Privacy Policy

This policy explains how personal information is handled when you visit Careers.ai, upload a CV, create an account, use AI features, publish a profile or contact us. It covers the actual service, including its support widget, and explains the planned payment arrangement separately.

1. Controller and contact

Nicola Ballotta, trading as Careers.ai, is the controller responsible for the personal data used to operate this service. For privacy requests or questions, contact:

2. Information we process and where it comes from

• Account information: email, name, authentication identifiers, access status and account settings. You provide this directly or, when using Google sign-in, Google supplies the authorised sign-in details.
• Career and application content: uploaded files, work history, education, skills, contact details and other information you include; job descriptions, prompts, edits and generated analyses or drafts. These may contain personal information about third parties if you include it.
• Usage and security information: feature requests, credit movements, job status, technical errors, IP address, browser information and request timestamps used to operate and protect the service.
• Support and feedback: messages, attachments and information you send through email or Featurebase, plus identifiers and technical context used by the support widget.
• Transaction information: test billing can create customer and subscription records with our payment-testing provider, without charging you. If you make a purchase once payments are enabled, the billing contact information, transaction and subscription identifiers, status and credit allowance needed to fulfil it. Hosted checkout handles payment credentials; our application does not store full payment-card numbers.

Provide only information needed for the feature. Do not include identity documents, payment-card details, health information or other special-category information in CVs or support messages unless specifically necessary and lawfully authorised. You can redact unnecessary details before uploading. Providing account and relevant career information is necessary to use the corresponding features; publication and support-message content are your choice.

Importing public job listings

When you import a job link, its URL and public page content may be processed by Jina AI to retrieve the page and by Anthropic to extract job details. We may also read an employer’s public recruiting feed. We do not send your account details, CV, session cookies or login credentials with these retrieval requests. Only submit public job links, not private, signed or authenticated URLs.

Public-profile statistics

When enabled, we measure visits to published profiles so their owners can understand their reach. We process the network address briefly to derive a profile-specific identifier that changes every UTC day, alongside the approximate country and a broad referral category (direct, LinkedIn, search or other). We do not retain raw network addresses, full referring URLs or user-agent strings in analytics tables, and we do not set analytics cookies or browser identifiers.

Profile owners see aggregate counts, not visitor identities. Shared networks and privacy tools can affect estimates. We respect browser Do Not Track and Global Privacy Control signals. Daily identifiers are retained for the current and preceding UTC day; aggregates cover 90 calendar days. Scheduled daily cleanup removes older records. Backup retention is separate, as described below. Deleting a CV or account removes its associated statistics from the live database.

3. Purposes and legal bases

• Providing the service — contract: account access, requested CV processing, AI outputs, editing, profile publication, credit accounting and service messages are processed to perform our agreement with you or take steps you request before entering it.
• Operating and protecting the service — legitimate interests: troubleshooting, abuse prevention, security monitoring and handling support requests. Our interests are maintaining a reliable service and protecting users; you may object to processing based on legitimate interests.
• Legal obligations: information needed to meet applicable accounting, tax, regulatory and lawful disclosure requirements.
• Consent, where required: optional activities requiring consent must rely on that consent, which you may withdraw without affecting earlier lawful processing. Accepting our terms is not blanket consent to unrelated marketing or tracking.

4. AI processing and your choices

When you request an AI feature, relevant CV text, profile information, job descriptions and instructions are sent to Anthropic’s API to produce the requested result. This may include personal information contained in that material. Remove details you do not want processed before submitting. Outputs and scores are stored in your account to provide the feature and its history.

We do not use your CVs to train our own general-purpose AI models. Anthropic’s commercial API terms govern its processing and retention; we do not promise zero provider retention. See Anthropic’s Privacy Center for its current policies.

The service generates CV scores, job-fit suggestions and salary estimates for you to assess. These inferences can be wrong. We do not use them to make hiring or other decisions with legal or similarly significant effects on you. You choose whether to edit, use, share or discard the output.

