Privacy Policy
HuntForTomorrow (HFT)
Last updated: 31 August 2026
Version: 1.0
1. Who we are
Hunt For Tomorrow, operating under the brand HuntForTomorrow ("HFT", "we", "us"), is the Data Fiduciary (data controller) for the personal data described in this policy.
This policy explains what personal data we collect, why, who we share it with, how long we keep it, and what rights you have. It applies to our website, our client portal at https://huntfortomorrow.in, and all services we deliver.
We have written this in plain language deliberately. If anything is unclear, write to admin@huntfortomorrow.com and we will explain it.
2. The laws this policy is built on
- Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 (India). Provisions are being brought into force in phases; we have written this policy to the full standard.
- Information Technology Act, 2000 (Section 43A) and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
- Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020.
- EU / UK GDPR — where we process the personal data of individuals located in the EU or UK (see Section 12).
3. The personal data we collect
3.1 Data you give us
| Category | Examples |
|---|---|
| Identity and contact | Name, email, phone, city, photograph (where used on a profile) |
| Career data | Resume and its full contents, employment history, job titles, employers, dates, education, certifications, skills, achievements, performance ratings |
| Compensation data | Current CTC (fixed, variable, ESOP), expected CTC, floor, notice period |
| Job-search preferences | Target roles, industries, locations, relocation and travel constraints, confidentiality status, companies to exclude |
| Profile data | LinkedIn and Naukri profile URLs, profile exports, headline and summary content |
| Account credentials (optional) | Where you choose to have us update your LinkedIn or Naukri profile directly. See Section 5. |
| Payment data | Billing name, invoice details, payment reference. Card/UPI/bank details are handled by the payment gateway, never by us. |
| Communications | Emails, portal messages, WhatsApp messages, support tickets, feedback |
3.2 Data generated during our work
- Your Career Blueprint, resume drafts, cover letters, profile copy.
- Target company lists, job links, application tracker entries and statuses.
- Notes and records from your onboarding, discovery and strategy sessions.
- Approval records in the portal (what you approved and when).
3.3 Session recordings and notes
Coaching sessions are held over Zoom. Where a session is recorded or transcribed, we tell you at the start and you may decline. Recordings and transcripts are used only to build your deliverables accurately and are deleted per Section 9.
3.4 Sensitive personal information
Some of what you tell us on a call may be sensitive — health, bereavement, caregiving, family circumstances. We do not put any of it into a client-facing document. A career gap is presented as a neutral date range. We record it only where necessary to advise you, and we handle it under the stricter safeguards of the SPDI Rules, 2011.
3.5 Technical data
Website and portal usage data — IP address, device and browser type, pages visited, and cookies. See Section 13.
3.6 Third-party contact data (people who are not our clients)
To support your outreach, we identify professional business-contact information of recruiters, HR professionals and hiring managers at target companies: name, job title, employer, professional profile URL, and a work email address (which may be verified or inferred). Section 6 explains how we handle this.
4. Why we process your data, and on what basis
| Purpose | Data used | Basis |
|---|---|---|
| Delivering the services you purchased | Career, compensation, preference, profile data | Performance of our contract with you / your consent |
| Building resumes, cover letters and profile copy | Career and achievement data | Contract / consent |
| Career strategy, salary benchmarking, targeting | Career, compensation, constraint data | Contract / consent |
| Identifying and contacting recruiters on your behalf | Your profile summary + third-party contact data | Your consent (for us to act) and legitimate use (Section 6) |
| Payments, invoicing, tax and accounting records | Identity, billing data | Legal obligation |
| Support, complaints and grievance handling | Communications | Contract / legal obligation |
| Service improvement and quality review | De-identified records | Legitimate use |
| Marketing to you about our services | Contact data | Consent — withdrawable at any time |
We do not sell your personal data. We do not circulate your profile to employers as a pool or database. We do not share your data with other clients.
5. Your LinkedIn and Naukri credentials
5.1 Providing credentials is entirely optional — and not our first ask. Profile optimisation is designed for you to perform yourself, using the copy and guidance we supply, and we advise exactly that first. Credentials come into the picture only where you are unable to make the changes yourself and you choose, at your own request, to share them.
5.2 If you do opt in, credentials are submitted only through our secure intake form and are held in an encrypted credential vault. They are never written into a document, spreadsheet, chat message, email or shared file.
5.3 We use them only to make the profile changes you have approved. We do not use them to browse, message, apply, or act in your name beyond that.
5.4 You may withdraw access at any time by changing your password and telling us. We delete stored credentials on request, and in any event at the end of the engagement.
5.5 We recommend you use platform-native access-sharing features where the platform offers them, and that you change your password after the engagement ends.
6. Third-party contact data — how we handle other people's information
We take this seriously, because these individuals are not our clients and have not come to us.
6.1 What we collect is limited to professional business-contact information relevant to your job search — name, job title, employer, professional profile URL, work email. We do not collect personal (non-work) contact details, home addresses, or any special-category information about them.
6.2 Where it comes from. Publicly published professional information, our own licensed data sources, and permitted data providers. We check that a source's terms and robots directives permit the access before we use it, and we do not route around a refusal by using a different tool, proxy or aggregator. "It was publicly visible" is not by itself a lawful basis, and we do not treat it as one.
6.3 Why. A single, relevant, professionally targeted approach about a specific role — a purpose a recruiter or hiring manager would reasonably expect, given their role.
6.4 Limits we apply.
- Contacts are relevant to your level and target — we do not target the apex leadership of large enterprises.
- Your current employer and its close affiliates are excluded entirely where your search is confidential.
