privacy policy

1. What we collect

• Account data: your name, email address, and authentication details (including your Google account identifier if you sign in with Google).
• Your CV: the file you upload and the structured data we extract from it (education, experience, skills, contact details). A CV can reveal a lot about you — treat this as the core of what we hold.
• Job data: URLs you submit, the scraped content of those postings, and the match scores and summaries we generate for you.
• Technical data: logs needed to run and secure the service (e.g. IP address for rate limiting).

2. How we use it

We use your data solely to provide the service: parsing your CV, scraping the job postings you submit, scoring how well you match them, and showing you the results. We do not sell your data or use it for advertising.

Legal bases under UK/EU GDPR: performance of our contract with you — parsing your CV and scoring it against the jobs you submit is the service you sign up for, so that processing is necessary to provide it — and legitimate interests (securing and improving the service). You can end the contract, and the processing with it, at any time by deleting your account.

3. Who processes your data

We use third-party processors to run the service. In particular, CV content and job posting content are sent to AI providers for analysis:

• Supabase — database, authentication, and CV file storage
• Anthropic (Claude) — CV parsing and job match analysis
• OpenAI — text embeddings of your CV and job postings
• Jina AI — fetching the job posting URLs you submit
• PostHog (EU-hosted) — product analytics
• Resend — transactional email (for example, feedback you submit is emailed to us along with your email address)
• Our hosting providers (currently Vercel and Railway) — running the web app and API

4. International transfers

Some of these providers process data outside the UK/EEA (notably the AI providers, in the United States). Where that happens, transfers rely on the providers’ standard contractual clauses or equivalent safeguards.

5. Retention and deletion

We keep your data while your account is active. When you delete your account, your CV files, extracted profile data, jobs, scores, and analytics profile (including its events) are deleted. Residual copies in backups are removed on the backup rotation cycle.

You can delete your account from your profile settings, or email us and we will do it for you.

6. Your rights

Under UK/EU GDPR you can ask us to access, correct, export, restrict, or delete your personal data, and you can object to processing based on legitimate interests. Email us to exercise any of these — we respond within one month. You also have the right to complain to your supervisory authority (in the UK, the ICO).

7. Cookies and analytics

We use cookies that are strictly necessary to keep you signed in (Supabase auth session cookies). We do not set advertising or cross-site tracking cookies.

We use PostHog, hosted in the EU, for first-party product analytics — which pages are visited and which features are used (for example adding a job or uploading a CV). It is configured cookieless: it stores a random identifier in your browser's localStorage rather than in cookies, does not record your screen, and does not track you across other sites. While you are signed in, analytics events are linked to your account ID and email so we can understand usage per user; this data is deleted when you delete your account. We rely on our legitimate interest in understanding and improving the service.

8. Changes and contact

If we change this policy materially we will take reasonable steps to notify you. Questions or requests: isaac.cruise@gmail.com.