Privacy Policy

Who is responsible

The controller of your personal information is:

[CareerDoc legal entity name]
[registered address]
Privacy contact: [privacy@careerdoc.app]

If we are required to have one, our Data Protection Officer / privacy lead can be reached at [dpo@careerdoc.app]. Our representative in the EU / UK for GDPR purposes, where required, is [EU/UK representative name and address].

Information we collect

a. Information you provide

• Account information — your name, email address, and password (stored only as a hash by our authentication provider), or the profile details shared by your chosen sign-in provider (for example, “Sign in with Google”).
• Profile and CV data — work history, education, certifications, projects, publications, skills, links (LinkedIn, GitHub, portfolio), location, salary expectations, an optional avatar image, and the contents of any CV or resume file you upload for parsing.
• Job and application data — job postings you paste or capture (title, company, location, salary, description, source URL), the company and role you apply to, application status and timeline, notes and correspondence you add, and application-form answers.
• Generated content — the CVs, cover letters, application answers, fit scores, interview questions, practice answers and feedback, and assistant chat history produced for you, which we store so you can return to them.
• Messaging identifiers — if you connect WhatsApp or Telegram, the chat identifier needed to send you messages, plus a verification code exchange.
• Payment information — if and when paid plans are offered, billing details are collected and processed by our payment provider; we receive limited information such as a customer identifier, plan, and payment status, not your full card number.
• Communications — messages you send us for support or feedback.

b. Information collected automatically

• Usage data — which features you use and when, counts of billable actions (job scans, document generations, form-answer generations) recorded to enforce plan limits and prevent abuse.
• Device and log data — IP address, browser and operating-system type, timestamps, referring pages, and error and diagnostic logs generated when you use the Services.
• Local storage — tokens and small preferences stored in your browser to keep you signed in (see Section 16).

c. Information from third parties

• Sign-in providers — if you sign in with Google, we receive your basic profile and email from Google.
• Connected Google account — if you authorise it, limited Gmail and Calendar data (see Sections 5 and 6).
• Payment provider — subscription and payment status.
• Pages the extension reads — content from job-posting and application pages you visit while using the extension (see Section 7).

How we use your information

• to create and manage your account and authenticate you;
• to provide the features you use — parsing a CV or job posting, scoring your fit, generating and rendering documents, identifying and filling form fields, drafting application emails, and maintaining your application pipeline;
• with your authorisation, to detect job-related email in a connected mailbox and create calendar events and reminders;
• to send you notifications you have asked for, by email and, if connected, WhatsApp or Telegram, and to send essential account and security messages;
• to generate interview preparation material and score self-practice answers you submit;
• to meter usage, enforce plan limits, and detect, prevent, and investigate fraud, abuse, and security incidents;
• to provide support and respond to your requests;
• to operate, debug, secure, analyse, and improve the Services, using aggregated or de-identified data where practicable;
• to comply with law and enforce our Terms.

We do not use your CV, profile, or job data for advertising, and we do not sell it.

Legal bases (EU/UK)

Where the EU or UK GDPR applies, we rely on the following legal bases:

• Performance of a contract — to provide the Services you sign up for and the features you use.
• Legitimate interests — to secure the Services, prevent abuse, understand how the Services are used, and improve them, balanced against your rights.
• Consent — to connect a Google account and access Gmail/Calendar data, to connect a messaging channel, and to send non-essential marketing. You can withdraw consent at any time.
• Legal obligation — to keep certain records and respond to lawful requests.

If you provide special-category data (for example, information revealing health, disability, ethnicity, religion, or trade-union membership) in your profile or documents, you do so on your own initiative and, by submitting it, you consent to us processing it to provide the Services.

AI processing

To produce generated content, we send the inputs needed for that task — typically your profile text, the relevant job description, and, for form-filling, the labels and context of the fields on the page — to a third-party AI provider that hosts the language model. Currently this is OpenRouter, which routes requests to Google’s Gemini models. We may change providers or models; the current list is in Section 9.

• These providers process your inputs to return output to us and are contractually restricted to that purpose.
• Your data is not used to train foundation models that serve other customers.
• Providers may retain inputs and outputs briefly for abuse monitoring and stability, per their own policies.
• As explained in the Terms, generated content can be inaccurate; you are responsible for reviewing it before use.

Google user data (Gmail & Calendar)

If you connect a Google account, you grant CareerDoc limited access to Gmail and Google Calendar. CareerDoc’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

• What we access. Message metadata and content sufficient to identify job-related email (interview invitations, application confirmations, rejections, offers), and the ability to create, read, update, and delete calendar events for interview scheduling and reminders. We request the narrowest scopes needed for the features you enable.
• How we use it. Only to provide those features. A lightweight keyword/company pre-filter runs first; only messages that pass it are classified. Classification results, and calendar events we create, are stored with your account.
• What we don’t do. We do not use Google user data for advertising, we do not sell or transfer it except to provide the feature or as required by law, and we do not let humans read it except with your explicit consent for specific messages, for security, to comply with law, or in aggregated/anonymised form for internal operations.
• Disconnecting. You can revoke access at any time in the Services or at your Google account permissions page; we then stop accessing Gmail and Calendar and delete stored Google tokens.

