Data Retention Policy

1. Introduction and Scope

1. This Data Retention Policy (“Policy”) is issued by DAVID PROTOCOL AND DEFI PRIVATE LIMITED, a private limited company incorporated under the laws of India, having its registered office at 36, Border Station Road, Kodambakkam, Chennai, Tamil Nadu 600024, India (“Company,” “we,” “us,” or “our”), which operates the career preparation platform offered under the brand names “FirstDay AI” and “First Day AI” at firstdayai.in (the “Platform” or “Services”).
2. This Policy sets out the principles, periods, and procedures that the Company follows in retaining and deleting personal data and other data collected, generated, or processed through the Platform. It is intended to comply with the Digital Personal Data Protection Act, 2023 (India), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the General Data Protection Regulation (EU) 2016/679, the UK GDPR, the UAE Federal Decree-Law No. 45 of 2021, the Singapore Personal Data Protection Act 2012, and other Applicable Law.
3. This Policy is incorporated by reference into, and forms part of, the Company’s Terms and Conditions and Privacy Policy. In the event of any conflict between this Policy and the Privacy Policy with respect to a retention matter, this Policy shall prevail.
4. The Company may update this Policy from time to time in accordance with Section 23.

2. Definitions

In this Policy, unless the context requires otherwise:

1. “Anonymised Data” means data that has been irreversibly altered such that the data subject can no longer be identified, directly or indirectly, alone or in combination with other reasonably available information.
2. “Aggregated Data” means data that has been combined with data of other Users or other sources such that the data subject can no longer be identified, and the data is used only for statistical analysis in a form that does not identify any individual.
3. “Applicable Law” has the meaning given in the Terms and Conditions.
4. “Backup” means a copy of data made for the purpose of disaster recovery, business continuity, or archival, and that is intended to be deleted after its defined retention period.
5. “Data Subject” means an identified or identifiable natural person to whom personal data relates.
6. “Personal Data” means any data about an individual who is identified or identifiable, including but not limited to name, email address, phone number, government identifier, resume content, profile content, intake responses, and online identifiers.
7. “Personal Identification Data” or “PID” means Personal Data that directly identifies an individual, including but not limited to name, government identification number (Aadhaar, PAN, SSN, NRIC, Emirates ID, etc.), date of birth, biometric data, financial account details, and authentication credentials.
8. “User Content” has the meaning given in the Terms and Conditions.
9. “User” has the meaning given in the Terms and Conditions.

3. Principles of Data Retention

1. The Company applies the following principles to all data that it processes:

4. Data Categories

The Company processes the following categories of data, each with its own retention rules:

1. Account Data. Name, email address, phone number, hashed password, account preferences, account creation date, last login date, account status, and authentication metadata.
2. Profile and Resume Data. Work experience, education, skills, certifications, portfolio links, salary expectations, target role, target location, work authorisation status, and other resume content provided by the User.
3. Intake Data. Career goals, preferences, current employment situation, and answers to onboarding questions.
4. Communication Data. Emails, in-app chat messages, support tickets, and other communications between the User and the Company.
5. Usage Data. Pages viewed, features used, session duration, click patterns, IP address, device and browser metadata, referrer URL, and other telemetry collected automatically.
6. Payment Data. Transaction records, billing address, last-four digits of payment card, payment method type, and invoice numbers. Full card numbers, CVV, and card expiry dates are not stored by the Company and are processed by the Company’s payment processors.
7. AI Output Data. AI-generated resumes, cover letters, profile rewrites, mock interview transcripts, and Interview Intelligence suggestions.
8. Application Data. Records of job applications submitted on the User’s behalf through the Targeted Application Engine, including job portal, role, company, application date, and outcome where available.
9. Referral Data. Records of Insider Referral Network introductions, including the partner, the contact, the role, and the outcome where available.
10. Support Data. Records of support tickets, bug reports, feature requests, and the Company’s responses.
11. Marketing Data. Marketing consent records, opt-in/ opt-out history, email open and click data, and other marketing engagement data.
12. Security Data. Authentication logs, access logs, security incident records, fraud signals, and investigations.
13. Backup Data. Periodic backups of the production environment, used for disaster recovery and business continuity.

