Privacy Policy

1. Data we collect

• Account data: name, email, password (hashed), or your Google/Apple sign-in identity.
• Profile and career data you provide: job title, location, target role, experience level, career goals, and the content of your resumes, cover letters, job applications, notes, and coach conversations.
• Uploaded documents: files you import (e.g. an existing CV) and their extracted content.
• Payment data: handled by Stripe. We store your subscription status and plan — never your card number.
• Usage data (only with your cookie consent): product analytics, session replays with masked inputs, web vitals, and error reports.
• Technical data: IP-derived approximate location (for language defaults), browser type, and security logs.

2. Why we process it (legal bases)

• To provide the Service — storing and rendering your documents, running AI features you request, tracking your applications (contract, Art. 6(1)(b)).
• To bill subscriptions and prevent abuse, including credit accounting and rate limiting (contract & legitimate interest, Art. 6(1)(b), (f)).
• To send account emails: welcome, verification, password reset, billing and subscription notices (contract, Art. 6(1)(b)).
• To send marketing emails — only with your consent, which you can withdraw anytime via the unsubscribe link (consent, Art. 6(1)(a)).
• To measure and improve the product with analytics and session replay — only with your cookie consent (consent, Art. 6(1)(a)).
• To keep the Service secure and debug errors (legitimate interest, Art. 6(1)(f)).

3. AI processing

When you use AI features, the relevant content (e.g. your resume text and a job description) is sent to our AI provider Anthropic (Claude models) — and, as a fallback for reliability, to other model providers — to generate the result you asked for. Our providers process this data as processors under data-protection agreements and do not use it to train their models.

AI telemetry (token counts, latency, quality flags) is stored to keep the features reliable and is deleted with your account.

4. Processors and recipients

We share data only with the processors needed to run the Service: Convex (database and backend), Vercel (hosting and web analytics), Anthropic (AI), Stripe (payments), Resend (email delivery), SearchApi (job search queries — no personal data beyond your search terms), PostHog (EU-hosted analytics, after consent), Google Analytics/Ads and Mixpanel EU (after consent).

Some processors are based in the US and process data under the EU–US Data Privacy Framework or Standard Contractual Clauses. We never sell personal data.

5. Retention

Your data is kept while your account exists. Deleting your account permanently removes your profile, documents, applications, conversations, AI memory and logs, analytics events, ATS scores, and newsletter subscription. Some billing records are retained as required by bookkeeping law (5 years in Denmark). Anonymous, aggregated statistics may be kept.

6. Your rights

• Access and portability: download a copy of your data from Settings → Download my data.
• Rectification: edit your profile and documents directly in the app.
• Erasure: delete your account in Settings — this triggers full deletion as described above.
• Withdraw consent: unsubscribe link in every marketing email; change cookie choice on the Cookie Policy page.
• Objection and restriction: contact us at the email above.
• Complaint: you can complain to Datatilsynet (the Danish Data Protection Agency, datatilsynet.dk) or your local supervisory authority.

7. Children

The Service is not directed at children under 16, and we do not knowingly collect their data.

8. Changes

We will announce material changes to this policy by email or in-app before they take effect.