and tax-record obligations under law.
• Analytics: per provider defaults (Google Analytics 4 up to 14 months; Microsoft Clarity and Sentry per their retention settings).
• Blog view IP-hashes: retained up to 26 months, then purged.
• Career tool uploads & reports: an uploaded resume file and the text extracted from it are kept for 30 days; the report generated from it is kept for 12 months so you can revisit it, then deleted.
• Inferred interests: the individual records behind each inference are kept for up to 24 months and then deleted, except records of something you told us outright or of a session you booked. An inference itself also fades on its own if nothing renews it, and disappears once it becomes too weak to be useful. You can delete all of it at any time from Settings → Your interests.
• Code, projects and practice: your projects, files and canvases are kept while your account is active. Within a project we keep a rolling window rather than everything forever - the most recent 50 runs and 20 restore points, older ones being pruned as new ones are made. A snippet shared without an account is deleted after 90 days; one saved to an account is kept with it. Records of free daily allowances used are kept for 14 days.
• Messages and support:messages, their attachments and support tickets are kept while your account is active, and are removed or anonymized with it. A message is also part of the other party's conversation, so the anonymization in the first bullet applies here too.
• Credit ledger and referral records: the credit ledger is a financial record and is retained with the transaction records above. The hashed abuse signals described in Section 2.15 are kept with the referral they belong to.
• Searches and profile impressions: retained on a rolling basis for abuse detection and ranking, and removed or anonymized when your account is.
• GitHub connection: the authorisation is deleted when you disconnect it, when you revoke it at GitHub, or when your account is deleted - whichever happens first.
• Data export bundles: a personal data export you request (see Section 7) is available to download for a limited window (currently 24 hours) after it is generated, then automatically removed from storage. You can request a new export at any time.

7. Your Rights

Subject to law, you can:

• Access / Port a copy of the personal data we hold about you - see “Exporting your data” below.
• Correct inaccurate or incomplete data directly in your profile settings.
• Delete your account and data - see “Deleting your account” below.
• Withdraw consent (e.g. cookies, the newsletter and other marketing email) at any time. Marketing email can be stopped one kind at a time, or all at once, from Settings or from the links at the bottom of any such email.
• Object to or restrict certain processing.

7.1 Exporting your data

From Settings → Privacy & Data, you can request a downloadable export of your own data. We generate a ZIP file containing a machine-readable JSON copy and a readable PDF summary. Once generated, the export is available to download for a limited time and you will also receive an email when it is ready.

It covers:

• Your profile and career history - profile fields, work experience, education, projects and links.
• What you bought and what you were charged - mock-interview, hourly-session and 1:1 bookings, service orders, payments, and your credit ledger with its running balance.
• What you made here - resume-builder documents including their contents, coding projects with every file, shared code snippets, and your Canvas boards.
• Your conversations and requests - booking message threads with mentors, both sides, and support tickets you raised.
• Records we keep about your account - referral records, badges (including any that were revoked, with the reason), your tracked job applications, notification preferences, active sessions, your GitHub connection, mentor payout history if you are a mentor, and which version of which legal document you accepted, and when.
• What we inferred - the interest profile described in Section 2.11 together with the records behind it.

What it caps or summarises. Credit history is limited to your most recent entries and booking messages to your most recent messages; a message its sender deleted is listed without its text. Canvas boards are included as records rather than as drawings - the drawing is stored as a file, and you can download it in full from the board itself. Coding practice submissions, and your blog posts, comments, bookmarks and follows, are not in the bundle yet. Your GitHub access token is never included, deliberately: an export is a file you download and keep, and a live credential does not belong in one.

The archive states each of these limits inside itself, so you do not have to rely on this page. Your right of access is not limited by what the button produces - email [email protected] and we will supply anything it leaves out.

