Privacy Policy

1. Who we are

Sakori.org (“Sakori”, “we”, “us”) is a job board for Northeast India. Employers publish openings. Candidates create accounts, apply, and track those applications. You can reach us at admin@sakori.org, through Contact, or on WhatsApp at +91 70864 13528.

This policy covers the Sakori website and the emails we send from it. It does not cover WhatsApp, Facebook, Instagram, or any external application website an employer or a Sakori admin listing may send you to.

2. The information we collect

We collect only what the product uses.

Candidate accounts

If you create a candidate account, we store:

• Full name and email address (required).
• Phone number, if you provide one. We store Indian numbers as +91 followed by 10 digits.
• A password, stored as a one-way hash. We do not store the password in readable form.
• Optional profile details you add later: city, headline, about you, years of experience, skills, and education.
• An optional profile photo, saved as a JPEG on our server.
• An optional PDF resume on your profile, plus the time it was uploaded.
• Whether your email address has been confirmed, and hashed tokens used to confirm it or reset your password.
• Account status (active or deactivated) and created/updated times.

Applying does not require a confirmed email. You can apply while a confirmation is still pending.

Employer accounts

If you create an employer account, we store:

• Your full name (stored in the account name field).
• Email address and phone number.
• Address and city, if you provide them.
• A password, stored as a one-way hash.
• An optional profile photo and an optional “about” text.
• Whether the account is an ordinary employer or a Sakori administrator (that role is set in the database, not by self-signup).
• Hashed password-reset tokens, account status, and created time.

The organisation named on a job is stored on the listing itself, not as a separate company registry.

Job listings

For each job we store the details the poster submits, including:

• Title, organisation name, description, location, job type, sector, experience and salary ranges, skills or requirements, whether a resume is required, recruiter name, listing contact email and phone, closing date, and listing status (for example draft, awaiting review, published, paused, closed, or removed).
• For some listings posted by Sakori administrators: vacancies, application opening date, pay scale, how to apply (on Sakori, by email, or on an external website), and extra labelled details or links.

When a listing is submitted for review, approved, rejected, or taken down, we keep a short moderation record: the job, the action, the administrator (if any), an optional reason, and the time.

Applications

When a signed-in candidate applies on Sakori, we store:

• The candidate’s name, the account email (not a different address typed in the form), phone if provided, cover letter, and a copy of any resume attached to that application.
• Optional experience and skills text if they are sent with the application.
• Application status (pending, reviewed, shortlisted, rejected, or hired), any next-step note the employer writes for shortlist or hired, and the time of application.

You must be signed in as a candidate to apply on Sakori. Some older applications may have no candidate account attached; those rows remain visible to the employer of that job.

Some administrator-posted listings do not collect applications on Sakori. In that case you apply by email or on another website, and Sakori does not receive that application.

Information created by using the site

• A login cookie namedjwt. See section 7.
• Your IP address, used only to limit how many API requests an address can make in an hour (currently 300 per hour).
• Server error messages and failed email-send messages, written to the application log so we can operate the site. In development we may also log HTTP requests. We do not run a separate analytics or advertising tracker on the site.

What we do not collect

The current website does not collect government identity documents, payment card details, date of birth, or precise device location. There is no on-site advertising pixel, and we do not use Google Analytics or similar product-analytics tools.

3. Why we use this information

We use the information to:

• Create and maintain your account, sign you in, and let you reset or change your password.
• Show and search job listings, and let employers post and manage them.
• Send a listing for Sakori review before it goes live (employer-posted jobs), and to record approve, reject, or take-down decisions.
• Let candidates apply, let employers and Sakori administrators review applicants, download the resume attached to an application, and update application status.
• Send the transactional emails listed in section 6.
• Confirm a candidate email address if you use the confirmation link.
• Keep the service secure (rate limits, password hashing, session checks).
• Respond if you contact us.

4. What an employer sees when you apply

For an application submitted on Sakori, the employer who owns that job (and Sakori administrators) can see:

• Name, email, phone (if provided), cover letter, application date, and status.
• The resume file attached to that application, if there is one, including by download from the applicants page.
• Any experience or skills text stored on that application.

They also receive an email that includes your name, email, phone, the job title, an application reference, the date, and — if you attached a resume — that PDF as an email attachment.

Your candidateprofile (headline, about you, education, skills, years of experience, profile photo, and profile resume) isnot automatically sent to the employer. Only what is on the application is shared. If you choose “use my profile resume”, we copy that PDF onto the application so a later profile upload does not change what the employer already received.

If the employer marks you shortlisted or hired, they must write a short next-step note. That note is stored on the application, shown on your applications page, and included in the status email to you.

5. Resumes and photos

Profile and application resumes must be PDF files, 5 MB or smaller. They are stored on the Sakori server (not in the public website folder). Download is only through a signed-in request: the candidate who owns that application, the employer for that job, or a Sakori administrator.

Replacing your profile resume does not replace resumes already attached to applications.

Profile photos are resized and saved under/img/ on the website. Anyone who has the file address can open the image. Recruiter photos also appear on the public recruiter profile page (that page currently requires you to be signed in).

Deleting an account does not currently delete resume files or photos from disk. See section 9.

6. Emails we send

We send transactional email related to your account and activity. Depending on what you do, that can include:

• Welcome email after signup (candidates and employers). Candidate welcome may include an email-confirmation link.
• Email confirmation, if you request another link.
• Password-reset link (valid for 10 minutes) and a notice after a password change.
• Application received (to the candidate).
• New application (to the employer, with resume attached when there is one).
• Application status updates to the candidate (pending, reviewed, shortlisted, rejected, hired).
• For employers: notice that a job is live, was not published (with the rejection reason), or was removed (with the take-down reason).
• For Sakori administrators: notice that a job is waiting for review.