The browser extension

When you use the CareerDoc browser extension and it detects a job posting or application page, it reads content from that page so we can extract job details and identify form fields. It sends the relevant text to our servers (and onward to the AI provider, per Section 5) to perform those tasks, and it fills fields in your browser from your profile.

• The extension acts on pages you visit; it does not run in the background across your general browsing, and it fills but never submits.
• It reads your CareerDoc sign-in token from the CareerDoc website’s local storage so you do not have to sign in twice; the token is stored in the browser’s extension storage.
• Captured job text is stored with the corresponding application in your pipeline.

How we share information

• Service providers and sub-processors — who host, secure, and operate parts of the Services under contract (Section 9).
• At your direction — when you send an application email or export your data, the content goes where you send it (for example, to an employer). CareerDoc does not control what a recipient does with it.
• Messaging platforms — to deliver notifications to a channel you connected.
• Legal and safety — to comply with law, respond to lawful requests, enforce our Terms, or protect the rights, safety, and security of CareerDoc, our users, or the public.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this policy or a successor policy with notice.
• Aggregated or de-identified data — that cannot reasonably be used to identify you.

We do not sell your personal information and do not share it for cross-context behavioural advertising.

Service providers and sub-processors

We use the following categories of providers. The specific vendors may change; we will keep this list current.

Each provider is bound by a data-processing agreement and may use the data only to provide its service to us.

International data transfers

CareerDoc and several providers operate in the United States and other countries. If you are in the EEA, the UK, or Switzerland, your information may be transferred to countries that do not provide the same level of data protection. Where we make such transfers, we rely on an appropriate safeguard, such as the European Commission’s [Standard Contractual Clauses] and, where applicable, the UK Addendum, together with supplementary measures. You can request a copy of the relevant mechanism by contacting us.

How long we keep information

• Account, profile, and application data — for as long as your account is active.
• Generated PDF files — stored on our servers for [90] days after creation, then deleted; the structured content they were rendered from is kept with your account so you can re-render them.
• Usage and log data — retained for up to [12] months for security and analytics, then deleted or aggregated.
• After account deletion — we delete or de-identify your personal information within [30] days, except where we must keep it to comply with law, resolve disputes, or enforce our agreements, and except for residual copies in routine backups that expire on a rolling basis.
• Google tokens and data — deleted promptly when you disconnect the integration.

Security

We use technical and organisational measures appropriate to the risk, including encryption in transit (HTTPS/TLS), access controls and least-privilege practices, short-lived access tokens with rotating refresh tokens, hashed passwords handled by our authentication provider, database row-level security, and monitoring. No method of transmission or storage is completely secure; we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law.

Your rights and choices

Depending on where you live, you may have the right to:

• access the personal information we hold about you and receive a copy;
• correct inaccurate or incomplete information (you can edit most of it directly in your profile);
• delete your information (you can delete your account in the Services);
• export your information in a portable format (the pipeline export, plus a full data export on request);
• restrict or object to certain processing, including processing based on legitimate interests;
• withdraw consent where processing is based on consent, without affecting prior processing;
• lodge a complaint with your local data-protection authority. If you are in the EEA/UK, we would appreciate the chance to address your concern first — contact [privacy@careerdoc.app].

To make a request, email [privacy@careerdoc.app]. We may need to verify your identity, and we will respond within the time required by applicable law (generally 30 days). You will not be discriminated against for exercising these rights.

US state privacy rights

If you are a resident of California or another US state with a comprehensive privacy law, you may have the right to know, access, correct, delete, and obtain a portable copy of your personal information, and to opt out of “sale” or “sharing” of personal information and of certain profiling. We do not sell or share personal information as those terms are defined by these laws, and we do not use it for cross-context behavioural advertising. Exercise your rights by contacting [privacy@careerdoc.app]. You may use an authorised agent, subject to verification.

Children

The Services are not directed to children under [16], and we do not knowingly collect their personal information. If you believe a child has provided us personal information, contact us and we will delete it.

Cookies and local storage

We use browser local storage and similar technologies to keep you signed in (session and refresh tokens) and to remember lightweight preferences such as a chosen tab or an unsent draft. The browser extension uses extension storage for its sign-in token and per-page state. We do not use third-party advertising or cross-site tracking cookies. Clearing your browser storage will sign you out.

Marketing and notifications

We send transactional messages (account, security, and activity you asked for) as part of the Services. We will only send marketing email with your consent where required, and every marketing email has an unsubscribe link. You can control in-app, email, and messaging-channel notifications in your settings, and disconnect WhatsApp or Telegram at any time. Opting out of marketing does not stop essential account messages.

Changes to this policy

We may update this policy as the Services evolve or the law changes. If a change is material, we will notify you by email or an in-product notice before it takes effect and update the “Last updated” date above. The current version always governs.

How to contact us

[CareerDoc legal entity name]
[registered address]
Privacy: [privacy@careerdoc.app]
Data Protection Officer / privacy lead: [dpo@careerdoc.app]
EU / UK representative: [representative name and address]