Privacy Policy

CV / Resume content. When you upload or paste your CV, we store the extracted text so our AI can analyze it against job descriptions. We do not store the original file after processing unless you explicitly save it to your account.

Account information. We collect your email address when you register, and your name if you choose to provide it. Passwords are hashed and never stored in plain text.

Usage data. We log basic product events — pages visited, features used, and scan counts — to understand how the product is used and to enforce plan limits. This data is not linked to advertising profiles.

Your CV text is sent to our AI providers (OpenAI or Google Gemini) solely for the purpose of generating match scores, keyword suggestions, and cover letters on your behalf. We do not use your CV content to train AI models, and our agreements with those providers prohibit them from doing so as well.

Your email address is used to manage your account, send transactional messages (receipts, password resets), and occasionally share product updates. You can opt out of marketing emails at any time via the unsubscribe link in each message.

We do not sell, rent, or trade your personal information to any third party for commercial purposes. Period.

All user data is stored in Supabase, a managed PostgreSQL platform. Data is encrypted at rest using AES-256 and in transit over TLS 1.2+. Supabase infrastructure is hosted on AWS and is SOC 2 Type II compliant.

Access to production data is restricted to the core engineering team and is protected by multi-factor authentication. We conduct periodic security reviews and apply patches promptly.

While we take security seriously, no system is 100% immune to breaches. In the event of a data incident that affects you, we will notify you by email within 72 hours of discovery.

OpenAI / Google Gemini — We route CV text and job description content to these providers to power our AI features. Both providers operate under data processing agreements that restrict use of your content.

Stripe — All payment processing is handled by Stripe. We never see or store your full card number; Stripe returns only a tokenized reference. Stripe's privacy policy governs payment data.

Resend — Transactional emails (receipts, magic links, alerts) are delivered via Resend. Your email address is shared with Resend solely for delivery purposes.

You have the right to access, correct, export, or delete your personal data at any time. Most of this can be done directly from your Account Settings page. For anything you can't do yourself, email us at a.aitibour@gmail.com and we will fulfill your request within 30 days.

If you are located in the EU/EEA, you have additional rights under the GDPR, including the right to lodge a complaint with your local data protection authority. We honor GDPR requests from all users regardless of location.

We use session cookies to keep you logged in between page loads. These cookies are essential to the service and do not track you across other websites. We do not use advertising cookies, third-party analytics cookies, or fingerprinting techniques.

You can disable cookies in your browser settings, but doing so will prevent you from staying logged in. We do not currently honor Do Not Track signals, as we do not perform cross-site tracking regardless.