Privacy Policy

Career Assistant (careerassistant.tech) is run by Francesco Palandra, a private individual based in Italy, who is the data controller for the personal data described here. For any question or request, write to frklintech@gmail.com.

• Account. Your email address and, if you sign in with Google, the name and profile picture Google shares. Sign-in is handled by Clerk, which also keeps the session and security data it needs, such as IP address and browser.
• Onboarding answers. Where and how you want to work, the role, level and salary you aim for, and the other answers you give.
• Your CV and archive. The text of the CV you upload or paste (the PDF file itself is not kept), the records drawn from it, and every version you confirm, edit or add.
• Contact details for your CVs. The name, email, phone and links you enter for the CV header. They are printed on your CVs and never sent to the AI provider.
• Jobs. The links and job text you add, and the jobs you save or hide.
• Applications. Their statuses, tailored CVs and their PDF files, interview dossiers, checklists, notes, calendar entries and reminders.
• AI usage. For each AI run: its kind, the model, the tokens used and the cost, so the daily limit can be kept.
• Technical data. Your time zone, in a cookie, and the request logs our hosting providers keep (IP address, time, page requested).
• Analytics. Pages viewed, referring site, country, browser, operating system and device type, collected without cookies (section 8).

We do not ask for sensitive data such as health, religion or political opinions. If your CV contains any, it is processed only as part of the text you asked us to handle, and you can remove it from your records at any time.

• To run the service you signed up for: your archive, job matching, tailored CVs, interview prep and reminders. Basis: contract (GDPR Art. 6(1)(b)).
• To keep the service secure, prevent abuse and keep AI costs within the daily limit. Basis: legitimate interest (Art. 6(1)(f)).
• To see, in aggregate, which pages are used so we can improve them. Basis: legitimate interest (Art. 6(1)(f)). No cookies, and no profile of you is built.
• To meet legal obligations, such as answering lawful requests from authorities. Basis: Art. 6(1)(c).

• When you import a CV, add a job, check your fit, draft a CV or prepare for an interview, the text needed for that run (your CV, your records, the job post) is sent to OpenAI, which also turns it into search vectors (embeddings).
• Interview prep looks up the company: the company name and the job's context go to OpenAI's web search, and our servers fetch the public pages it cites.
• OpenAI processes this data on our behalf. Under its API data terms it does not use it to train its models, and keeps it only for a limited time, for abuse monitoring.
• What the AI writes stays a draft until you confirm it. Fit results are guidance for you: no decision about you is made automatically, and nothing is sent to employers.

These providers process data on our behalf, only to run the service:

If you choose Sign in with Google, Google learns that you signed in to Career Assistant, under its own privacy policy.

We never sell your data, share it with employers or recruiters, or use it for advertising. We disclose it to authorities only when the law requires it.

Some providers are based in the United States. Where data leaves the European Union, the transfer relies on the EU-US Data Privacy Framework for providers certified under it, or on the European Commission's Standard Contractual Clauses.

• Your account and everything in it: as long as the account exists.
• A record, application, CV, dossier or calendar entry you delete: removed straight away.
• When your account is deleted, we delete your profile and all data linked to it, including job text you pasted, within 30 days. Job posts added by link are public listings and may stay in the shared job list, with no link to you. Our database provider's backups expire on their own shortly after.
• AI usage records are kept for cost accounting, with no link to you once your account is gone.
• Analytics: the daily visitor identifier is discarded after 24 hours; only aggregate counts remain.
• Hosting request logs: as long as each provider keeps them, usually days to a few weeks.

We use only the cookies the site needs to work:

• Clerk's session cookies (such as __session and __client_uat), which keep you signed in.
• tz, your time zone, so dates and reminders show in your local time. It lasts one year.

There are no advertising or tracking cookies. Vercel Web Analytics counts page views without cookies: it stores nothing on your device and tells visits apart only by a hash of the request, discarded after 24 hours. As these cookies are strictly necessary and the analytics are cookieless, there is no cookie banner.

Under the GDPR you can:

• access your data and get a copy of it;
• correct it;
• have it deleted;
• restrict or object to how it is used;
• receive it in a portable format.

You can view, edit and delete most of your records yourself in the app. For anything else, deleting your account included, write to frklintech@gmail.com. We reply within one month.

You can also complain to the Italian data protection authority, the Garante per la protezione dei dati personali, or to the authority where you live or work.

Connections are encrypted (HTTPS). Your data sits in a database in Frankfurt that only our API can reach, and each account sees only its own data. No system is perfectly secure: if a breach puts your data at risk, we will tell you and the authority as the law requires.

Career Assistant is not meant for anyone under 16, and we do not knowingly collect their data.

When the way we handle data changes, we update this page and the date at the top. For significant changes we tell you by email or in the app before they apply. The Terms of Service cover the rest of how the service works.