Privacy Policy

CareerWell is operated by Parisa Gifani, trading as CareerWell, based in the United Kingdom. For data-protection matters, contact us at support@careerwell.app or write to 28 Hunt Close, London W11 4JU, United Kingdom. We act as the data controller for the personal data described below.

We collect only what we need to provide CareerWell:

• Account data — name, email, hashed password (managed by Supabase Auth)
• Profile data — your master CV in markdown, target role keywords, plan tier
• Application data — companies, roles, statuses, scores, notes you add to your tracker
• Job-description text — JDs you paste for evaluation or tailoring
• Generated content — AI-tailored CVs, cover letters, outreach drafts
• Scanner results — public job postings from career pages, scoped to your account
• Billing data — Stripe customer ID + subscription state. We never see your card number; Stripe handles that.
• Technical data — IP address, browser type, request logs (kept for security/debugging)

To:

• Provide the Service (evaluate jobs, generate documents, track applications)
• Authenticate you and protect your account
• Process payments via Stripe
• Send transactional emails (signup confirmation, billing receipts)
• Detect abuse and enforce rate limits
• Improve the Service (aggregated, non-personal analytics)

We do NOT sell your data, ever. We do NOT use your data to train AI models. We do NOT share your CV or job-search activity with employers, recruiters, or third parties beyond the processors listed below.

We rely on:

• Contract performance — most data processing is necessary to deliver the Service you signed up for
• Consent — for optional things like email marketing (you can withdraw anytime)
• Legitimate interests — for security, fraud prevention, and aggregated analytics
• Legal obligations — for accounting / tax records required by law

When you ask CareerWell to evaluate a job or generate a tailored document, we send your master CV and the job description to Anthropic's Claude API for processing. We send only what's required for that specific request.

Anthropic does NOT train its models on data submitted via its API (per Anthropic's commercial terms as of writing). Data sent through the API is used only to generate the response and is then deleted from Anthropic's systems per their retention policy.

Anthropic's privacy policy: anthropic.com/legal/privacy.

We share data only with the following processors, each contractually bound by data-protection terms:

• Supabase — database + auth hosting (data hosted in our chosen region; see Section 9)
• Vercel — application hosting (request routing, log storage)
• Stripe — payment processing (card data, billing history)
• Anthropic — AI inference (CV + JD text only, per Section 5)
• Cloudflare — DNS + email forwarding

• Active account data — retained while your account is active
• Account deletion — your personal data is permanently removed within 30 days of account closure
• Backup retention — encrypted backups may persist up to 90 days for disaster recovery
• Billing records — kept for 7 years (legal requirement)
• AI request logs — kept 90 days for debugging, then deleted

You can:

• Access — request a copy of the personal data we hold about you
• Rectify — correct inaccurate data (most things you can edit yourself in-app)
• Erase — request account deletion at any time
• Restrict / object — limit how we process your data
• Portability — export your data in a machine-readable format
• Withdraw consent — for any processing based on consent
• Complain — to your local data-protection authority (UK: ICO at ico.org.uk; EU: your member-state regulator)

To exercise any of these rights, email support@careerwell.app. We'll respond within 30 days.

Your data is primarily stored in the London (EU) region. Some processors (Stripe, Anthropic, Cloudflare) operate globally and may process data in the United States. Where data leaves the UK/EEA, we rely on Standard Contractual Clauses or equivalent legal mechanisms to ensure protection equivalent to UK/EU GDPR.

CareerWell uses essential cookies only — to keep you logged in, remember your filter preferences (e.g., scanner search), and prevent fraud. We don't use third-party advertising or tracking cookies.

We protect your data through:

• HTTPS everywhere (TLS 1.2+)
• Encrypted-at-rest database (Supabase Postgres + AWS)
• Row-Level Security so users can only access their own rows
• Hashed passwords (bcrypt via Supabase Auth)
• Limited employee access on a need-to-know basis

No system is 100% secure. If we ever experience a breach affecting your data, we'll notify you and the relevant authorities within 72 hours, as required by GDPR.

CareerWell is for users aged 16 and older. We don't knowingly collect data from children under 16. If you believe a child has signed up, email us and we'll delete the account.

We may update this Privacy Policy as the Service evolves. Material changes will be announced via the website and by email. The “Last updated” date at the top of this page indicates the latest revision.

Questions about this policy or your data? Email support@careerwell.app. For data-protection requests specifically, include “GDPR” in the subject line so we route it promptly.