In production, those messages are sent through SendGrid. In development they may be sent through a configured SMTP server. The From address is the address configured for Sakori mail. We do not operate a marketing newsletter in the current product.

7. Cookies and sign-in

Sakori uses one first-party cookie namedjwt. It holds a signed login token so we know which candidate or employer you are. The cookie is HttpOnly (JavaScript on the page cannot read it) and SameSite=Lax. In production it is also marked Secure so the browser only sends it over HTTPS.

The token includes your account id and whether the session is a candidate or employer session. How long it lasts is set in the server configuration (days, not minutes). Changing your password or deactivating the account invalidates existing tokens. Logging out replaces the cookie with a short-lived logged-out value. The login API also returns the token in the JSON response; the website itself signs you in with the cookie.

You can also send the token as a Bearer header if you use the API directly. There are no advertising or analytics cookies.

8. Who can access your information

• You — your own profile, applications, and (for employers) your listings and applicants.
• The employer for a job you applied to — the application details listed in section 4, including the resume on that application. They do not get your password or login token.
• Sakori administrators — they can review listings, take listings down, view employer accounts, deactivate an employer account, view applicants for any job, and download application resumes. The admin dashboard also loads recent employer names and listing summaries.
• Email delivery — SendGrid (production) or the configured SMTP provider (development) processes the message content described in section 6.
• Hosting — the database and uploaded files sit on the servers Sakori uses to run the site. The application does not document a specific country of storage in the codebase.

We do not sell your information. We do not share it with other employers except the one you applied to (or Sakori administrators as above).

Some pages load the Axios library from the jsDelivr content network so forms can talk to our API. That request is made by your browser to jsDelivr, not a transfer of your Sakori account out of our database.

If you follow a Facebook, Instagram, WhatsApp, or external application link, those services receive whatever their own pages collect. Their policies apply.

9. Public and signed-in pages

• Anyone can browse the homepage and the job list. Those pages show listing title, organisation name, location, type, sector, salary or pay information, experience (when present), and skill tags — not your candidate profile.
• Opening a full job page or a recruiter profile currently requires you to be signed in. The job page shows the listing content and organisation name. It does not display the listing contact email or phone on the page. The recruiter profile shows the account holder’s name, photo, about text, city, and address — not their email or phone.
• The jobs API, which requires a login, returns listing fields that include recruiter name and listing contact email and phone.
• Candidate profiles are not published as a public talent directory. Columns exist in the database for a possible future “visible profile” feature; the website does not turn that on or write consent for it.

10. Retention, account deletion, and leftover data

There is no automatic deletion schedule in the software. We keep account, listing, application, and moderation records while they are needed to run the board, unless we deactivate or close them as described below.

If you delete your own account (password required):

• The account is deactivated. You cannot sign in with it.
• Candidates: your applications stay on the job. The employer has already received them. Deactivating the account does not remove those rows or the resume files already stored for them.
• Employers: your listings that are not already removed by Sakori are closed so they no longer appear as open jobs. Applications on those jobs remain in the database.

A Sakori administrator can deactivate an employer account, which also closes that employer’s listings in the same way.

Deactivation is not a hard delete. The row remains, with passwords still hashed. Signing up again with the same email reactivates that row with the new details you submit. Resume and photo files are not automatically erased from disk when an account is deactivated.

If a job is closed or taken down, related applications stay unless the job row itself is removed from the database (the schema would then remove its applications). The ordinary “delete job” action for employers closes the listing; it does not wipe applicant records.

If you want information erased beyond what the website does, email admin@sakori.org. We will look at what the systems can actually remove. We cannot promise a number of days for that work, and we may need to keep some records where we must operate the service or deal with misuse.

11. Security

We take practical steps that the product actually implements:

• Passwords hashed with bcrypt.
• Password-reset and email-confirmation tokens stored only as hashes, with short expiry (10 minutes for reset; 24 hours for email confirmation).
• HttpOnly login cookie; Secure flag in production.
• Login required for applying, posting, and managing accounts.
• Resume download limited to the applicant, the job’s employer, or an administrator.
• Rate limiting on the API, security headers (Helmet), and limits on upload size and PDF type for resumes.

These measures reduce risk. They are not a guarantee against every breach, and we do not claim a security certification.

12. Your choices and requests

From your account you can:

• View and update most profile fields (you cannot change email from the profile form).
• Change your password.
• Upload or replace a profile resume or photo.
• See your applications and their status (candidates).
• Deactivate your account.

To ask for a copy of the information we hold, a correction we cannot make in the account screens, or help with deletion, email admin@sakori.org from the address on the account. We may need to confirm that the request comes from the account holder.

13. Children

Sakori is a job board. We do not knowingly collect information from children, and the site does not ask for age. If you believe a child has an account, contact us and we will deactivate it.

14. Changes

If this policy changes, we will update this page and the version or date at the top. Continued use of the site after a change means you are using the service under the updated policy. We will not use this section to describe collection that the product does not yet do.

15. Contact

Privacy questions, access or deletion requests, and complaints: admin@sakori.org. You can also use sakori.org/contact.

If you are in India and you are not satisfied with our response, you may also use any complaint route available under applicable Indian law. We have not named a separate Grievance Officer in this version of the policy; email above is the contact that exists on the site today.