Privacy Policy

We collect the information you provide when you create an account (email address and password hash) and when you use our service (CV files you upload, analysis results, and usage activity such as login timestamps and feature interactions). We also collect technical data automatically — your IP address, browser type, and device identifiers — to operate the service securely. We do not collect sensitive personal categories such as health data, biometrics, or government ID numbers. CV files are processed in memory and deleted immediately after analysis is complete; we do not store your raw CV.

Your data is used solely to provide, improve, and support the CareerAI service. Specifically: your account data identifies you and controls access; your CV content is passed to our AI provider (Anthropic) to generate your career risk report and then deleted; your analysis results are stored so you can access your reports; usage data is aggregated (never individually identified) to improve our model and UI. We do not use your data for advertising, sell it to third parties, or use it to train AI models without your separate, explicit consent.

Your account data is retained for as long as your account is active. Analysis reports are retained indefinitely so you can review them, but you can delete individual reports or your entire account at any time from your Settings page. CV files are deleted from our systems immediately after your report is generated — typically within seconds of analysis completion. Anonymised, aggregated usage statistics (no personal identifiers) may be retained for up to 3 years to support product improvement. If you request account deletion, all personally identifiable data is purged within 30 days, except where retention is required by law (e.g. financial records for active subscriptions).

We use the following sub-processors to deliver the service: Supabase (EU region) for database and authentication; Anthropic (USA) for AI analysis via their API under a Data Processing Agreement; Stripe for payment processing; Upstash for job queuing and caching; Vercel for hosting. Each processor is bound by contractual obligations to handle your data in compliance with applicable privacy law. We do not transfer your data outside these processors without your knowledge. A full, up-to-date list of sub-processors is available on request at privacy@careerai.io.

Depending on your jurisdiction, you have the right to: access the personal data we hold about you; correct inaccurate data; request deletion of your data; restrict or object to processing; receive a portable copy of your data; and withdraw consent at any time (without affecting the lawfulness of prior processing). To exercise any of these rights, email privacy@careerai.io or use the account controls in your Settings page. We will respond within 30 days. If you are in the EU or UK and believe we have not handled your data correctly, you have the right to lodge a complaint with your local data protection authority.