Privacy Policy

Effective Date: June 1, 2026

Last Updated: October 3, 2026

WinJob is part of WinQ AI Labs Software Private Limited. Our address is Plot 67, Avanthi Nagar Thota, Hyderabad - 500018.

This Privacy Policy describes how WinQ AI Labs Software Private Limited ("WinJob," "we," "us," or "our") collects, uses, and protects your personal information when you use the WinJob platform available at https://winjob.pro (the "Service"). This policy explains the information used to provide the Service and the choices available to you. Where consent is required for a particular use, that use is subject to the applicable consent requirements.

1. Information We Collect

1.1 Information You Provide Directly

When you create an account, contact us, or use certain features of the Service, you may provide us with:

Account Information: Your name, email address, authentication credentials, and account settings. Password-based sign-in stores a password hash rather than a readable password.
Profile Information: Optional details such as your job title, company name, or avatar.
Payment Information: Billing details processed through Razorpay, together with payment references, transaction status, purchased access and subscription information. Payment-method details are handled by the payment provider; WinJob does not receive or store your full card number.
User Content: Course progress, quiz responses, saved learning activity, AI prompts and responses, and information you choose to submit for enabled features. This can include job descriptions, career profiles, interview context, diagrams or files. Only submit information you are entitled to use.
Communications: Messages you send to us via email or the contact form.

1.2 Third-party sign-in

When you choose a third-party sign-in option offered by WinJob, such as Google or GitHub, the provider shares the account information authorized on its consent screen. For Google Sign-In, this includes:

Email address associated with your Google account.
Basic profile information, including your display name and profile picture.

We use this information solely to create and manage your WinJob account, personalize your experience, and communicate with you. We do not access your Google contacts, Google Drive files, or any other Google services beyond the authentication scopes listed above.

You can revoke access through the relevant provider's account permissions. Revoking a sign-in connection does not by itself delete your WinJob account or cancel a paid subscription.

1.3 Information Collected Automatically

When you use the Service, we may automatically collect:

Usage Data: Feature requests, learning activity, and usage records needed to provide the Service, apply plan limits and troubleshoot errors.
Device Information: Browser and device information associated with a request or support report.
Log Data: IP address, access times, referring URLs, and error logs.
Cookies and Similar Technologies: We use cookies and browser storage to maintain your session and remember your preferences. See Section 7 for details.

2. How We Use Your Information

We use the information we collect to:

Provide and maintain the Service, including account creation, authentication, and feature delivery.
Diagnose technical problems, understand feature usage and maintain the Service.
Communicate with you about account activity, security alerts, billing and support inquiries. Product communications are subject to your choices and applicable law.
Process transactions and send related billing or subscription information.
Show and charge prices in the currency for your region: Indian rupees in India and US dollars elsewhere. When prices are about to be shown to you, your browser asks ip-api.com, a geolocation service, for your country. ip-api.com receives your IP address to answer and returns a two-letter country code. The lookup runs in your browser on each page load, and nothing from it is stored in your browser or on our servers: only the country code and the time zone your device reports are sent to our servers, and only to choose the currency. If the lookup is unavailable, your time zone decides. If you already hold a paid plan, its currency is used instead.
Enforce our Terms of Service and protect against fraud, abuse, or unauthorized access.
Comply with legal obligations and respond to lawful requests from authorities.

AI-assisted features

When you use an AI-assisted feature, your input and the context needed to answer it are sent to the AI service configured for that feature. For example, an interview prediction may use the career profile and job description you provide; a diagram evaluation uses the submitted diagram and related question. Generated responses and usage records may be saved to provide history and manage your credit allowance.

External AI services process submitted data under their applicable terms and privacy policies. Do not include passwords, payment credentials, confidential employer information or another person's sensitive information in an AI prompt or upload. Contact us if you need the current provider and data-processing details before submitting sensitive material.

We do not sell your personal information. We may share your information in the following circumstances:

Service Providers: We use providers for hosting and databases, file storage, authentication, payment processing, email delivery, analytics and AI-assisted features. Information is sent to the providers needed to perform the relevant function. Razorpay handles payments; a sign-in provider receives information when you choose that sign-in option. Provider availability and configuration can vary by feature. ip-api.com receives your IP address directly from your browser when prices are about to be shown to you, and returns your country so prices are shown in the right currency.
Collaboration Features: If you join an organization, information required to administer membership and access is available to its authorized administrators. Content you explicitly share is available to its intended recipients.
Legal Requirements: We may disclose information if required by law, subpoena, court order, or other legal process, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

4. Data Retention

We retain personal information while it is needed to provide the Service and for the purposes described in this policy. Deleting your account removes your ability to use it. We delete or anonymize associated information when it is no longer needed, subject to legal, tax, security and dispute-resolution requirements. Backup copies and records held by payment or other service providers may follow separate retention periods.

