Privacy notice
Version 2026-10-11 · last updated 11 October 2026
Brightspark ("we") is a free job finder run by BrightSparkHQ in Bengaluru, India. This notice explains, as India's Digital Personal Data Protection Act, 2023 requires, what personal data we process, why, on what basis, who else gets it, how long we keep it, and your rights. For this data we are the Data Fiduciary; you are the Data Principal.
What we collect, and why
We process your personal data on the basis of your consent, given when you request an invite or join, and only for the purposes below. We do not sell it.
| Data | Purpose | Kept until |
|---|---|---|
| Invite request: email, name, optional note | Review your request and email your invite. | 180 days after we handle it (a year if never handled), or straight away when you delete your account |
| Account: name and email from Google sign-in; your consent and 18+ confirmation | Sign you in, email you about your account, and keep proof of your consent. | You delete your account (the invite you joined with goes too) |
| Profile: skills, certifications, roles you want, experience, current title and employer, current and expected salary, notice period, work modes, dealbreakers, ranking weights | Find and rank jobs for you. Only you see it. | You delete your account (or edit it) |
| Job activity: shortlisted jobs, hides, ratings, applied marks, notes | Your shortlist and Applied tab, and tuning your ranking. | You delete your account |
| Usage: last sign-in and last active times; when you open a job's posting or mark it applied | Understand how Brightspark is used, and spot misuse. Seen by admins. | You delete your account |
| Feedback, company suggestions and custom role families you create | Improve Brightspark, add the companies you ask for, and your own role families. | You delete your account (families you share stay, without your name) |
| Account restrictions: whether you are blocked, until when, and why | Enforce the terms against misuse, and tell you about it. | The block ends, or you delete your account |
| Data protection requests you make, and our answers | Answer them, and keep the record that we did. Kept even if you delete your account, as proof we handled the request. | 3 years after we answer |
| Server logs: IP address, pages requested, times | Keep the service secure, and detect and investigate misuse or breaches. | 1 year |
If you upload your resume, it is read once on our server, in memory, to suggest your skills, certifications, current role and experience, and is then discarded: the file and its text are never written to disk, stored or logged. If you paste resume text instead, it is read in your browser and not sent to us. Only the details you then save are kept.
Backups that contain deleted data are overwritten within seven days.
Who else processes your data
These service providers process data for us, only for the purposes above:
- Google (sign-in): Your sign-in with Google; we receive your name and email from it.
- SendPulse: Your name and email address, to send invite and welcome emails.
- OpenWeb Ninja: Job title, company, location and an experience band when you ask for a company salary estimate; nothing that identifies you.
- Google Analytics: Only with your consent: page visits and a random identifier.
- Google AdSense: Only with your consent: the page address, IP address, device details and ad cookies.
- DigitalOcean: Hosts our servers and backups in its data centres; it does not use the data itself.
Some of them process data outside India. We do not transfer personal data to any country the Government of India has restricted. We may also disclose data where the law requires it.
Job listings
Listings come from employers' careers sites and from open job boards. Apply links take you to the employer's site or the job board, each with its own privacy policy.
Cookies and similar storage
We use a few cookies and browser storage items of our own that the site needs to work, and, only if you allow them, cookies from Googlefor analytics and ads.
| Name | What it is for | Kept for | Type |
|---|---|---|---|
pb_auth | Keeps you signed in. | Until you sign out, or your session expires | Necessary cookie |
bs_oauth | Protects Google sign-in while it is in progress. | 10 minutes | Necessary cookie |
theme | Your light or dark theme choice. | Until you clear it | Local storage |
analytics-consent, ads-consent | Your cookie choices, so we do not ask again. | Until you clear them | Local storage |
feedback-snoozed-until | Remembers "Not now" on the feedback prompt. | 30 days | Local storage |
_ga, _ga_* | Google Analytics: counts visits with a random identifier. | Up to 2 years | Optional: analytics |
__gads, __gpi, __eoi, and cookies on Google's own domains | Google AdSense: chooses and measures ads, limits repeats and prevents fraud; with personalised ads, also interest-based advertising. | Up to 13 months | Optional: ads |
Optional cookies are set only after you allow them in the cookie banner. If your browser sends a Global Privacy Control signal we treat it as "Necessary only" and do not ask. You can change your choices at any time with "Cookie settings" at the bottom of every page or on your settings page; turning something off stops it and deletes the cookies it set on this site. Google's use of data is described in Google's privacy policy and in how Google uses information from sites that use its services.
Analytics
If you allow analytics, we use Google Analytics to count page visits and a few actions (such as opening a job posting or finishing sign-up). Google receives the page address with any codes or tokens removed, the page title, your browser and device type, an approximate location, and a random identifier stored in Google Analytics cookies. It does not receive your email, name, profile, notes or ratings. Google signals and ad personalisation are turned off for analytics.
Advertising
If you allow ads, Google AdSense shows ads in the job list and on job pages, each labelled "Advertisement". Google, and the ad partners it works with, receive the page address, your IP address, browser and device details, and identifiers stored in cookies, and use them to choose ads, limit how often you see them, measure them and prevent fraud. They do not receive your email, name, profile, resume, salary, notes or ratings from us. Ads never appear in your shortlist and never affect how jobs are scored or ranked.
- Personalised: Google may use its cookies to show ads based on your interests across sites. You can manage this at Google's ad settings.
- Non-personalised: ads are chosen from the page and your approximate location only; cookies are still used to limit repeats and stop fraud.
- No ads: no ad code runs and no ad cookies are set.
Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this site or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the internet. You can opt out of personalised advertising in Google's ad settings, and opt out of some other vendors' use of cookies for personalised advertising at aboutads.info or youronlinechoices.eu. Choosing "Non-personalised" or "No ads" in our cookie settings does the same for this site.
We do not choose individual ads and do not share your profile with advertisers. If an ad seems misleading or inappropriate, use the "AdChoices" or "Why this ad?" link on it to report it to Google, or tell us.
Your rights, and how to use them
- Withdraw consent at any time, as easily as you gave it: for ads and analytics with "Cookie settings"; for everything else by deleting your account in Settings. Withdrawing does not affect what we lawfully did before.
- Access: download your data, with a summary of what we process and who we share it with, from Settings, or ask us.
- Correction and erasure: edit your profile yourself, delete your account straight away, or ask us to correct, complete or erase anything else.
- Nominate someone to exercise these rights if you die or become unable to.
- Grievances: complain to us about how we handle your data.
Make any of these requests from Settings → Your data rights, or by email to the grievance officer below. We reply within 90 days at most. If you are not satisfied with how we resolve a grievance, you can complain to the Data Protection Board of India.
Your duties under the Act: give us true information, and do not file false or frivolous complaints.
Children
Brightspark is only for people aged 18 and over; everyone confirms this when they join. We do not knowingly process children's data, and we do not track or target ads at children. If you believe a child has an account, tell us and we will delete it.
Security and breaches
Sign-in is handled by Google, so we hold no passwords for members. The site is served over HTTPS, the database is not reachable from the internet, only admins can see member data, and we keep access logs for a year. If a breach affects your personal data, we will tell you and the Data Protection Board of India without delay, as the Act requires: what happened, the likely impact, what we are doing, and what you can do.
Changes and languages
When what we collect or share changes, we update this notice and its version before the change takes effect, and ask you to agree again when you next sign in. You can ask for this notice in any language listed in the Eighth Schedule to the Constitution of India by writing to the grievance officer.
Grievance officer and contact
brightspark, grievance officer, BrightSparkHQ, Bengaluru, India · brightspark+grievance@gmail.com
Other questions: brightsparkhq+hello@gmail.com.