This Privacy Policy is published pursuant to Section 5, Section 6, and Section 8 of the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 of India. It governs the collection, processing, storage, cryptographic verification, retention, and erasure of personal data on the INTERNSYNC software platform operated by LLM Advocates (“we”, “us”, “our”), acting as a registered Data Fiduciary.

DPDP

DPDP Act Interactive Architectural Blueprint

Explore our live cryptographic ledger, consent lifecycle state machines, and rights automation diagrams.

View Technical Architecture →

1. Data Fiduciary & Contact Particulars

Platform Identity:

INTERNSYNC (Enterprise Internship Management System)

Data Fiduciary Legal Entity:

LLM Advocates

Official Domain:

https://internsync.in

Data Protection Officer (DPO):

Ritik Khurana

Statutory Grievance Email:

rkhurana@internsync.in

Grievance Portal & Dual-Key Tracker:

https://internsync.in/grievance/track

2. Statutory Definitions (DPDP Act, Section 2)

Data Principal (Sec 2(j)): The natural individual to whom the personal data relates (intern candidates, enrolled students, faculty supervisors, and portal visitors).
Data Fiduciary (Sec 2(i)): LLM Advocates, which alone or in conjunction with partnering institutions determines the purpose and lawful means of processing personal data.
Data Processor (Sec 2(k)): Any technical service provider that processes personal data strictly on behalf of the Data Fiduciary (e.g., enterprise cloud infrastructure and verified AI APIs).
Consent (Sec 6(1)): Any freely given, specific, informed, unconditional, and unambiguous indication of the Data Principal's intent through clear affirmative action.
Cryptographic Audit Chain: A SHA-256 HMAC append-only hash sequence establishing irreversible digital proof of consent lifecycle events pursuant to Section 6(7).

3. Age Gate & Protection of Children's Personal Data (Section 9)

Affirmative Age Declaration Required:

Pursuant to Section 9 of the DPDP Act, 2023, InternSync enforces an affirmative age gate during registration (is_adult = true). The platform does not undertake behavioral tracking, targeted advertising, or processing likely to cause harm to individuals under 18 years of age. Where an applicant is below 18, verifiable consent from a parent or lawful guardian is required before data processing begins.

4. Categories of Personal Data Collected & Processed

Data Category	Specific Items Collected	Storage / Protection Mode	Statutory Purpose
Identity & Account Data	Full Legal Name, College / University, Profile Photo	Database Plaintext	Account setup, authentication, and institution roster mapping.
Sensitive Contact Data	Email Address, Mobile Number, Password Hashes	AES-256-CBC / Bcrypt	Two-factor authentication, security digests, and stage notifications.
Application & Credentials	Resume PDF, Cover Letter, Academic Transcripts	Encrypted Storage Disk	Internship evaluation, qualification vetting, and interview scheduling.
Operational Telemetry	Login Timestamps, IP Address, Device Fingerprint, Attendance	Restricted Table	Automated attendance verification, IP blocklisting, and IDPS monitoring.
Consent Artifacts	Purpose, Version ID, Action, Timestamp, Cryptographic Hash	SHA-256 HMAC Ledger	Statutory audit readiness per Section 6(7) & Rule 4.

5. Granular Consent Architecture (DPDP Act, Section 6)

In strict compliance with Section 6(1) and Section 6(2), InternSync avoids bundled, all-or-nothing consent. Each processing purpose is presented with independent disclosures and discrete opt-in toggles:

1. Registration Terms & Core Processing Mandatory for Account

Necessary to create an account, enforce platform security, and administer educational internships under Section 4(1)(a).

2. Transactional & Stage Notifications Voluntary (Opt-in)

Permission to dispatch stage-wise updates regarding task evaluations, offer letters, and credential awards via email.

3. AI-Assisted Screening & Performance Analytics Voluntary (Opt-in)

Permission to process submitted resumes through our sandboxed AI engine (Google Gemini API / OpenRouter) for keyword matching and skill indexing.

4. Alumni Directory & Public Spotlight Voluntary (Opt-in)

Permission to feature candidate name, professional photo, and internship achievements in the public institutional alumni directory.

5. Media & Project Deliverable License Voluntary (Opt-in)

Non-exclusive license permitting the institution to display capstone project decks, code excerpts, and demo videos in educational showcases.

6. Artificial Intelligence & Third-Party Processor Safeguards (Section 6(10))

Zero Data Retention (ZDR) & Human Oversight Guarantee

Where you consent to AI-assisted features, data is routed through verified enterprise endpoints (Google Gemini AI API and OpenRouter). In strict alignment with DPDP Act Section 6(10) and international privacy benchmarks:

No Model Training: Your resumes, task submissions, and communications are never retained or used to train third-party foundation models.
Human-in-the-Loop Mandate: No significant academic or employment outcome (such as application rejection, task grading, warning, or termination) is executed autonomously by an algorithm. All AI outputs serve strictly as assistive recommendations for verified human administrators.
Immediate Cessation Upon Withdrawal: Pursuant to Section 6(10), withdrawing your ai_features consent immediately terminates third-party API transmissions. Your application is then routed for 100% manual human review without disadvantage.

