Privacy Policy

UpNxtWork is a verified talent marketplace connecting college students in India with real, admin-reviewed project work from startups, along with mentorship, recruiting, investor-discovery, and alumni give-back features built on top of the same verified community. UpNxtWork is operated by Harsh Aade as a sole proprietorship based in Maharashtra, India. We are the "Data Fiduciary" for the personal data described in this policy. If UpNxtWork's legal form changes (for example, on registration as a company), the new entity will take over these responsibilities, this policy will be updated, and we will tell you before the change takes effect.

This policy applies to every account type on the platform: Students, Startups, Founders, College Partners (TPOs), Recruiters, Mentors, Investors, Alumni, and platform Admins. Where a section applies to only some of these, it says so explicitly.

We'll refer to UpNxtWork as "we," "us," or "the platform" throughout this policy, and to you as "you" or "the user" regardless of which account type you hold.

We only collect what each feature actually needs to function. Here's exactly what that is, broken down by role:

All accounts

• Email address and password (your password is hashed by our authentication provider; we never see or store it in plain text)
• Account role and account creation / last-login timestamps
• Any additional role you're granted beyond your primary account type (for example, a student also approved as a mentor)
• If you sign in with Google: the name, email address, and profile photo Google shares with us. We never see your Google password.

Visitors who haven't created an account

Some forms work without an account. When you use one, we collect only what that form asks for:

• Contact form: your name, contact details, and your message
• Share Your Problem: your name, your email address or phone number (you choose which), a description of your problem, and, only if you choose to record one, a voice note of up to 3 minutes. Your browser asks your permission before the microphone is used, and nothing is recorded unless you press record.
• Job and career applications: your name, email, phone number, LinkedIn link, and the CV you upload
• Event registrations: the details the registration form asks for, such as your name and email

Students

• Full name, headline, about/bio, degree, graduation year, domain, availability, weekly hours, and work preference
• College name, college ID (if your college is a registered partner), college email, placement officer name and contact
• LinkedIn, GitHub, portfolio, Twitter, and Instagram links, resume file, and profile photo
• If you connect GitHub: your GitHub username, avatar, bio, company, location, public repo count, followers/following count, and an access token used only to read that public profile data
• LeetCode username/URL and HackerRank URL, if you add them
• Skills you select from our skills list, plus any external work experience or external certificates you add manually
• Your applications, matched projects, certificates earned, and Practice Challenge submissions

Startups and Founders

• Company name, description, industry, size, location, website, LinkedIn, logo, and the type of support you're looking for
• Contact name and contact email for your organization
• Compliance documents where provided: registration number, PAN, TAN, MSME/Udyam number, and any uploaded incorporation document — collected only to verify you're a genuine, operating business before anything you post goes live
• Founder-specific profile: name, photo, and links, separate from your startup's operating account
• Projects you post, applications received, and messages with matched students

College Partners (TPOs)

• Organization name, partner type, and staff accounts linked to your college
• Placement and student-activity data visible to you only for your own college's students

Recruiters, Mentors, Investors, and Alumni

• Recruiters: job listings you post and the applicant details (name, phone, email, LinkedIn, CV) submitted against your own listings only
• Mentors: the mentee profiles the UpNxtWork team matches you with, and any private session notes you choose to write — these notes are visible only to you and platform admins, never to the mentee
• Investors: the admin-verified startup names, industries, descriptions, and funding needs you browse, and any interest note you submit — which goes to our team for review, not directly to the startup
• Alumni: referral listings you post (handled the same way as recruiter listings) and any story you choose to share on the platform feed

Everyone: platform activity data

• Messages sent through the platform's messaging system (tied to a specific application or match)
• Feed posts, comments, and likes you create
• Connection requests you send or receive through the People directory
• In-app notifications and, where enabled, email notifications
• Event registrations and podcast ("The Hot Seat") submissions, if you participate

Technical data

Our hosting (Vercel) and database (Supabase) providers automatically log standard web request data — IP address, browser type, and request timestamps — as part of running any website securely. These logs exist for security and abuse prevention.

If you accept analytics cookies, we also use Google Analytics to understand how the website is used: which pages are visited, how long visits last, the type of device and browser, the approximate location (city or country, worked out from your IP address), and how you arrived at our site. Google Analytics sets cookies in your browser to do this. We use these reports only in aggregate to improve the website; we don't use them to identify you or to show you ads. See Section 10 for how to opt out.