5. Retention Periods

The Company retains Personal Data for the periods set out below. Each period is measured from the triggering event identified in the right- hand column.

1. Account Data. Retained for the duration of the User’s active account plus 90 days after account closure, after which it is permanently deleted. Backup copies are deleted within 1 year in accordance with Section 11.
2. Profile and Resume Data. Retained for the duration of the User’s active account, plus 1 year from the date the User last logged in or engaged with the Platform, after which it is permanently deleted. The User may request earlier deletion at any time.
3. Intake Data. Retained for the duration of the User’s active campaign, plus 1 year from the completion of the campaign, after which it is permanently deleted.
4. Communication Data. Retained for the duration of the User’s active account, plus 1 year after account closure, after which it is permanently deleted.
5. Usage Data. Retained for 6 months from the date of collection, after which it is permanently deleted or anonymised.
6. Payment Data. Retained for 7 years from the date of the relevant transaction, in accordance with Indian tax, GST, and company law requirements.
7. AI Output Data. Retained for the duration of the User’s active subscription, plus 1 year from the date the User last logged in or engaged with the Platform, after which it is permanently deleted.
8. Application Data. Retained for 1 year from the date of submission, after which it is permanently deleted. The Company may retain anonymised, aggregated counts of applications (for example, “User submitted 312 applications in 2026”) indefinitely.
9. Referral Data. Retained for 1 year from the date of the referral, after which it is permanently deleted, subject to legal hold exceptions in Section 13.
10. Support Data. Retained for 2 years from the date of the support ticket, after which it is permanently deleted.
11. Marketing Data. Retained until the User withdraws consent or unsubscribes, plus 30 days for system processing, after which it is permanently deleted.
12. Security Data. Retained for 1 year from the date of the event, or longer where required for an active investigation, legal hold, or regulatory inquiry.

1. The Personal Data is no longer necessary for the purpose for which it was collected;
2. The User has requested deletion and the request has been approved;
3. The User’s account has been inactive for an extended period; or
4. The Company has determined that retention is no longer commercially reasonable.

6. No Use of Personal Identification Data by Third-Party Processors

1. The Company does not share Personal Identification Data (PID) — including but not limited to government identification numbers, biometric data, financial account details, and authentication credentials — with any third-party processor, sub-processor, or other third party, except:

1. As required to operate the Services at the User’s direction (for example, sharing application data with a job portal in order to submit an application);
2. As required by Applicable Law, regulation, court order, or valid legal process; or
3. As expressly authorised by the User in writing.

2. The Company engages third-party processors to provide hosting, payment processing, customer support, analytics, email delivery, and security services. These processors are contractually restricted from accessing or processing PID, except as necessary to perform the specific service for which they have been engaged (for example, a payment processor processing a payment).
3. A list of the categories of third-party processors engaged by the Company is available on request to hello@firstdayai.in.

7. Storage Locations and International Transfers

1. The Company is headquartered in India, and the primary storage of Personal Data is in India, with the Company’s cloud infrastructure providers.
2. The Company may transfer Personal Data to, and process Personal Data in, countries other than the User’s country of residence, including but not limited to India, the United States, the United Arab Emirates, Singapore, and the United Kingdom, where the Company’s service providers operate.
3. The Company implements appropriate safeguards for international transfers, including but not limited to:

1. Standard Contractual Clauses approved by the European Commission for transfers from the EEA;
2. The UK International Data Transfer Addendum for transfers from the UK;
3. Contractual safeguards for transfers from India, the UAE, and Singapore consistent with applicable data protection law; and
4. Encryption in transit and at rest, access controls, and audit logging for all cross-border data flows.

8. Data Subject Rights

The User has the following rights with respect to their Personal Data:

1. Right of Access. The User may request a copy of the Personal Data the Company holds about them.
2. Right of Correction. The User may request that the Company correct inaccurate or incomplete Personal Data.
3. Right of Deletion. The User may request that the Company delete their Personal Data, subject to the retention requirements in Section 5 and any applicable legal hold.
4. Right of Portability. The User may request a machine-readable copy of their Personal Data.
5. Right to Withdraw Consent. Where processing is based on consent, the User may withdraw their consent at any time.
6. Right to Opt Out of Marketing. The User may opt out of marketing communications at any time.
7. Right to Lodge a Complaint. The User may lodge a complaint with a competent data protection authority in their jurisdiction.

