Privacy Policy

What we collect

Account details you give us: name, email address and password (stored only as a secure hash). Optional profile details such as phone and location are encrypted at rest.

Content you create: resumes, cover letters, and the job descriptions you paste for matching.

Usage records needed to run the service: AI generations with token counts and cost, exports, credit ledger entries and security events. We do not put personal data in our log files.

How your content is used with AI

When you run an AI action, the relevant part of your resume is sent to our AI provider to generate the suggestion. We do not sell your content, and we do not use it to train models.

Prompt and response payloads are kept for 90 days for debugging and quality, then permanently stripped. Aggregate figures such as token counts remain, because they contain no personal data.

Cookies

We use essential cookies to keep you signed in and to protect forms against cross-site request forgery. We do not use advertising cookies. Non-essential analytics stay off unless you accept them in the cookie notice.

Sharing

We share data only with the processors needed to run the service: our AI provider for generations, Stripe for payments, and our email provider for transactional messages. Each handles data under its own agreement with us.

A resume becomes visible to others only when you deliberately enable a share link, and you can revoke that link at any time.

Your rights

You can download everything we hold about you as a JSON file from Settings → Data & privacy, at any time and without asking us.

You can delete your account from the same page. We deactivate it immediately and permanently erase your data, including generated files, after a 30-day grace period.

You can opt out of any non-essential email per message type in Settings → Email preferences. Marketing email additionally requires your explicit consent.

Retention

Deleted resumes stay in trash for 30 days. Generated export files are removed after 30 days and can be regenerated. AI payloads are stripped after 90 days. Security audit records are kept for two years.