7.2 Deleting your account

From Settings → Privacy & Data, you can request account deletion. For your security, we may ask you to verify a one-time code sent to your email before proceeding, and you must type a confirmation phrase to finalise the request. Once confirmed:

• You are signed out immediately on all devices, and cannot sign back in while the request is pending.
• Your account enters a 14-day grace period. We email you a link that lets you cancel the request at any time during this window, restoring full access.
• If the grace period elapses without cancellation, we anonymize your profile (irreversibly overwriting your name, email, and other identifying fields) rather than deleting every associated row outright, since some records are shared with other users (e.g. a completed booking, a rating you left) and cannot be fully erased without affecting them. Where a record is entirely yours and not shared with anyone else, it is deleted outright.
• Your Canvas boards and the files behind them are deleted, as are your coding projects, drafts and practice submissions, your credit ledger, and your inferred interest profile. A shared code snippet is kept but severed from you rather than deleted, so a link somebody else is relying on does not break.
• Your GitHub connection is removed, and with it the access token we held for you. That deletes our copy. It does not end GitHub's side of the grant - to do that, revoke the Revquix app in your GitHub settings.
• Financial and tax-related records (payments, invoices, payout records) are retained beyond deletion as required by law - see Section 6.
• Your record of which legal documents you accepted is kept, because it is evidence of an agreement that was formed - but the IP address and browser recorded alongside it are erased, so the fact survives without the identifiers.
• Deletion may be temporarily blocked or reversed if, at the time it is due to take effect, you have an open session dispute, a pending mentor payout, or an active order - we will email you if this happens so you can resolve it and request deletion again.

7.3 Seeing and changing what we've inferred

From Settings → Your interests you have direct control over the inferred profile described in Section 2.11, without needing to email us:

• See all of it, in plain language, with a one-line explanation of what led us to each conclusion.
• Remove anything that is wrong. A removal is permanent - it is recorded so that the inference is not re-created later, even if we rebuild the profile from scratch.
• Add a skill, role or goal yourself. Anything you state directly outranks anything we worked out on our own.
• Switch personalisation off. We then stop collecting this, stop using what we already have, fall back to our general recommendations, and exclude you from interest-based email. Nothing is deleted, so you can switch it back on.
• Download the whole thing as JSON, or delete it - separately from, and without affecting, your account. If you delete it while personalisation is still on, it will start building again from your next tool run; the page tells you this before you confirm.

The full personal-data export in Section 7.1 also includes this data, so you do not need to have found this screen to receive it.

For any of the above, or anything not yet covered by the in-product controls, email [email protected]. We respond within the timelines required by the DPDP Act. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

8. Children

The Platform is not intended for children. Under the DPDP Act, a “child” is anyone under 18 years of age. We do not knowingly process a child's personal data without verifiable parental consent. If you believe a child has registered, contact us and we will remove the data.

9. Security

We use TLS encryption in transit; encryption at rest for the sensitive credentials we hold - mentor payout account numbers, the credentials for the Google account on which we create meeting rooms, and the GitHub authorisation you grant us if you connect a GitHub account; hashed passwords; multi-factor authentication where you enable it; access controls; and rate limiting. No system is 100% secure, but we work to protect your data and will notify you and the Data Protection Board of personal-data breaches as required by law.

10. Grievance / Data Protection Officer

For privacy questions, to withdraw consent, to exercise your rights, or to raise a grievance, contact our Grievance Officer:

We acknowledge grievances within 24 hours and aim to resolve them within 15 days.

11. If We Email You and You Do Not Have a Revquix Account

Most of this policy is written for people who use the Platform. Separately, we sometimes send email about Revquix to people who are not registered users. If you received a message from us and have never had an account, this section is the one that applies to you.

• What we hold. Your email address, your name if we have it, which campaign was sent to you, and whether it was delivered, opened or unsubscribed. Nothing else - we do not build a profile of you, and none of the inferred-interest processing in Section 2.11 applies to someone without an account.
• Stopping it, in one click. Every such message carries an unsubscribe link, and the standard one-click unsubscribe header your mail client can act on by itself. Using either adds your address to a suppression list, which exists precisely so that we remember not to contact you again. You can also write to [email protected], which is a mailbox we read.
• Being erased entirely. Unsubscribing keeps a minimal record of your address so we do not mail it again. If you would rather we held nothing at all, email [email protected] and say so, and we will delete it - though that means a future campaign could reach you again, because there would be nothing left to match against.
• Complaining. The Grievance Officer in Section 10 handles this the same way as any other privacy grievance, whether or not you are a user.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last Updated” date above, and material changes will be notified in-product or by email. Continued use of the Platform after changes take effect constitutes acceptance of the updated policy.