7. Cryptographic Tamper-Evident Ledger (Section 6(7))

Under Section 6(7), the burden of proving that valid consent was given rests upon the Data Fiduciary. InternSync maintains a cryptographic ledger of all consent operations:

Every grant, update, renewal, or withdrawal calculates a SHA-256 HMAC hash binding the candidate ID, purpose, timestamp, IPv4/IPv6 address, and the previous chained hash (previous_hash → audit_hash).
The cryptographic chain is continuously verifiable via automated CLI commands and internal integrity suites.
Downloadable Audit Certificate: Authenticated candidates can generate and download an official DPDP Consent Audit Transcript (Vector PDF) from their dashboard anytime, proving their exact historical consent ledger with verifiable digital signatures.

8. Statutory Data Retention Schedules & Legal Hold Protection (Section 8(7))

Personal data is retained only for the period necessary to fulfill its specified purpose, after which it is securely erased or anonymized pursuant to our formal retention matrix:

Category	Retention Window	Statutory Basis	Post-Period Action
Consent Artifacts & Ledger	5 Years (1,825 Days)	DPDP Act Sec 6(7) & Rule 4	Permanent cryptographic archival.
Unselected Resumes & Applications	180 Days	DPDP Act Sec 8(7) & Rule 8(1)	Automated disk erasure.
Attendance, Location & IP Logs	3 Years (1,095 Days)	DPDP Act Sec 8(7)	Permanent purge.
Support & Mentorship Chats	1 Year (365 Days)	DPDP Act Sec 8(7)	Automated purge.

Statutory Legal Hold Safety Mechanism: Accounts subject to an active dispute, pending grievance, or formal proceeding before the Data Protection Board of India are flagged with is_legal_hold = true. Records under legal hold are strictly protected against automated deletion schedules to preserve evidence until legal resolution.

9. Data Principal Rights Hub (DPDP Act, Sections 11–14)

Every candidate is empowered with dedicated, automated self-service controls accessible directly through the DPDP Rights Hub inside their intern dashboard:

Right to Access & Portability (Sec 11)

Download a comprehensive, machine-readable CSV export of all your personal data, attendance logs, and task records with a single click.

Right to Correction & Updating (Sec 12)

Update inaccurate or incomplete profile records, contact data, or academic particulars through self-service profile controls.

Right to Erasure & Deletion (Sec 12)

Request complete erasure of your profile. Initiates a 30-day statutory grace period during which you can reverse the deletion request.

Right to Nominate (Sec 14)

Designate a lawful representative to exercise your data principal rights in the event of death or physical/mental incapacity.

10. Consent Withdrawal & Account Freezing Protocol (Section 6(5))

You have the statutory right to withdraw previously granted consent at any time:

Voluntary Consents (AI, Reviews, Alumni, Media): Toggling off any voluntary consent in your dashboard executes immediately. Data processing ceases and associated assets are unpublished without penalizing your ongoing internship.
Mandatory Terms & Core Processing Consent: Because processing identity data is essential to delivering educational internship credits and system access, withdrawing consent for Registration Terms initiates an automated account freeze. Your active session is logged out, access is disabled, and your account enters a 30-day retention window before irreversible deletion.
Anti-Abuse Cooldown: To safeguard system stability against automated scripts, a 7-day cooldown period applies between successive toggles of the same consent purpose.

11. Cookies, Telemetry & Zero-External-CDN Architecture

To eliminate unauthorized third-party tracking, InternSync operates a Zero-External-CDN policy:

Self-Hosted Fonts & Scripts: Typography (Plus Jakarta Sans), stylesheet frameworks (Tailwind CSS), and front-end scripts (Alpine.js) are strictly self-hosted on our own Indian servers. Your browser makes zero outbound requests to external Google Fonts or CDN servers.
180-Day Cookie TTL: Non-essential analytics cookies are capped at an immutable lifespan of 180 days.
Essential Cookies: Encrypted session cookies (ims-session) and CSRF protection tokens (XSRF-TOKEN) are strictly required for secure authentication and cannot be disabled.

12. Data Breach Notification & Emergency Incident Response (Section 8(6))

Statutory Breach Response Protocol

In the unlikely event of an unauthorized security breach affecting your personal data, InternSync will:

Notify the Data Protection Board of India within statutory timelines.
Notify all affected Data Principals without unreasonable delay via registered email, detailing the scope of the incident, impact analysis, and recommended remedial measures.
Coordinate immediate mitigation in accordance with CERT-In (Indian Computer Emergency Response Team) guidelines.

13. Grievance Redressal & Data Protection Officer (Section 8(10))

Office of the Data Protection Officer Statutory SLA

Designated Officer:

Ritik Khurana

Direct DPO Email:

rkhurana@internsync.in

Formal Acknowledgment:

Within 48 Hours

Maximum Resolution Window:

Within 30 Calendar Days

If your concern remains unresolved, you retain the statutory right to escalate directly to the Data Protection Board of India.

File Grievance → Track Ticket

14. Notice of Modifications & Re-Consent Wall

We reserve the right to revise this Privacy Policy to maintain parity with legislative updates or functional upgrades. Whenever material changes occur:

A version diff summary will be published with an updated version increment (v1.0 → v2.0).
Upon your next login, an interactive scroll-to-agree Re-Consent Wall will appear, requiring explicit review before further platform interaction.
Registered candidates will receive email notification summarizing the operational impact of the modifications.

15. Governing Jurisdiction

This Privacy Policy is construed and governed in accordance with the laws of the Republic of India, specifically the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000. Any disputes arising hereunder shall be subject to the exclusive jurisdiction of the competent courts and appellate tribunals of India.

INTERNSYNC

🌐 Choose Policy Language / अपनी भाषा चुनें

Privacy Policy & Personal Data Governance Charter