Privacy Policy

CareerForge AI (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, including our website, resume builder, interview coach, job application tracker, and all related services (collectively, the “Service”).

By accessing or using the Service, you agree to the terms outlined in this Privacy Policy. If you do not agree, please discontinue use of the Service immediately.

1. Information We Collect

1.1 Information You Provide Directly

• Account Data: When you register, we collect your name, email address, and authentication credentials via Clerk. We never store raw passwords; authentication is fully delegated to Clerk’s secure identity platform.
• Resume Content: All information you input into the resume builder — including work history, education, skills, contact details, and any uploaded documents — is stored securely and encrypted at rest.
• Job Application Data: When you use our job tracking features, we store job URLs, application statuses, notes, and related metadata.
• Communication Data: If you contact our support team, we retain email correspondence, chat logs, and any attachments you share.

1.2 Information Collected Automatically

• Usage Analytics: We use PostHog for anonymous product analytics including page views, feature usage, session duration, and interaction events. This data is pseudonymized and never linked to identifiable resume content.
• Device & Browser Data: We collect browser type, operating system, device type, IP address (anonymized), and referring URLs for security and analytics purposes.
• Performance Metrics: We monitor application performance including page load times, API latency, and error rates using Vercel Analytics to ensure service reliability.
• Cookies & Similar Technologies: We use essential cookies for authentication (via Clerk), and optional analytics cookies. See our Cookie Policy for details.

2. How We Use Your Information

• Service Delivery: To generate AI-optimized resumes, provide ATS score analysis, generate podcast audio summaries, and facilitate mock interview sessions via our LangChain and ElevenLabs integrations.
• AI Processing: Your resume content is processed through Groq’s LLM inference API to generate tailored bullet points, keyword suggestions, and career insights. Data is transmitted over encrypted channels and is not used to train third-party models per Groq’s data usage policies.
• Personalization: To tailor your experience including recommended templates, relevant job matches, and personalized feedback.
• Communication: To send transactional emails (account notifications, billing receipts) and, with your consent, product updates and tips.
• Security & Compliance: To detect and prevent fraudulent activity, enforce our Terms of Service, and comply with legal obligations.
• Product Improvement: Aggregated, anonymized data helps us understand feature adoption, identify usability issues, and prioritize roadmap items.

3. How We Share Your Data

We do not sell, rent, or trade your personal information. We share data only in the following limited circumstances:

• Service Providers: We engage trusted third-party processors bound by data processing agreements (DPAs) — including Clerk (authentication), Vercel (hosting), Neon (database), Groq (AI inference), ElevenLabs (voice synthesis), PostHog (analytics), and Liveblocks (collaboration).
• Legal Compliance: We may disclose information if required by law, subpoena, court order, or governmental regulation.
• Business Transfers: In the event of a merger, acquisition, or asset sale, your data may be transferred as part of the transaction with appropriate safeguards.
• With Your Consent: We may share data for any other purpose with your explicit consent.

4. Data Retention & Deletion

• Account Data: Retained for the duration of your account. You may request deletion at any time through your account settings or by contacting our support team.
• Resume Content: Your resumes remain private and are only accessible via a cryptographically hashed pdfSecret token during PDF generation through our Puppeteer print engine. Content is permanently deleted upon account termination.
• Analytics Data: Pseudonymized analytics data is retained for up to 24 months for trend analysis.
• Backup Archives: Encrypted database backups are retained for 30 days per our disaster recovery protocol.

5. Data Security

We implement industry-standard security measures to protect your data:

• Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256).
• Authentication: We use Clerk’s enterprise-grade authentication with multi-factor authentication (MFA) support.
• Infrastructure Security: Our application is hosted on Vercel’s secure edge network with DDoS protection, WAF rules, and automatic security patches.
• Database Security: Neon provides isolated compute environments with IP allowlisting, connection pooling, and automated backups.
• Access Controls: Internal access to production data is strictly limited, logged, and requires multi-factor authentication.
• Penetration Testing: We conduct regular security assessments and vulnerability scans.

6. Your Rights & Choices

Depending on your jurisdiction (including GDPR for EU/EEA residents and CCPA for California residents), you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Correct any inaccurate or incomplete data.
• Erasure: Request deletion of your account and associated data (“right to be forgotten”).
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to certain processing activities, including direct marketing.
• Withdraw Consent: Withdraw previously given consent at any time.

To exercise any of these rights, contact us at privacy@careerforge.ai. We will respond within 30 days as required by applicable law.

7. Children’s Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that a child under 16 has provided us with personal data, we will take steps to delete such information immediately.

8. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including the United States where our primary infrastructure (Vercel, Neon) is hosted. We ensure adequate safeguards through Standard Contractual Clauses (SCCs) and Data Processing Agreements with all subprocessors.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email and/or an in-app notification at least 14 days before taking effect. Continued use of the Service after changes become effective constitutes acceptance of the revised policy.

10. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: