Privacy Policy

We collect only what we need to provide and improve CigyID:

• Account information — your email address, display name, and authentication provider (e.g., Google) when you sign up.
• Profile content — the information you choose to add to your CigyID profile: name, bio, phone, social links, photos, gallery images, documents, emergency contacts, and any custom fields.
• Tag data — the unique slug, label, and type of any NFC tag you claim or create.
• Career data — career timeline entries (titles, employers, dates, salary), career gaps, generated and uploaded resumes, assessment responses and scores.
• BGV data — Background Verification documents you upload, verifier comments, and per-item verification status.
• Lead Management data — for issuer/business accounts, leads promoted from sharebacks and the action history (calls, emails, meetings, follow-ups) recorded by your team.
• Scanned business cards — temporary card images submitted to our AI scanner; the image is discarded after extraction and only the structured contact fields are kept.
• Usage analytics — counts of profile views and shareback submissions on tags you own. We deliberately ignore visitor IP and user-agent data for analytics integrity.
• Operational logs — limited diagnostic data (timestamps, error events) needed to keep the service running safely.

We do not collect biometric data, location coordinates, advertising identifiers, or browsing history outside CigyID.

• To render your public profile when someone taps your tag or visits your link.
• To authenticate you and protect your account from unauthorised access.
• To generate the analytics and shareback logs visible in your dashboard.
• To generate AI resumes from your career timeline, grade assessments, and extract contacts from scanned business cards.
• To run Background Verification on the timeline items you submit, and display verifier feedback only to you and the authorised verifier.
• To surface your profile in Employer Search only if you explicitly opt in — and to remove it within minutes when you opt out.
• To send transactional emails (sign-in, security notifications, billing receipts, BGV updates, brute-force unlock links) via notify.cigyid.com and verify.cigyid.com.
• To detect, investigate, and prevent fraud or abuse of the service.

We do not use your data to train advertising models, and we do not use it to train third-party AI systems. Public profile pages explicitly instruct search engines and AI crawlers (including GPTBot, ClaudeBot, Google-Extended, and others) not to index or train on profile content.

• Encryption in transit: all traffic to CigyID is served over HTTPS with modern TLS.
• Hashed credentials: Privacy PINs and Wallet passwords are hashed with bcrypt on the server and verified through dedicated edge functions — they are never stored or transmitted in plaintext.
• Brute-force lockout: 10 wrong PIN or Wallet attempts trigger an automatic 5-hour lockout, with an emailed unlock link sent from verify@cigyid.com.
• Row-level security: the database enforces row-level security so users can only read or modify rows that belong to them.
• Scoped storage: uploaded images, gallery photos, BGV documents and wallet files live in isolated buckets keyed to your user ID; other users cannot list or read your files.
• Server-side validation: sensitive lookups go through security-definer functions so internal IDs are never leaked to the browser.
• Session hygiene: sessions automatically expire after 10 minutes of inactivity, and signing out clears local state immediately.
• Privacy-by-default for profiles: individual profile pages send noindex, nofollow, noarchive headers to all major search engines and AI crawlers.

You can mark fields as personal and lock them behind a Privacy PIN. Premium users can upload documents into a Wallet protected by a separate password. Both are bcrypt-hashed and verified server-side via dedicated edge functions. Even CigyID staff cannot recover a lost PIN or Wallet password — only reset it.

By design, anyone with your tag link can view your public profile fields. Fields you mark as personal remain hidden until a visitor enters your PIN. Wallet documents stay locked until the Wallet password is entered.

Career data, BGV documents, lead-management data and Wallet documents are never public by default. Career analytics, salary entries and BGV documents are only ever visible to you and the verifier you grant access to. Employer Search visibility is opt-in — your profile only appears when you explicitly enable it, and disappears within minutes of opting out.

Search engines and AI crawlers are told not to index profile pages, but a determined human visitor with your link will still see public fields — only put on your profile what you are comfortable sharing.

Some features (AI Resume Builder, AI Assessment grading, Business Card Scanner, Career timeline extraction) use third-party AI models routed through the Lovable AI Gateway. We send only the minimum data needed to perform the task; outputs are returned to you and stored on your account.

The model providers we use (Google Gemini and OpenAI families) operate under contracts that prohibit using your data to train their general-purpose models. Scanned business card images are discarded after extraction; only the structured fields are kept.

CigyID runs on managed cloud infrastructure (Lovable Cloud, powered by Supabase). Data is stored in secure, access-controlled databases and object storage. Backups and 90-day archival snapshots are retained to support data recovery for accidental deletions.

We share data only in these limited cases:

• Service providers who host our infrastructure, send our emails, process payments, or run AI inference (via the Lovable AI Gateway) — under strict contractual confidentiality.
• Issuers (organisations that issued your business tag) may see profiles linked to their issuer for branding and management purposes.
• BGV verifiers you authorise can see the specific timeline items and documents you submit for verification.
• Employer Search — only when you opt in. Employers can then see the public fields you have chosen to surface.
• Legal compliance — when required by valid law, court order, or to protect users from imminent harm.

We never sell, rent, or trade your personal data.

• Access & edit — view and update any profile field from your dashboard at any time.
• Export — download your contact card (vCard) directly from your profile.
• Unlink or delete — unlink a tag or delete profile data; archived snapshots are retained for 90 days for recovery, then permanently purged.
• Withdraw consent — disable shareback, lost-tag mode, or end-to-end encryption from your security settings.
• Account deletion — email request@cigyid.com and we will permanently delete your account and associated data within 30 days, subject to legal retention obligations.

Active profile data is retained while your account is active. Deleted or unlinked items are kept as encrypted JSON snapshots for up to 90 days to allow recovery, then permanently removed. Operational logs are rotated regularly and not used to build behavioural profiles.

CigyID is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us data, please contact us so we can remove it.

CigyID is operated from India. By using the service, you consent to the transfer and processing of your data in jurisdictions where our infrastructure providers operate, with safeguards consistent with this policy.

We may update this Privacy Policy as the service evolves. Material changes will be announced on this page with a new "Last updated" date. Continued use of CigyID after a change constitutes acceptance of the revised policy.

Questions, requests, or concerns about your privacy?

• Email: request@cigyid.com
• Phone: +91-7483306904
• Web: www.cigyid.com