Privacy Policy

1. Who we are

CareerBoost AI (“the service”) is a resume, cover letter and job-matching tool for job seekers in the United States and United Kingdom. The operator of this deployment is the data controller for the personal data described below. Requests can be made through the contact form.

2. What we collect

• Account data. Your email address, the name you choose to provide, and a password. Passwords are never stored in plain text — either hashed with scrypt in the built-in local backend, or managed by Supabase Auth when it is configured.
• Documents you create. Resume content, cover letter text, and ATS check reports you save to your account.
• Usage counters. A record of which AI feature was used and when, so monthly plan limits can be enforced. We store the feature name and a timestamp, not the content.
• Contact messages. The name, email, subject and message body you submit through the contact form.
• Technical data. Our hosting provider records standard request logs (IP address, user agent, timestamp) for security and abuse prevention.

3. What we do not collect

• No advertising identifiers, no third-party analytics trackers, no session recording.
• No payment details — billing is not connected in this build.
• No copies of uploaded resume files. Uploads to the ATS checker are parsed in memory to extract text and are discarded when the request finishes.

4. AI processing

When you use an AI feature — bullet improvement, summary drafting, cover letter generation or the ATS explanation — the text required for that request is sent to GroqCloud, the inference API operated by Groq, Inc., using a server-side API key. That means:

• The API key is never exposed to your browser; every request is proxied by our server.
• Only the fields relevant to the feature are sent: for bullet improvement, the bullets and role title of the role you are editing; for a summary, the career details you type into that panel; for cover letters, your resume or profile text and the job description you paste; for the ATS explanation, the findings our local analyser already produced (no file is re-uploaded).
• Groq processes the request to return a completion and, like other model providers, may retain request logs for abuse monitoring under its own terms. We send no account identifiers, email addresses or file names with those requests.
• If you do not want your text processed this way, do not use the AI panels — the builder, templates, PDF export and the entire ATS heuristic work without them, and the app tells you when AI is switched off rather than inventing output.
• The ATS score itself is computed locally by our own rules engine. No AI is involved in producing the number, and the AI explanation can never change it.

5. Where data is stored

With Supabase configured, account and document data live in a Postgres database whose region is chosen by the deployment operator, protected by row-level security policies that restrict every row to its owner. Without Supabase configured, the app uses a local demo backend that writes to a JSON file on the server it runs on. The active backend is displayed in your account settings.

6. Advertising (Google AdSense)

Public pages — the home page, blog, templates and the market landing pages — carry advertising supplied by Google AdSense (publisher ID pub-6708275279834644). This is how the free tier is funded. Our editor and account areas are deliberately ad-free: no advertisement is shown inside the resume builder, the ATS checker, the cover letter generator or your dashboard, and no ad code can read the contents of your resume.

• Google and its partners may set cookies or use device identifiers to serve and measure ads. This is separate from our own cookies, and we do not receive your resume or account data from them.
• Personalised advertising in the UK, EEA and Switzerland is consent-based. For those visitors, personalisation cookies are requested only after you accept the consent prompt; if you reject it, only non-personalised ads may be shown. The “Ad settings” link in the footer takes you straight to Google’s controls, where you can change your choice at any time.
• You can opt out of personalised advertising generally in Google Ads Settings and see how Google uses data from partner sites at policies.google.com/technologies/partner-sites. Our advertising partners are listed in /ads.txt.
• Ad blocking does not affect any feature of the product.

7. Legal bases (UK GDPR / GDPR)

• Contract — processing your account and documents is necessary to provide the service you signed up for.
• Legitimate interests — security logging, abuse prevention and aggregate usage counting.
• Consent — sending resume text to the AI provider happens only when you actively use an AI feature, and personalised advertising is served only after you consent where the law requires it.

8. Retention

Documents are kept until you delete them or delete your account. Usage counters are kept for the current month and may be aggregated afterwards. Contact messages are kept until the query is resolved. Deleting your account removes your profile, documents, usage events and contact records associated with your account immediately and permanently.

9. Your rights

• Access, correction and deletion of your data — deletion is self-service in Account settings.
• Portability — your documents are stored as JSON and can be exported on request.
• Objection and restriction — contact us and we will respond.
• UK users may complain to the Information Commissioner’s Office; EU users may complain to their local supervisory authority.

10. Security

• HTTPS everywhere, HTTP Strict Transport Security, no-sniff and frame-options headers.
• Row-level security so one account cannot read another’s documents, even with a guessed ID.
• Session cookies are HTTP-only and same-site; the local backend binds them to a server-side session record.
• Upload limits, file-signature checks and server-side input validation on every endpoint.
• Rate limiting on authentication and AI endpoints.

No system is perfectly secure. If you believe you have found a vulnerability, please contact us before disclosing it publicly.

11. Children

The service is intended for people aged 16 and over. We do not knowingly collect data from children.

12. Changes

Material changes to this policy will be announced on this page with a new “last updated” date. If a change affects how your documents are processed, we will ask for consent where the law requires it.