• Verification: profiles that are 75% complete or more are verified automatically; the rest get a human review from our team within 24–48 hours
• Skill matching: we calculate a skill-match percentage between your selected skills and a project's required skills, and apply a 50% threshold before you can apply
• WhatsApp (optional): if you add a WhatsApp number and tick the box on your profile, only the UpNxtWork team can see it and use it to tell you about problems that match your skills. Untick the box or clear the number any time
• Enabling messaging between matched students and startups, mentors and mentees, and recruiters/alumni and their applicants
• Issuing certificates that require sign-off from both our admin team and the startup, so they carry real weight
• Admin review and moderation of every project brief, job listing, and verification request before it's published or approved
• Notifications about your account activity, delivered in-app always, and by email if you've enabled it in Settings
• Fraud and abuse prevention — detecting fake profiles, spam messaging, or attempts to bypass the platform
• Aggregate, anonymized platform statistics (for example, total verified students, total completed certificates) shown publicly on our investor-overview page — this never includes identifiable individual data
• Responding to you when you use the contact form, Share Your Problem, a job application, or an event registration
• Improving the platform based on how features are actually used, including aggregate Google Analytics reports

Under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"), we process your personal data on two grounds:

• Your consent (Section 6 of the DPDP Act), given when you sign up and agree to this policy and our Terms of Service, or when you submit one of our public forms. Your consent covers only the purposes listed in Section 3.
• Certain legitimate uses (Section 7 of the DPDP Act): where you have voluntarily given us data for a specific purpose (for example, sending a job application or a message), and where we must process data to comply with Indian law (for example, keeping tax records for payments).

You can withdraw your consent at any time, as easily as you gave it: delete your account, or email us (see Section 9). Withdrawing consent doesn't affect processing we did before you withdrew it, and it may mean we can no longer provide you the service.

Visibility on UpNxtWork is deliberately narrow and scoped to what each relationship actually needs:

• Our admin team can see your full profile during verification and whenever reviewing a project, application, or dispute. Each admin uses their own individual account (no shared logins), and access is role-restricted (support-tier admins see less than full admins).
• A matched startup can see a student's full name and profile only once officially matched to their project. A startup's identity stays private from public view until a match is confirmed.
• A recruiter or alumni poster sees applicant details only for applications submitted to their own listings — never anyone else's.
• A mentor sees only the mentee profiles the UpNxtWork team has explicitly matched them with. There's no self-serve "browse students" option for mentors.
• An investor sees only admin-verified startup names, industries, locations, descriptions, and stated funding needs — never a startup's compliance documents, owner contact details, or any other sensitive field. An investor's own interest notes go to our team for review; we make the introduction manually, so a startup never sees who expressed interest unless and until we connect you.
• Other platform users (through the People directory and Feed) see only the name, role, and basic public details you choose to make visible — the same level of visibility as a professional network, not your full profile.
• The public can look up a specific certificate by ID, or a student/founder's profile if you've explicitly made it public, through our Verify a Certificate page. Nothing else is publicly searchable.

We do not sell your personal data to third parties, and we never will.

• A startup's compliance documents (PAN, TAN, MSME/Udyam number, incorporation documents) are never exposed to investors, students, or any party outside our admin team's verification process.
• A mentor's private session notes about a mentee are visible only to that mentor and platform admins — never to the mentee, and never to anyone else.
• An investor's interest note about a startup goes to our admin team only, not to the startup, unless and until we manually make the introduction.
• Messages between matched users are private to that conversation; we don't read them except to investigate a reported dispute or abuse.

Your data is stored with Supabase, a managed database and authentication provider, with our database hosted in the Tokyo (ap-northeast-1) region. This means some processing of your personal data happens outside India — see Section 12 for what that means and the safeguards in place.

Technical safeguards we actually have in place, not just policy statements:

• Row-level security enforced at the database level on every table, meaning a request for data you're not entitled to see is rejected by the database itself, not just hidden by the app's interface
• Password hashing via our authentication provider's industry-standard algorithm; we never store or see your password in plain text
• Encrypted connections (HTTPS/TLS) between your browser and our servers for every request
• Tiered admin access — support-tier staff see a restricted subset of what full admins can see, and every admin signs in with their own individual account
• Inactivity auto-logout after 30 minutes of no activity on any dashboard, to reduce the risk of a shared or unattended device exposing your account

No system is perfectly secure, and we can't guarantee absolute security of data transmitted over the internet. If we ever discover a data breach affecting your personal data, see Section 14.

If you delete your account, or your account becomes inactive and we close it, we permanently delete your personal data within 90 days, with these exceptions required by law or platform integrity:

• Financial records tied to a completed Paid project payment (payment amount, dates) are retained for the period required under Indian tax law — currently up to 8 years — even after account deletion.
• Issued certificates and their verification records are retained indefinitely by default, since the whole point of a certificate is that it can be verified by a third party (a recruiter, for example) years later. If you'd prefer your certificate record be removed from public verification after account deletion, tell us when you request deletion and we'll honor that instead.
• Records relevant to an open dispute, fraud investigation, or legal obligation are retained until that matter is resolved.
• Security and access logs are kept for at least one year, as Indian data protection rules require, and then deleted.

Data from our public forms (contact messages, Share Your Problem submissions and voice notes, job applications and CVs, and event registrations) is kept for up to 12 months after our last contact with you, and then deleted, unless you go on to create an account or the law requires us to keep it longer. You can ask us to delete it sooner at any time.

Google Analytics data is kept for no longer than 14 months and then deleted automatically by Google.