5. Service providers and other recipients

• Hetzner: infrastructure hosting, our self-hosted database and authentication services, object storage and backups.
• Anthropic: processing the content submitted for AI features.
• Google: optional Google authentication. Google also handles information under its own privacy terms when you use its sign-in service.
• Resend: sending account and transactional emails, including recipient information, delivery events and message content.
• Featurebase: support chat, feedback and in-app communications. The widget loads on the website and can receive IP/device information and session identifiers before you send a message. For signed-in users we may supply account ID, name and verified email to associate support with the right account. CV contents are not automatically included in this identity information; information you paste or attach to a message is shared. See Featurebase’s privacy information.
• Paddle — planned payments: Paddle is the intended reseller and Merchant of Record, subject to approval and activation. If you later complete a Paddle purchase, it will process billing, payment, tax and fraud-prevention information under its Privacy Notice, including processing for which it acts as an independent controller. We will receive information needed to provide the purchased service. This statement does not indicate that live Paddle payments are active.

Providers receive information relevant to their service; their contractual role depends on the activity. We may also disclose information when legally required, to protect legal rights or to professional advisers under appropriate confidentiality obligations. We do not sell personal data or use CV content for third-party advertising.

6. Cookies, local storage and support sessions

We use browser cookies or storage for authentication, anonymous-session continuity, security and preferences such as your theme. Featurebase uses its own session technologies for the embedded support experience and can associate visits with a support identity. See its Cookie Policy. Blocking browser storage or third-party scripts may prevent sign-in or support features from working. You can contact us by email instead of using chat.

This notice describes storage use; it is not itself permission to place non-essential cookies. You can use your browser’s controls to inspect or remove stored data. Removing it does not automatically delete information already stored in your account or support conversations.

7. Public profiles

Publication is optional. When you publish, the selected profile information becomes accessible to anyone with the URL and may be copied or indexed by search engines. Unpublishing removes our public presentation, but third-party caches and copies may persist. A noindex preference asks search engines not to index; it does not make a published profile private.

8. Retention and deletion

• Account content: retained to provide your account and saved history while the account exists. Account deletion removes profile data, registered uploads and AI history from the active service when deletion completes, subject to records retained for legal obligations or claims.
• Anonymous uploads: anonymous-session data expires after seven days and is removed by scheduled cleanup. Data imported into an account follows that account’s retention instead.
• Older object versions: deleted or overwritten versions become eligible for permanent cleanup after seven days. Cleanup is asynchronous, so this is not a guarantee of removal at an exact hour.
• Recovery backups: isolated recovery copies may retain earlier data after active deletion. They rotate under separate backup and object-storage lifecycle schedules; a recovery window does not mean every backup copy is erased on that date. They are not publicly accessible or used as active profiles.
• Security, support and transaction records: retained for the purpose they serve, such as resolving a request, investigating abuse, meeting applicable recordkeeping requirements or defending a legal claim. Relevant criteria include the age and status of the issue, legal retention duties and whether identifiable details remain necessary. Provider retention may differ from account retention.

Deleting your Careers.ai account does not automatically erase independent provider records or every support conversation. Contact us for requests concerning those records or for more detail on retention affecting your data.

9. International processing

Our infrastructure and providers may process information in the EEA and other countries, including the United States. The location depends on the service and its subprocessors. For transfers requiring safeguards under data-protection law, the applicable mechanism may be an adequacy decision or contractual safeguards such as the European Commission’s Standard Contractual Clauses. Contact us for information about the mechanism and safeguards applicable to your data. We do not promise that all processing takes place in the EU.

10. Your rights and complaints

Depending on applicable law, you may request access, correction, erasure, restriction, a portable copy of information you provided, or object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it. These rights have legal conditions and exceptions; we will explain any refusal. You do not need to pay to make an ordinary request.

Email [email protected] from your account email where possible. We may request proportionate information to verify your identity. We normally respond within one month; if a lawful extension is needed, we will tell you within that month and explain why.

You may complain to Italy’s Garante per la protezione dei dati personali, or the competent supervisory authority where you live, work or believe a violation occurred. You do not have to contact us before exercising that right.

11. Security, children and updates

We use access controls, encrypted transport and measures to separate users’ private records. No service can guarantee absolute security. Where a personal-data breach requires notification, we will notify the relevant authority and affected people as required by law.

The service is not intended for children under 16. If you believe a child has provided information contrary to this rule, contact us so we can investigate and take appropriate action.

We update the date on this page when it changes. Material changes will be communicated by email or in-app notice at least 14 days before they take effect, except where legal or urgent security requirements require earlier action. We will seek consent when a new processing activity legally requires it.