Privacy Policy

What we collect

Account details: your email address and name. If you sign in with Google or GitHub, we receive your name, email address and profile picture from that provider.

CV analysis: when you analyse a CV we save the file name, file size and the resulting score, skills and suggestions to your account. The CV file itself is not kept after the analysis.

CV builder: the CV you build is kept in your browser, and in your account when you are signed in, until you delete it.

Applications: when you use Apply, we store the name, email, optional phone number, introduction and CV file you attach, together with the job you applied to.

Saved jobs and apply clicks: the listings you bookmark and which listings you open from CareerAI.

Profile (optional): if you fill in your dashboard profile we store your headline, current role, years of experience, skills, preferred locations and work arrangement, education, experience, profile links, and the CV file you upload there. Only you can see it; employers do not see your profile unless you apply to them.

Job alerts prompt: the "Get Job Confirmed" box remembers in your browser (local storage) whether you closed it or subscribed, so it doesn't keep appearing. Nothing about this is sent to us unless you submit the form.

Payments: for wallet or bank payments we store the plan, amount, payment method, the transaction ID you enter and, if you give them, the sender name and the last 4 digits of the sending number. We never ask for or store your PIN, OTP, card number or full account number.

Plan and usage: whether you are on Free or Pro, your Boost credits, and a count of AI actions (reviews, tailored CVs, cover letters) so monthly limits work. The content of those actions is not kept in this log.

Alerts: your alert settings (skills, cities, type, email frequency). If you connect Telegram we store your Telegram chat ID; email digests go to your account email.

Referrals and ambassadors: which account invited yours (from an invite link), whether you built a CV (that is what counts toward your friend's reward), ambassador applications (university, society, your plan) and the Pro pass codes ambassadors create and redeem.

How your CV is processed

Your CV's text is read in your browser. Before anything is sent, your name, email address, phone number, CNIC number and profile or portfolio links are removed. Only that cleaned text reaches our server. Scanned PDFs without a text layer cannot be read in the browser, so they are sent as the file itself.

The cleaned text is sent to the Google Gemini API for written feedback. When Gemini is overloaded it may instead go to a backup provider (Groq or OpenRouter). Under the free-tier terms of these providers, they may review and use that content to improve their services, so avoid uploading information you do not want shared.

Your numeric CV score is calculated by our own rules, not by an AI model, and job match percentages are calculated in our database without sending your CV to an AI model again.

To give instant results for a CV that was already analysed, we keep the analysis result and a numeric fingerprint (embedding) of the cleaned text, identified by a one-way hash. We do not keep the CV text: while an analysis waits in line, the cleaned text is stored temporarily and deleted as soon as it is processed (at most 2 days).

When you use the CV builder's AI features, the lines you write (without your contact details) are sent to the same providers to suggest bullet points.

Pro tools (tailored CV, cover letter, LinkedIn message) send your saved CV's text without your name, email, phone or links, together with the job posting, to the same providers. Your name is added to the letter afterwards on our server. Tailored CVs are saved as a new version in your account.

Word (.docx) files are generated on our server from your CV and sent straight back to you; they are not stored.

Instructions hidden inside a CV are ignored by our analysis and flagged to you.

Where it is stored and who can see it

Data is stored in Supabase (database and private file storage) and the site is hosted on Vercel. Row-level security ensures each signed-in user can only read their own records; CV files sit in a private bucket inside a folder only your account can access.

Your browser never connects to our database directly: all reads and writes go through our server, and your session is kept in a secure, httpOnly cookie.

To stop bots from abusing CV analysis, upload forms may use Cloudflare Turnstile, which processes your IP address and browser signals to check that you are a person.

Email digests and payment emails are sent through Resend. Telegram alerts are sent through Telegram's Bot API, which receives your chat ID and the job links in each message. The WhatsApp Channel is a public broadcast: following it does not share your phone number with us.

The PKR pay estimate uses daily exchange rates from open.er-api.com; no personal data is sent to it.

Payment verification is done by a CareerAI admin, who sees your account email and the payment details above.

For listings from other sites, we do not send your CV or introduction to employers: you submit them yourself on the employer's or job board's own page.

When you apply to a vacancy that an employer posted on CareerAI ("Apply on CareerAI"), your name, email, optional phone number, cover note and CV go to that employer's hiring team only. They can see them, move your application through stages and add internal notes you don't see. Other employers cannot see your application.

We do not sell your data or use it for advertising.

How long we keep it and how to delete it

Application CVs and introductions are kept until you delete the application. Deleting an application in Saved → Applications removes its CV file and record immediately.

Saved jobs are kept until you remove them. If you are signed out, saved jobs live only in your browser's local storage.

Saved CV versions are kept until you delete them. Alert settings are kept until you change them: email digests stop from the Unsubscribe link in any digest, and Telegram alerts stop with /stop or Disconnect.

Payment records are kept for as long as the law requires us to keep financial records, even if you delete your account.

Applications to CareerAI-hosted vacancies are kept until you withdraw them on the vacancy's apply page (which deletes the CV file), or until the employer's organization is deleted.

Search analytics are deleted automatically after 180 days.

Your profile and profile CV are kept until you change or delete them in your dashboard (Profile & CV).

You can download everything stored about your account from Dashboard → Account & privacy, and delete your account there yourself (type DELETE to confirm). That removes your profile, CV files, saved jobs, applications and alert settings straight away. You can also email us at the address below; we complete deletion within 30 days.

Job alerts (Get Job Confirmed)

If you enter your email and skills in the "Get Job Confirmed" box, we store your email address, the skills you chose, the page you signed up from and the time you gave consent.

We send one confirmation email first. Alerts start only after you click the link in it (double opt-in); unconfirmed sign-ups get no alerts. If you're signed in with a verified email, that address is used without a second confirmation.

Alerts contain jobs that match your skills, at most once a week. They are separate from any marketing: we don't send promotions to this list.

Every alert email has a one-click Unsubscribe link. After you unsubscribe we keep only your email and the unsubscribed status, so we don't email you again.

Search analytics

To see which jobs people look for, which cities lack listings and whether search works, we record searches made on the job search page: the keywords, the city, country, work mode and job type filters, the number of results, and the time. We also record when a listing is opened, saved or its apply link is clicked.

Before a search is stored, email addresses, links and long numbers (such as phone or CNIC numbers) are removed from it. We never store CV text, passwords or IP addresses in these records.

Each browser tab gets a random identifier (kept in session storage, not a cookie) so searches in one visit can be linked to the jobs opened afterwards. If you are signed in, the record is also linked to your account; employers never see who searched for what.

Only CareerAI admins see these records, and only as totals (most searched keywords and cities, searches with no results). Popular searches may be suggested to other visitors as autocomplete only after at least three different searches.

If your browser sends Do Not Track or Global Privacy Control, nothing is recorded. Records are deleted after 180 days, and deleting your account deletes the ones linked to it.

Employer accounts

Organizations that post jobs give us their organization name and, optionally, website, logo link, description, locations and a public contact. These appear on the organization's public company page.

We record who in an organization created, edited, published or closed a vacancy, changed an applicant's stage or exported applicants, to keep employer activity accountable.

An organization is shown as verified only after a CareerAI admin reviews it (for example, that the work email matches its website). We may suspend organizations that post misleading or fraudulent vacancies.

Job listings

Listings come from public company career pages and job boards. Each listing shows its source, and Apply opens the original posting. We remove listings that disappear from their source or pass their deadline.

Contact

Questions or deletion requests: ahsanmohsin1259@gmail.com