As a Data Principal under India's Digital Personal Data Protection Act, 2023, you have the right to:

• Access a summary of the personal data we hold about you
• Correct inaccurate or incomplete data — most of this you can do directly from your dashboard; anything you can't, email us
• Erase your data, subject to the retention exceptions in Section 8
• Withdraw consent at any time, as easily as you gave it, by deleting your account
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity
• Grievance redressal if you're unhappy with how we've handled a request — see Section 15 for our Grievance Officer contact
• Complain to the Data Protection Board of India if you're still not satisfied after using our grievance process

To nominate someone, email us with their name and contact details. Your rights also apply to data you gave us through a public form without creating an account; email us from the address or phone number you used.

To exercise any of these rights, email support@upnxtwork.com from your account email. Every request is reviewed and actioned personally by our team, not an automated system — we aim to respond within 2 business days and fully resolve access or deletion requests within 30 days.

We use a small amount of browser storage and one set of analytics cookies:

• Local storage (needed for the site to work): keeps you logged in between visits, remembers your theme (light/dark mode), remembers whether you've already seen your dashboard's welcome message, and remembers your cookie choice so we don't ask again on every page.
• Session storage (needed for the site to work): briefly holds a draft you started on the homepage (for example, a Share Your Problem note) so it isn't lost when you move to the next page. It is cleared once used or when you close the tab.
• Google Analytics cookies (analytics, only with your consent): cookies named _ga and _ga_*, set by Google, that tell visits apart so we can count visitors and see which pages are used. They last up to 2 years. Google Analytics doesn't load at all until you click "Accept" on our cookie banner.

We do not use advertising cookies or tracking pixels, and we don't sell or share analytics data for advertising. You can change your choice at any time, as easily as you made it, through Cookie settings (also linked in the footer of every page). If you withdraw consent, we stop Google Analytics and delete its cookies from your browser. You can also block cookies in your browser settings or install Google's Google Analytics opt-out add-on. The site works the same either way.

We use a small number of carefully chosen providers to run the platform. None of them are permitted to use your data for their own purposes.

• Supabase — authentication, database, and file storage. Processes nearly all platform data described in Section 2. Hosted in Tokyo, Japan.
• Vercel — website hosting and content delivery. Processes standard web request logs as described in Section 2.
• Zoho Mail — sends platform emails (notifications, verification, account-related messages) on our behalf. Receives your email address and the content of the specific email being sent.
• GitHub — if you connect your GitHub account, we read your public profile and repository data through GitHub's own OAuth flow, governed by GitHub's own privacy policy for that connection.
• Google — Google Sign-In (if you choose it) shares your name, email, and profile photo with us; Google Analytics measures website use as described in Sections 2 and 10; Google Fonts serves the fonts on our pages. When your browser loads these, Google receives your IP address and browser details under Google's privacy policy.
• Cloudflare (cdnjs) — serves a code library used to create downloadable PDFs (such as certificates). Your browser's IP address and request details are visible to Cloudflare when it loads.
• WhatsApp (Meta) — only if you choose to message us on WhatsApp. Those messages are handled under WhatsApp's own privacy policy.
• Cashfree Payments — processes paid event tickets (your name, email, mobile number and payment details go to Cashfree to complete the payment; we never see or store card or bank details), and, once live, Paid project and plan-upgrade payments. See our Refund & Cancellation Policy for refunds.

Because our database is hosted in Tokyo, Japan (via Supabase's ap-northeast-1 region), your personal data is processed outside India. Under India's Digital Personal Data Protection Act, 2023, this is permitted for countries not restricted by the central government (Japan is not a restricted destination as of this policy's last update). Our provider maintains industry-standard technical and organizational safeguards for data in that region. If this changes — for example, if we migrate to an India-hosted region — we'll update this section.

You must be 18 or older to create an UpNxtWork account or submit any of our forms. Under the DPDP Act, anyone under 18 is a child, and processing a child's data needs verifiable consent from a parent or lawful guardian, which we don't currently collect. Some first-year college students are 17; if that's you, please wait until you turn 18 before signing up. We don't knowingly collect data from anyone under 18, and we never track, profile, or target advertising at children. If we learn that we've collected data from someone under 18, we'll delete it promptly. Parents or guardians who believe this has happened can email us.

If a data breach affects your personal data, we'll tell you without delay, along with the Data Protection Board of India, as the DPDP Act and its Rules require, and send the Board a detailed report within 72 hours of becoming aware of it. We'll tell you what happened, what data was involved, the likely consequences for you, what we're doing about it, and the steps you can take to protect yourself, along with a contact person for questions.

In accordance with the Digital Personal Data Protection Act, 2023 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, our designated Grievance Officer is Harsh Aade (Founder), reachable at support@upnxtwork.com (please use the subject line "Grievance") or WhatsApp +91 84848 55106. We acknowledge every grievance within 24 hours and resolve it within 15 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

We may update this policy as the platform evolves — for example, when the payment gateway described in Section 11 goes live. Material changes will be communicated via the platform or email, and where required by law, we'll ask for renewed consent before a material change takes effect. The "Last updated" date at the top of this page always reflects the current version.

Questions about this policy, or to exercise any of your data rights: support@upnxtwork.com, or WhatsApp +91 84848 55106.