9. Data Subject Requests — Process

1. The User’s full name;
2. The email address associated with the account;
3. The phone number associated with the account (if available);
4. A clear description of the request (access, correction, deletion, portability, etc.); and
5. Sufficient information to verify the User’s identity.

10. Deletion Process

1. Cryptographic shredding, where encryption keys used to encrypt the data are destroyed, rendering the encrypted data unreadable;
2. Secure overwriting of storage media using methods that conform to NIST SP 800-88 Rev. 1 or equivalent standards;
3. Physical destruction of end-of-life storage media, where appropriate; and
4. Logical deletion in production systems, with subsequent deletion from backups within the periods set out in Section 11.

1. To comply with a legal obligation under Applicable Law, including but not limited to tax, GST, anti-money laundering, and company law record-keeping obligations;
2. To respond to a valid subpoena, court order, or other legal process;
3. To defend a legal claim;
4. To cooperate with a law enforcement or regulatory investigation;
5. To enforce the Terms and Conditions; or
6. To comply with a legal hold notice issued in accordance with Section 13.

11. Backup Retention

1. The Company maintains periodic backups of the production environment for the purposes of disaster recovery and business continuity.
2. Backups of Personal Data are retained for a maximum of 1 year from the date of the backup.
3. Backups are not selectively modified to remove individual User data; rather, all data in a given backup is deleted together when the backup reaches the end of its retention period.
4. As a result, Personal Data that has been logically deleted from production systems may continue to exist in backups for up to 1 year, after which the backup is deleted and the Personal Data is permanently unrecoverable.
5. The Company does not restore backups to recover deleted Personal Data at the request of a Data Subject, except where the Company determines, in its sole discretion, that restoration is reasonable and technically feasible, and that the Data Subject has a legitimate basis for the request.

12. Anonymisation and Aggregation

1. The Company may anonymise or aggregate Personal Data for the purposes of:

1. Producing statistics, analytics, and reports about the use of the Platform;
2. Improving the Company’s AI models and Services;
3. Marketing and case studies, in a form that does not identify any individual; and
4. Complying with Applicable Law.

2. Anonymisation is performed using methods that prevent re-identification, including but not limited to removing direct identifiers, generalising quasi-identifiers, and adding statistical noise.
3. Once Personal Data has been anonymised, the resulting data is no longer Personal Data and is not subject to this Policy or to the deletion obligations in Section 10. The Company may retain anonymised data indefinitely.
4. Aggregated data is data that has been combined across multiple Users or events such that no individual User can be identified. Aggregated data is not Personal Data and may be retained indefinitely.

13. Legal Hold

1. The Company may, at its sole discretion, issue a legal hold notice that suspends the deletion of specified categories of Personal Data for a specified period of time.
2. A legal hold may be issued where the Company has reasonable grounds to believe that:

1. The Personal Data is relevant to an actual or anticipated legal proceeding, regulatory investigation, or government inquiry;
2. The Personal Data is relevant to an internal investigation of misconduct, fraud, or other wrongdoing; or
3. Deletion of the Personal Data would prejudice the Company’s legal, regulatory, or commercial interests.

3. While a legal hold is in effect, the Company will retain the affected Personal Data notwithstanding any other provision of this Policy, and will not respond to deletion requests in respect of that data until the legal hold is released.
4. The Company will document the issuance and release of each legal hold, including the legal basis, the scope of the hold, the data subjects affected, and the date of release.

14. Account Closure

1. A User may close their account at any time by sending a request to support@firstdayai.in from the email address associated with the account, or by using the “close account” feature in the User’s dashboard.
2. Upon closure of an account, the Company will:

1. Disable the User’s access to the Platform immediately;
2. Mark the account as closed in the Company’s internal systems;
3. Retain Account Data, Profile and Resume Data, AI Output Data, Communication Data, and Application Data for the periods set out in Section 5, and then permanently delete such data; and
4. Anonymise Usage Data in accordance with Section 12.

