Your application data should stay yours.

1. Scope and controller information

CareerPilot AI acts as the data controller for personal data processed through the website, onboarding form, checkout flow, and related document-delivery service. This policy applies to visitors and users who submit CVs, job descriptions, or related application materials through the service.

If you have any question about this policy, or if you want to exercise your privacy rights, contact privacy@careerpilot.ai.

2. What data we collect

We only collect data needed to operate CareerPilot AI and improve the product responsibly.

3. Why we process your data and the legal bases

Our main legal bases under GDPR are contract and consent.

• Contract: we process your email, submitted CVs, job descriptions, language choices, and service history to deliver your month of access, fulfill rewrite requests, and maintain the service you actively use.
• Consent: we rely on consent for optional analytics cookies and for any optional communications or preferences that are not strictly required to provide the service.
• Compliance and security: in limited cases we may retain records required by law, prevent abuse, detect fraud, or protect the security and integrity of the platform.

4. How we use and share data

We use personal data to operate CareerPilot AI, personalize outputs, deliver documents by email, and support billing, analytics, and security operations.

• Provide CV rewriting, personalized cover letters, onboarding, and account functionality.
• Authenticate users, prevent abuse, monitor reliability, and investigate incidents.
• Measure product usage with privacy-first analytics and improve UX, onboarding, and feature quality.
• Work with processors such as hosting, storage, analytics, and payment providers under contractual data protection obligations.
• We do not sell or rent personal data to third parties.

5. Retention periods

We keep data only for as long as needed for the purposes above or to comply with legal obligations.

• Account records: stored while your paid or free access remains active and for up to 24 months after closure unless a longer period is legally required.
• Submitted CVs, job descriptions, and generated materials: retained until you delete them, or for up to 12 months after your last account activity.
• Request history and notes: retained while your account is active and up to 24 months after closure to support service continuity and compliance needs.
• Billing and transaction records: retained for the period required by tax, accounting, and anti-fraud rules.
• Analytics and cookie preferences: retained according to the purpose of the cookie and your consent settings.

6. Security measures

CareerPilot AI uses reasonable technical and organizational safeguards to protect personal data, including encryption in transit, encryption at rest, access controls, and monitoring designed to reduce unauthorized access, disclosure, or loss.

No internet service can guarantee absolute security, but we design the platform to minimize exposure and limit access to the systems needed to operate the service.

7. Your GDPR rights

Subject to applicable law, you may request:

• Access to the personal data we hold about you.
• Correction of inaccurate or incomplete data.
• Deletion of your account or stored materials.
• Portability of the data you provided to us.
• Restriction or objection to certain processing activities.
• Withdrawal of consent for analytics or other optional processing at any time.

To exercise these rights, email privacy@careerpilot.ai. You also have the right to lodge a complaint with a competent EU data protection authority.

8. Cookies and analytics

We use a limited set of cookies and similar technologies:

• Strictly necessary cookies: required for session continuity, authentication, security, and core product functionality.
• Functional cookies: used for settings such as language or interface preferences.
• Analytics cookies: used only to understand product usage and improve the service, with privacy-first configuration and consent where required.

We do not use third-party advertising cookies. For more detail, see the Cookie Policy.

9. International transfers and policy updates

Where processors handle data outside your country, we rely on appropriate safeguards such as contractual commitments and standard transfer mechanisms when required by law.

We may update this policy when the product, law, or processing activities change. Material updates will be posted on this page and, where appropriate, communicated by email.