Privacy Policy

1. Who is responsible for your data

The data controller is Asaad Sammouh, Volksfeststraße, Linz, Austria — see our Legal Notice for full contact details. For any privacy question or request, contact caretiq@gmail.com.

2. What data we collect

Depending on how you use CaretIQ, we process:

• Account data: email address, hashed password, optional full name.
• CV content: the text extracted from CVs you upload, the job descriptions you paste, and the resulting AI analysis (scores, strengths, weaknesses, recommendations).
• Billing data: your subscription/plan status and Stripe customer/subscription identifiers. Card details are entered directly with Stripe and never touch our servers.
• Contact form data: name, email, and message if you submit the Services & Contact form.
• Technical data: IP address and request metadata, processed briefly for security, abuse prevention, and rate limiting.

3. Why we process it and our legal basis

• Providing the service (account, CV analysis, templates, subscriptions) — performance of a contract (Art. 6(1)(b) GDPR).
• Responding to contact form / service requests — performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR).
• Security, fraud prevention, and enforcing free-plan usage limits — legitimate interest (Art. 6(1)(f) GDPR).
• Legal and tax record-keeping (e.g. invoices) — legal obligation (Art. 6(1)(c) GDPR).

4. Who we share data with

We use the following processors to run CaretIQ. Each only receives the data it needs to perform its function:

• Database hosting (Supabase / PostgreSQL) — stores account, CV, and analysis data.
• AI analysis provider (an OpenAI-compatible API) — receives your CV text and job description solely to generate the match analysis. It is not used to train models on your data beyond the processor's standard API terms.
• Stripe — processes subscription payments and billing. See Stripe's Privacy Policy.

Some of these providers may process data outside the EU/EEA (e.g. the United States). Where that is the case, we rely on the provider's Standard Contractual Clauses or equivalent safeguards under Art. 46 GDPR. We do not sell your personal data to anyone.

5. How long we keep your data

We keep account and CV analysis data for as long as your account is active. If you delete your account, we delete or anonymize your personal data within a reasonable period, except where we are legally required to retain records (e.g. invoices, for tax purposes).

6. Cookies & local storage

CaretIQ uses your browser's local storage (not cookies) to keep you logged in, storing your session token and basic profile info on your device. This is strictly necessary for the service to function and is not used for tracking or advertising.

7. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you (Art. 15)
• Request correction of inaccurate data (Art. 16)
• Request deletion of your data (Art. 17)
• Request restriction of processing (Art. 18)
• Receive your data in a portable format (Art. 20)
• Object to processing based on legitimate interest (Art. 21)

To exercise any of these rights, email caretiq@gmail.com. You also have the right to lodge a complaint with the Austrian data protection authority (Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, Austria, www.dsb.gv.at).

8. Changes to this policy

We may update this policy as CaretIQ evolves. Material changes will be reflected by updating the "last updated" date above.