Privacy Policy

Account data: email, full name, optional phone number, password hash (handled by Supabase Auth).

Content you submit: CVs, job descriptions, gap-question answers, free-form chat messages with the in-product help and gap assistants. We process these to deliver the feature you asked for.

Generated content: tailored CVs, cover letters, recruiter messages, interview-prep questions, LinkedIn audits, AI chat threads. We persist these so you can revisit them without re-paying.

Application kanban: companies, roles, status, notes you add to job applications.

Billing data: credit transactions, subscription state, Polar customer / order references. We do NOT see or store full card numbers — those are handled directly by Polar.

Telemetry: page views, feature events, error logs (anonymized where possible). Used only to improve the product.

To run the features you invoke (analyze a CV, tailor a CV, generate a cover letter, chat with the help assistant, etc.).

To send transactional email (signup confirmation, password reset, welcome credits).

To bill you when you purchase credit packs or a subscription.

To detect abuse and rate-limit excessive use.

To improve the product based on aggregate usage patterns.

CVAccelerate uses OpenAI to power its AI features. Content you submit (CVs, JDs, chat messages, gap answers) is sent to OpenAI for inference.

OpenAI does NOT train its models on data sent through their API (per OpenAI’s API data-usage policy, effective March 2023).

We never share your data with OpenAI for any purpose other than producing the response you requested.

Free-form chat features (gap chat, help chat) include classifier and content sanitization layers to reject off-topic or jailbreak content; nothing about that filtering is sent to third parties.

Supabase — authentication, database, file storage. Your data lives in Supabase’s managed Postgres in the region we provisioned.

OpenAI — AI inference for analysis, tailoring, generation, chat (see section 3).

Resend — transactional email delivery.

Polar — payment processing and subscription management.

Cloudflare Turnstile — bot protection on signup / login.

Vercel — hosting and CDN.

Google — OAuth sign-in (only profile + email scopes; never read your Gmail or Drive).

Access: request a copy of all data we hold about you.

Correction: update inaccurate data through the app or by emailing support.

Deletion: request account deletion. Soft-deleted rows are purged from backups within 30 days. Some billing records are retained for tax compliance.

Portability: request an export of your CVs and analyses in JSON.

Objection: opt out of any non-essential processing.

To exercise any of these, email support@cvaccelerate.app. We respond within 30 days.

Active accounts: data retained as long as the account exists.

Soft-deleted analyses and applications: 30 days, then purged.

Billing records: 7 years (tax compliance).

AI chat threads: until the user deletes them or the account is closed.

We use first-party cookies for: authentication session, locale preference, and rate-limit tracking. We do not use third-party advertising cookies.

CVAccelerate is not intended for users under 16. We do not knowingly collect data from children. If you believe a minor has signed up, email us and we will delete the account.

Your data may be processed in the United States or the European Union depending on the third-party processor (OpenAI: US; Supabase: configurable; Polar: EU). All processors are bound by their own DPAs.

We will update the date at the top when material changes happen and notify active users via email if a change affects their rights.

Email support@cvaccelerate.app for any privacy question.