Some organization records may remain where required to administer that organization. Contact us for a deletion request or information about the records that must be retained. Cancelling a subscription does not delete your account or learning history.

5. Data Security

We use authentication, access controls and other safeguards to protect the information processed by the Service. Access is limited according to the function being performed. No internet service or storage system can guarantee absolute security. Please use strong authentication, keep your device secure and contact us if you suspect unauthorized access.

6. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights:

Access: Request a copy of the personal information we hold about you.
Correction: Request correction of inaccurate or incomplete information.
Deletion: Request deletion of your personal information, subject to legal retention requirements.
Data Portability: Request a machine-readable copy of your data.
Objection/Restriction: Object to or restrict certain processing activities.
Withdraw Consent: Where a processing activity relies on your consent, you may withdraw it at any time. This does not affect processing carried out before withdrawal. Contact us to make a request.

To exercise any of these rights, contact us at shafi.khan@gmail.com. We may need to verify your identity before acting on a request. We handle requests within any period required by applicable law. You may also raise a concern with the relevant data-protection or consumer authority where that right applies.

7. Cookies and Tracking Technologies

We use cookies and similar technologies for the following purposes:

Essential Cookies: Required for authentication, session management, and core functionality.
Local Feature State: Browser storage can retain interface choices and feature state needed for your experience.
Preference Cookies: Remember your settings and display preferences.

Usage analytics and session recordings. When enabled by deployment configuration, Google Analytics and PostHog collect approved usage events automatically; the Service does not currently provide an in-app analytics or recording preference control. Google Analytics may store first-party _ga cookies when enabled. Session recordings use PostHog only and run on eligible pages only when replay is explicitly enabled for that deployment. Disabling a provider in a later build stops future collection but does not automatically delete data already sent or cookies already stored.

PostHog records a fixed list of approved page, navigation, learning and checkout events. It uses random pseudonymous visitor and session identifiers held in that browser tab's session storage; when you are signed in and PostHog is enabled, it also associates events with an opaque account identifier. Google Analytics receives sanitized page views and a smaller allowlist of app events, without a WinJob account identifier. For page views and app events sent by WinJob, both providers use a generic route description such as /app/win-system-design/questions/:content in place of the actual page address; query strings and fragments are discarded. Google Analytics receives only the referring site's origin on entry and the previous generic route during in-app navigation; it does not receive the referring page's path, query string or fragment in those app events. Campaign parameters are not sent as app-event properties. GA4 also automatically produces standard session, first-visit and engagement signals and processes basic browser/device and approximate-location information when enabled. The GA4 web stream can independently send Enhanced Measurement page views on page load or browser-history changes, plus optional events outside the app-event allowlist. Those property settings are not controlled by this application; disable Enhanced Measurement page views and optional events in GA4 as described in the analytics setup guide. If left enabled, those features may collect additional page URLs or interaction data, including outbound-link URLs, searches, video use, downloads and form interactions. The analytics integrations do not send your name, email address, free-text searches, note contents, AI prompts or responses, chat messages, credentials, payment signatures or payment identifiers as app-event properties.

When PostHog replay is enabled for the deployment, it may capture eligible page layouts, authored curriculum, scrolling and interactions. All text is masked by default and only authored interface and course copy is left readable. Form inputs are always masked. Avatars, note contents, personal AI material, uploaded images, embedded frames and elements we mark as private are removed from the recording entirely. Authentication pages, account and security settings, administration, invoices, private notes and private chat content are not recorded at all. Recording pauses before a hosted payment page opens and resumes after the payment attempt ends. Console output, network request and response contents and network headers are never recorded. Browser settings, connection problems and content blockers mean not every eligible visit is recorded.

Information sent to PostHog is processed and stored in the United States, according to the configured project retention period and PostHog's service terms. See PostHog's privacy policy. Google Analytics is provided by Google and is subject to Google's Privacy Policy. If you want to know what has been recorded about you, or ask for it to be deleted, contact us at shafi.khan@gmail.com and we will act on the request as described in Section 6.

You can also manage cookies and local storage in your browser settings. Disabling essential storage may prevent sign-in or other core functionality.

8. International Data Transfers

If you access the Service from outside the jurisdiction where our servers are located, your information may be transferred to, stored, and processed in a different country. The locations depend on the providers used for the relevant feature. Transfers are subject to applicable data-protection requirements. Contact us for current processing-location and safeguard details before submitting information with residency restrictions.

9. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child under 16, we will take steps to delete it promptly. If you believe a child has provided us with personal information, contact us at shafi.khan@gmail.com.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by posting the revised policy on this page and updating the "Last Updated" date. Where a change requires new consent under applicable law, we will request that consent.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy, contact us at:

WinQ AI Labs Software Private Limited Plot 67, Avanthi Nagar Thota, Hyderabad - 500018 Email: shafi.khan@gmail.com Website: https://winjob.pro