Privacy Policy

We collect information that you provide directly to us, as well as certain technical data generated automatically when you use the site.

Information you provide:

• Contact form submissions — Name, work email, company name, project type, budget range, timeline, and message content when you reach out through our contact page

• Candidate registration — Name, email address, and password when you create a candidate account to apply for roles

• Job applications — Resume (PDF), professional details, and any information included in your application submitted through the career portal

• Student programme applications — Name, email, institution, and resume submitted through the student application form

Information collected automatically:

• Session cookies — HTTP-only authentication cookie (cand_session) set when you log in. This contains only a session identifier — no personal data

• Consent state — Your cookie preference choice, stored in your browser's local storage

• Server logs — IP address, browser type, device type, and timestamps recorded by our hosting infrastructure (Vercel) for security and operational purposes

We use the information we collect for the following purposes:

• To provide our services — Processing contact form enquiries, evaluating job applications, and managing candidate and student accounts

• To communicate with you — Responding to your messages, providing project proposals, and sending updates related to your application or engagement

• To authenticate users — Verifying your identity when you log in to the candidate portal

• To protect our site — Detecting and preventing fraud, abuse, and unauthorised access through session management and input validation

• To improve our website — Understanding general usage patterns to improve site performance and user experience

• To comply with legal obligations — Meeting applicable legal, regulatory, or contractual requirements

We do not use your information for advertising, behavioural profiling, automated decision-making, or selling to third parties.

We process your personal data on the following legal grounds:

• Consent — When you submit a contact form, create an account, or apply for a position, you consent to the processing of the data you provide for that specific purpose

• Contractual necessity — When processing is required to perform a contract with you or to take steps at your request prior to entering into a contract (e.g., evaluating a project proposal)

• Legitimate interest — For website security, fraud prevention, and improving our services, where these interests do not override your fundamental rights

• Legal obligation — When we are required to process data to comply with applicable Indian law

We take the security of your data seriously and implement appropriate technical and organisational measures:

• Database — User data is stored in a PostgreSQL database hosted by Supabase with encrypted connections (TLS/SSL)

• File storage — Uploaded documents (resumes, PDFs) are stored in Cloudflare R2 with unique, non-guessable file identifiers

• Password security — All passwords are hashed using bcrypt before storage. We never store passwords in plain text

• Session security — Authentication cookies are HTTP-only, Secure (HTTPS-only in production), and SameSite=Lax to prevent cross-site attacks

• File validation — Uploaded files are validated for type (PDF only), size (5 MB maximum), and magic bytes to prevent file-type spoofing

• Input validation — All API endpoints validate and sanitise input to prevent injection attacks

• Security headers — We enforce X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy headers

While we use industry-standard measures to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

We do not sell, rent, or trade your personal information to anyone. We share data only with the following third-party service providers who assist in operating our website:

• Supabase (Database & Authentication) — Stores user accounts, contact form submissions, applications, and job listings. Supabase processes data under their privacy policy and maintains SOC 2 Type II compliance

• Cloudflare R2 (File Storage) — Stores uploaded documents (resumes). Cloudflare processes data under their privacy policy

• Vercel (Hosting & Deployment) — Hosts the website and processes server-side requests. Vercel may collect server logs including IP addresses

These providers process data only on our behalf and in accordance with our instructions. They are contractually obligated to protect your data.

We may also disclose your information if required by law, court order, or governmental regulation, or if necessary to protect the rights, property, or safety of NyRock LLP, our users, or the public.

We retain your personal data only for as long as necessary to fulfil the purpose for which it was collected:

• Contact form submissions — Retained for up to 24 months, or until the enquiry is resolved and no further business relationship is anticipated

• Candidate accounts & applications — Retained for up to 24 months after your last activity. You may request deletion at any time

• Student applications — Retained for up to 12 months after the application cycle concludes

• Session cookies — Expire automatically after 7 days, or when you log out

• Server logs — Retained by our hosting provider according to their retention policies (typically 30 days)

When data is no longer needed, it is securely deleted or anonymised.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right of access — Request a copy of the personal data we hold about you

• Right to rectification — Request correction of inaccurate or incomplete data

• Right to erasure — Request deletion of your personal data ("right to be forgotten")

• Right to restrict processing — Request that we limit how we use your data

• Right to data portability — Request your data in a structured, machine-readable format

• Right to object — Object to the processing of your data for certain purposes

• Right to withdraw consent — Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us at management@nyrock.co. We will respond to your request within 30 days. We may need to verify your identity before processing your request.

If you have a candidate account, you can update your profile information directly through the candidate portal.

Our website and services are not directed at individuals under the age of 16. We do not knowingly collect personal information from children. If you believe that a child has provided us with personal data, please contact us at management@nyrock.co, and we will take steps to delete such information promptly.

Our student programme is intended for college and university students who are 18 years of age or older.

NyRock LLP is based in Chikkanayakanahlli, Tumkur, Karnataka, India. Our service providers (Supabase, Cloudflare, Vercel) may process and store data in data centres located outside India, including in the United States and the European Union.

When your data is transferred internationally, we ensure it is protected by appropriate safeguards, including the data processing agreements and security certifications maintained by our service providers.

By using our website and providing your information, you acknowledge and consent to the transfer you your data to these jurisdictions.

We use a minimal set of cookies, all of which are essential for the site to function. We do not use analytics, advertising, or behavioural-tracking cookies.

For complete details on what cookies we set, how they work, and how to manage your preferences, please see our Cookie Policy.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "last updated" date at the bottom of this page.

We encourage you to review this Privacy Policy periodically. Your continued use of the site after any changes constitutes acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: management@nyrock.co

Founder: ceo@nyrock.co

Company: NyRock LLP, Chikkanayakanahalli, Tumkur, Karnataka, India

This Privacy Policy was last updated on 6 March 2026.