Privacy Policy

1. Introduction

CVPilot Inc. (“we,” “us,” or “our”) operates the CVPilot platform (the “Service”), an AI-powered career development tool that helps users translate their experiences into career-ready materials. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. Please read this policy carefully. By using the Service, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Information You Provide

• Account registration data: name, email address, and graduation year
• Resume content: work experience, skills, education history, projects, and achievements
• Cover letter content and job application preferences
• Payment information (processed by our third-party payment processor; we do not store full payment card numbers)

2.2 Information Collected Automatically

• Device and browser information (IP address, browser type, operating system) — collected from standard HTTP request headers when you load a page or call an API
• Server-side operational logs (request timestamps, error traces, AI quota usage) retained for debugging and abuse prevention. These logs are not sent to any third-party analytics provider.
• A small number of strictly-necessary cookies (see Section 7)

2.3 Information from Third Parties

• Authentication data from Clerk (our authentication provider)

3. How We Use Your Information

We use collected information for the following purposes:

• To provide and maintain the Service, including AI-powered resume generation, cover letter creation, and job matching
• To process your transactions and manage your subscription
• To communicate with you about your account, updates, and new features
• To improve and optimize the Service based on aggregate operational metrics (e.g., error rates, response times) and direct user feedback
• To comply with applicable legal obligations
• To detect and prevent fraud, abuse, or unauthorized access

4. AI Processing

CVPilot uses artificial intelligence (provided by Anthropic’s Claude API) to generate resume content, cover letters, and career recommendations. You should know:

• Your personal data and content are sent to Anthropic’s API solely to generate responses for you. Anthropic does not use API inputs or outputs to train their AI models.
• AI-generated content is provided as suggestions and should be reviewed by you before use.
• We do not use your personal data to train any proprietary AI models.
• AI outputs may not be perfectly accurate and should not be relied upon as the sole basis for career decisions.

5. Data Sharing and Disclosure

We do not sell your personal data. We may share your information with:

• Service providers: Supabase (database hosting), Clerk (authentication), Vercel (application hosting), Anthropic (AI processing), and Stripe (payment processing) — each bound by data processing agreements
• Legal requirements: we may disclose information if required by law, subpoena, court order, or government request
• Business transfers: in connection with a merger, acquisition, or sale of assets, your data may be transferred to the successor entity

6. Data Security

We implement industry-standard security measures including:

• AES-256-GCM encryption at rest for sensitive data
• TLS 1.2+ encryption for all data in transit
• Role-based access controls (RBAC)
• Comprehensive audit logging of all data access events
• Regular security assessments and monitoring

7. Cookies and Tracking

CVPilot uses only a small number of strictly-necessary cookies to run the Service. Under the EU ePrivacy Directive, the UK PECR, and similar laws, strictly-necessary cookies do not require prior consent.

7.1 Cookies we set today

• Authentication and session cookies from Clerk, our identity provider. These keep you signed in and protect your session against hijacking. They cannot be disabled without breaking the sign-in flow.
• Payment session cookies from Stripe, set only when you visit the checkout page to purchase or manage a subscription. These are required to complete the transaction and are governed by Stripe’s privacy policy.

7.2 What we do NOT do

• We do not run any third-party advertising or marketing pixels.
• We do not use Google Analytics, Meta Pixel, LinkedIn Insight, or any cross-site tracking tools.
• We do not set any cookies for behavioral advertising.
• We do not record or replay your browser sessions.

7.3 Product analytics

We use PostHog for product analytics in a privacy-preserving, cookieless mode. No cookies or localStorage entries are written to your browser for analytics purposes. We do not create persistent cross-visit identifiers for anonymous visitors. Once you sign in, events from your session are associated with your opaque Clerk user ID so we can understand usage by account — we never pass your email address, name, resume text, or job listing text into the analytics event stream.

We capture only explicit events (for example, when a resume analysis completes or a cover letter is generated) — we do not record sessions, capture keystrokes, or auto-capture clicks. If you send Do Not Track, we drop your events. If we ever change this approach and introduce any non-essential cookies, we will update this Policy and, where legally required, obtain your consent through a clear in-app notice before any such cookie is set on your device.

7.4 Your controls

You can clear or block cookies through your browser settings at any time. Note that blocking Clerk’s authentication cookies will prevent you from signing in, and blocking Stripe’s checkout cookies will prevent you from completing a purchase. We also honor the Do Not Track signal: if your browser sends DNT, our analytics silently drops any events from your session.

8. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Upon account deletion:

• Personal profile data is deleted within 30 days
• Resume and cover letter content is deleted within 30 days
• Audit logs are retained for 180 days for compliance purposes, then purged
• Aggregated, anonymized data that cannot identify you may be retained indefinitely for analytics purposes

9. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: request a copy of the personal data we hold about you
• Correction: request that we correct inaccurate data
• Deletion: request that we delete your personal data
• Portability: request your data in a machine-readable format
• Opt-out: opt out of non-essential data processing

To exercise any of these rights, contact us at privacy@cvpilot.co. We will respond within 30 days.

10. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and California Privacy Rights Act, including the right to know what personal information is collected, the right to delete, the right to opt-out of sale (we do not sell personal data), and the right to non-discrimination for exercising your rights.

11. Children’s Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected data from a child under 13, we will delete that information promptly.

12. International Data Transfers

Your information may be transferred to and processed in the United States. By using the Service, you consent to this transfer. Our service providers (Supabase, Anthropic, Vercel, Stripe) process data in the United States.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on the Service and updating the effective date.

14. Contact Us

CVPilot Inc.
Email: privacy@cvpilot.co
Website: www.cvpilot.co

CVPilot Inc. © 2026. All rights reserved.