3. A User who closes their account may reopen the account at any time within 90 days of closure, by sending a request to support@firstdayai.in. After 90 days, the account is permanently deleted and cannot be reopened.

15. Cookies and Tracking Technologies

1. The Company uses cookies, local storage, web beacons, and similar tracking technologies on the Platform.
2. The retention period for each cookie and tracking technology is set out in the Company’s cookie policy, available on the Platform.
3. In general:

1. Session cookies are deleted when the User closes their browser;
2. Authentication cookies are retained for the duration of the User’s session plus a reasonable period (typically 7 to 30 days);
3. Preference cookies are retained for up to 1 year;
4. Analytics cookies are retained for up to 6 months; and
5. Advertising cookies are retained for up to 1 year, where applicable and subject to consent.

4. The User may disable cookies through their browser settings, but doing so may affect the functionality of the Platform.

16. Marketing Data

1. Where the User has opted in to marketing communications, the Company retains the User’s marketing preferences and consent records for the duration of the User’s account plus 1 year after the User opts out or closes their account, in order to evidence compliance with Applicable Law.
2. The Company does not retain marketing engagement data (for example, email open rates) for longer than 2 years from the date of the engagement event.

17. Employee and Contractor Data

1. Where the Company processes personal data of its employees, contractors, or job applicants (for employment purposes), the retention of such data is governed by a separate internal policy, which is available on request to hello@firstdayai.in.
2. The Company retains employee and contractor data for periods consistent with Applicable Law, including tax, labour, and company law requirements.

18. Vendor and Partner Data

1. Where the Company processes personal data of its vendors, partners, or contractors (in a business-to-business context), the retention of such data is governed by the relevant vendor agreement and by Applicable Law.
2. The Company retains vendor and partner data for the duration of the business relationship plus 7 years from the end of the relationship, in accordance with tax, GST, and company law requirements.

19. Financial and Accounting Records

1. The Company retains financial and accounting records, including invoices, receipts, bank statements, and tax records, for 7 years from the date of the relevant transaction, in accordance with the Income Tax Act, 1961, the Companies Act, 2013, and the Central Goods and Services Tax Act, 2017.
2. Financial records are retained in secure, access-controlled storage and are deleted at the end of the retention period using secure deletion methods.

20. Security Incident Data

1. Where the Company experiences a security incident affecting Personal Data, the Company retains records of the incident, including detection logs, investigation records, and remediation records, for 5 years from the date of the incident.
2. Security incident records are retained for the purposes of demonstrating compliance with Applicable Law, supporting any regulatory inquiry, and improving the Company’s security posture.

21. Children's Data

1. The Platform is not directed to individuals under 18 years of age. The Company does not knowingly collect Personal Data from individuals under 18.
2. Where the Company becomes aware that it has collected Personal Data from an individual under 18, the Company will delete such data as soon as reasonably possible, and in any event within 30 days.

22. Compliance with Applicable Law

1. This Policy is intended to comply with:

1. The Digital Personal Data Protection Act, 2023 (India);
2. The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (India);
3. The General Data Protection Regulation (EU) 2016/679;
4. The UK GDPR and the Data Protection Act 2018;
5. The UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection;
6. The Singapore Personal Data Protection Act 2012; and
7. Any other Applicable Law that applies to the processing of Personal Data by the Company.

2. Where any provision of this Policy conflicts with a mandatory provision of Applicable Law, the Applicable Law shall prevail.

23. Changes to this Policy

1. The Company may update this Policy from time to time at its sole discretion. Material changes will be communicated to the User by email and/or by an in-product notice at least 7 calendar days before the changes take effect.
2. The current version of this Policy will always be available on the Platform with a “Last updated” date indicating the date of the most recent revision.
3. The version of this Policy in effect at the time of the User’s last interaction with the Platform shall govern the retention of that User’s Personal Data, unless the User expressly agrees in writing to a later version.

24. Contact

For any questions about this Data Retention Policy, to submit a data subject request, or to request the deletion of Personal Data, please contact us at: