Privacy Policy

Who we are

Career Agent is operated by RND HORIZON LLC, a company registered in the United States (“we”, “us”). We act as the controller of the personal data described in this policy. Contact: [privacy contact address] · [registered address].

If you live in Türkiye, our notice under the Personal Data Protection Law No. 6698 (KVKK) is published in Turkish as the “KVKK Aydınlatma Metni”.

What we collect

We collect only what is needed to provide the service you use:

• Account data: name, email address, password hash (never the password itself), interface language and email notification choice.
• Profile data you provide or confirm: contact details you add (phone, city, links), work history, education, skills, languages, certifications, projects, achievements and career goals.
• Job-search preferences: target roles, seniority, work arrangements, locations, willingness to relocate, work authorization by country, salary expectation, industries and companies to exclude.
• Documents you upload (résumés) and the text extracted from them, text you paste, and your conversations with the profile interviewer and the career coach.
• Job and application data: postings you save or add, fit analyses, drafts, approved versions, exports, status history and notes.
• Usage and security data: sessions with browser and system name, keyed hashes of IP addresses, sign-in and security events, and monthly usage counts for plan limits.
• Billing data: handled by Stripe. We store your Stripe customer and subscription identifiers and plan status, never card details.
• Records of what you were shown and agreed to: which version of these terms and notices, and when.

Sensitive information

We do not ask for special categories of data such as health or disability, memberships of associations or trade unions, religious or philosophical beliefs, or criminal records. If you choose to include such information in your résumé, profile or conversations, we process it only on the basis of your separate, optional explicit consent, which you can give or withdraw at any time in Settings → Privacy & data. Without that consent, please remove such information before you upload a document.

How we use it

To provide the service: building your profile, finding and analyzing jobs, drafting, checking and exporting documents, tracking applications, coaching, and account management (contract performance).

To keep the service and your account secure and prevent abuse (legal obligation to secure data, and legitimate interests).

To send transactional emails such as email confirmation, password resets and password-change notices, and the new-match emails you choose in settings (contract performance). We do not send marketing email.

We do not sell personal data, and we do not use your data for advertising.

AI processing

When you use AI features, the relevant parts of your profile, documents, conversations and job postings are sent to our AI provider (currently Anthropic, United States; when Anthropic cannot be reached, OpenAI, United States, answers instead) to perform the task you requested, under commercial terms that do not allow your data to be used to train models. AI output is checked against your confirmed evidence before you see it, and nothing is used in an application until you approve it.

Fit analyses describe how your documented experience covers a posting's stated requirements. They are not automated decisions about you, they do not predict hiring, and they are not shared with employers. You can contest any result by contacting us.

Sharing

We share data only with processors that help us run the service, under data-processing agreements:

• Hosting, database and file storage: [Google Cloud, European Union region, to be confirmed at launch].
• Anthropic (AI processing), United States, and OpenAI (AI processing when Anthropic cannot be reached), United States. We may change these providers and will update this page when we do.
• Stripe (payments) and Resend (transactional email).

Employers

We never send your data to employers. You submit applications yourself on the employer's site. Job postings are read from employers' public career-site APIs.

Retention

We keep account data while your account is active and delete it on the schedule below:

• When you delete your account, your profile, uploaded files, documents, approved versions, applications, conversations, usage counts and consent records are permanently erased.
• Sessions end after 30 days without use and are then deleted.
• The security log is deleted after 12 months; when you delete your account, its link to you is removed at once.
• Copies of the emails we sent are deleted after 30 days. Confirmation links work for 24 hours and password-reset links for 60 minutes; their records are deleted 7 days after they stop working.
• Copies in backups are deleted within 8 days.
• You can delete each uploaded résumé or pasted text yourself in Settings → Privacy & data. Information already added to your profile stays there until you edit it.
• Stripe retains billing records as required by the law that applies to it.

Your rights

You can access, correct and export your data at any time (Settings → Privacy & data provides a complete JSON export), delete uploaded files, withdraw a consent, and delete your account permanently. Depending on where you live, you may also object to or restrict processing and complain to a supervisory authority. Contact us at the address above to exercise any right.

International transfers

We are based in the United States, and our processors may process data outside your country. Where required, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses or the standard contracts published by Türkiye's Personal Data Protection Board.

Security

Data is encrypted in transit, passwords are hashed with scrypt, sessions use random tokens stored only as hashes, approved documents and consent records are protected against modification at the database level, and access to each record is restricted to its owner.

Cookies

We use only strictly necessary cookies: a session cookie that keeps you signed in (up to 30 days) and a cookie that remembers the language you chose (365 days). We do not use analytics or advertising cookies. Checkout opens on Stripe's own site, under Stripe's cookie rules.

Children

The service is intended for people aged 16 and over.

Changes

We will notify you by email of material changes to this policy before they take effect.