Privacy Policy
What we collect, why we collect it, and the rights you have over it under India's Digital Personal Data Protection Act, 2023.
This document is not yet in force.
The operating entity and grievance-contact details have not been finalised, so this text is published for review only and does not yet bind either party. Complete lib/legal.ts before accepting real sign-ups.
Who we are
InternWithUs is operated by [Legal entity name — not yet provided]. For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) we are the Data Fiduciary for the personal data described below, and you are the Data Principal.
What we collect
- Account details — your email address (used to sign you in), mobile number, full name, city, and date of birth.
- Why date of birth — to calculate your age. We record whether you are under 18 so we can apply the additional protections the DPDP Act requires for children.
- Student profile — your course, college, skills, and any résumé you upload.
- Employer details — company name, city, website, GSTIN and logo, submitted for verification.
- Activity — internships you apply to, your application stage, placements, certificates issued to you, reviews you write, and listings you report.
- Analytics — only if you accept the cookie banner. If you decline, no analytics data is collected.
We do not collect payment details from students. Students are never charged to apply or to be hired.
Why we use it, and on what basis
We process your data on the basis of the consent you give when you create an account, and we record the moment you gave it. We use your data only to run the marketplace: to authenticate you, to show your application to the employer whose internship you applied to, to issue certificates, and to keep the platform safe.
You may withdraw consent at any time by asking us to delete your account. Withdrawal does not affect processing already carried out.
If you are under 18
The DPDP Act requires verifiable consent from a parent or legal guardian before a child’s personal data is processed, and prohibits tracking, behavioural monitoring and targeted advertising directed at children. We flag under-18 accounts so these protections apply, and we do not run behavioural advertising on this platform.
If you are under 18, do not create an account without your parent or guardian’s involvement. If we learn that a child’s data has been processed without verifiable guardian consent, we will delete it.
Who we share it with
- Employers — when you apply to an internship, the employer who posted it can see your application, your student profile and your résumé. Employers cannot see students who have not applied to them.
- Supabase — our database, authentication and file storage provider.
- Our email provider — receives your email address in order to deliver your one-time login code.
- PostHog — product analytics, only if you accepted the cookie banner.
We do not sell your personal data and we do not share it with advertisers.
Your rights
Under the DPDP Act you may ask us to:
- tell you what personal data of yours we hold and who we shared it with;
- correct or complete anything inaccurate;
- erase your data and close your account — we will delete it unless we are required by law to keep a record;
- nominate another person to exercise these rights on your behalf if you die or become incapacitated.
To exercise any of these, contact [Grievance email — not yet provided]. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
How long we keep it
We keep your account data while your account is open. When you ask us to delete it, we remove your personal data. Certificates already issued remain verifiable, because their purpose is to let an employer or college confirm that an internship was genuinely completed — a certificate that stopped verifying would be worthless to you.
How we protect it
Every table is protected by row-level security, so access is enforced by the database itself rather than only by application code. Traffic is encrypted in transit. Administrative keys are held server-side and are never sent to your browser.
No system is perfectly secure. If a breach affects your data we will notify you and the Data Protection Board as the DPDP Act requires.
Grievance redressal
[Grievance officer — not yet provided] is responsible for answering data-protection questions. Write to [Grievance email — not yet provided] and we will respond within the period prescribed by law.
Changes
If we change this policy we will update the effective date above and, where the change is significant, tell you directly.