- Every outreach message identifies the sender and offers a clear way to decline further contact.
6.5 If you are a recruiter or hiring manager and we contacted you: you can object at any time by replying to the message or writing to admin@huntfortomorrow.com. We will suppress you permanently and account-wide — not just for one client — and we will delete your details. You do not need to give a reason.
6.6 Clients' obligations. Contact data we give you is for your own job search only. You may not resell it, publish it, add it to a marketing list, or use it for any purpose other than approaching that person about your candidacy.
7. Who we share data with
We share personal data only with service providers who process it on our instructions, under contract, and only as far as needed:
| Type of provider | What they process | Where |
|---|---|---|
| Cloud database and hosting | Your profile data, records, deliverables | India / EU / US |
| Client portal hosting | Portal accounts, approvals, documents | India / EU / US |
| Document storage | Resumes, cover letters, trackers | India / US |
| Intake and form platforms | Intake form responses | EU / US |
| Data and research providers | Company and contact research | US / EU |
| Email delivery and outreach tooling | Outreach messages sent in your job search | US / EU |
| Video conferencing | Session hosting, recordings where consented | US |
| Payment gateway | Payment processing (they, not we, hold payment credentials) | India |
| AI and language-model providers | Text used to draft and review documents | US / EU |
| Accounting, tax and legal advisers | Billing records, where required | India |
On AI tools: we use AI-assisted tooling to draft and review documents. Where we do, we use providers under terms that do not permit our data to be used to train their models, and we minimise what is sent. A human reviews every deliverable before it reaches you.
We may also disclose data where required by law, court order or a lawful request from an authority, and to a successor entity in the event of a business transfer (with notice to you).
A named, current list of our sub-processors is available on request from admin@huntfortomorrow.com.
8. International transfers
Some of the providers above are located outside India. Indian law currently permits such transfers except to countries specifically restricted by the Government, and we comply with any such restriction. Where data of individuals in the EU or UK is transferred, we rely on Standard Contractual Clauses or equivalent safeguards.
9. How long we keep data
| Data | Retention |
|---|---|
| Active client records and deliverables | For the engagement, plus [RETENTION PERIOD — e.g. 24 months] so we can help you when you return |
| Session recordings and transcripts | [e.g. 90 days] after the related deliverable is approved, then deleted |
| Login credentials | Deleted at the end of the engagement, or immediately on request |
| Third-party contact data | For the duration of the campaign it was sourced for, plus [e.g. 12 months]; deleted immediately on objection |
| Suppression list (people who asked not to be contacted) | Kept indefinitely — this is the only way to honour the objection |
| Invoices, tax and accounting records | 8 years, as required by Indian tax law |
| Marketing contact data | Until you unsubscribe |
After these periods we delete the data or irreversibly anonymise it.
10. Security
We use access controls, encryption of credentials at rest, encrypted transmission, role-based access limited to the people working on your engagement, contractual confidentiality with all providers, and separation controls that prevent one client's data entering another client's workspace or deliverable.
No system is perfectly secure. If a breach occurs that affects your data, we will notify you and the Data Protection Board of India as required, without undue delay.
11. Your rights
Under the DPDP Act you have the right to:
- Access — a summary of your personal data we process and who we have shared it with.
- Correction and completion — have inaccurate or incomplete data fixed.
- Erasure — have your data deleted where we no longer need it and no law requires us to keep it.
- Withdraw consent — as easily as you gave it. This may end our ability to deliver the service.
- Grievance redressal — complain to us first (Section 14), and to the Data Protection Board of India if unsatisfied.
- Nominate — nominate another person to exercise your rights in the event of death or incapacity.
To exercise any of these, write to admin@huntfortomorrow.com. We will respond within 7 working days wherever possible and in any event within the timelines prescribed by law. We may need to verify your identity first.
12. If you are in the EU or the UK
Where GDPR or UK GDPR applies to our processing:
- Our lawful bases are contract (delivering the service you bought), consent (marketing, optional processing), legal obligation (tax records), and legitimate interests (service improvement, and professional outreach on a client's behalf — for which we maintain a documented Legitimate Interests Assessment).
- You additionally have the rights to object, to restrict processing, and to data portability, and the right to lodge a complaint with your supervisory authority (in the UK, the ICO).
- The right to object to direct marketing and to outreach contact is absolute — once you object, we suppress permanently.
13. Cookies
Our website and portal use cookies that are strictly necessary (login, security, session), plus analytics cookies to understand how the site is used. Where required by law we ask for your consent before setting non-essential cookies, and you can withdraw it at any time. You can also block cookies in your browser, though parts of the portal may then not work.
14. Grievance Officer
In line with the DPDP Act, 2023, the IT (SPDI) Rules, 2011 and the Consumer Protection (E-Commerce) Rules, 2020:
- Grievance Officer: The Grievance Officer, HuntForTomorrow (HFT)
- Email: admin@huntfortomorrow.com
- Acknowledgement: within 48 hours
- Resolution: within one month of receipt
If you are not satisfied with our response, you may complain to the Data Protection Board of India.
15. Children
Our services are for adults. We do not knowingly process the data of anyone under 18. If we learn we have, we will delete it. Where processing a child's data is unavoidable, we will obtain verifiable parental consent as the DPDP Act requires.
16. Changes to this policy
We will update this policy as our practices or the law change. The "Last updated" date will change, and we will notify active clients of material changes by email or through the portal.
17. Contact
HuntForTomorrow (HFT) — Hunt For Tomorrow
Email (including privacy and grievances): admin@huntfortomorrow.com