Privacy Policy | Career Compile

1. Data Controller

The data controller responsible for your personal data is:

Career Compile

2. What Data We Collect

We collect only the data that is necessary to provide the service.

Account information

When you register, we collect your full name, email address, and username. Your password is handled by Amazon Cognito and stored only in hashed form; we never see it. If you sign up with Google, we receive your name, email address, and a Google account identifier instead of a password.

Photos

You can upload a profile photo and a photo for your resumes (JPEG, PNG, or WebP). They are stored in our file storage and shown only where you use them. You can remove them at any time.

Resume and career data

You may upload resume files (PDF, DOCX, images) and enter career information such as work experience, education, skills, projects, and contact details. You may also add job applications, job descriptions, cover letters, application timelines (including emails and interview notes you paste or import), scheduled meetings, learning plans, interview preparation content, and company watchlists. All this content is yours and is stored only to provide the service to you.

Information about other people

Your content may include details about other people, for example recruiters or interviewers you add as contacts (name, email, LinkedIn profile) or that come from a calendar invitation you import, or references on your resume. We store this only on your behalf and use it only to show it back to you.

Resume history

When you edit a resume, we keep earlier versions so you can look at them and restore one. Each version is deleted automatically after 90 days.

Preferences

We store your settings, such as default resume layout, date and time format, time zone (first taken from your browser), calendar options, and your default AI rewrite level.

Support requests

When you contact support from the app, we store your email address, the category, subject, and message you write, the page you sent it from, and basic technical details about your browser (browser and operating system, language, time zone, and screen and window size) to help us solve the problem.

AI usage log

We log each AI action run for you (for example resume parsing or cover letter generation) with token counts, estimated cost, and time. We use it to show your usage on the Plans page and to apply the daily AI limit of your plan. It is not shared or sold.

Public resume link views

If you share a resume on a public link, we count how many times it is viewed. We count at most one view per visitor's browser session and skip your own views and known bots. We do not store who viewed it, their IP address, or any identifier.

Analytics data

Only with your consent, we use Google Analytics 4 with Consent Mode v2 to understand how the platform is used. We send the pages you visit (with ids, usernames, and email addresses removed from the address), which features you use (for example "resume created" or "application status changed"), and the technical details Google Analytics collects about your device and browser. When you are signed in, we also send your random account ID (not your name, email, or username) so visits from your different devices count as one user. We never send the content of your resumes, applications, or other data.

3. Legal Basis for Processing

Contract (Art. 6(1)(b)):Processing your account data, photos, resume and career content, preferences, and public links is necessary to provide the service you signed up for.

Consent (Art. 6(1)(a)):Google Analytics, including the account ID sent for signed-in users, runs only after you accept it. You can withdraw consent at any time.

Legitimate interest (Art. 6(1)(f)):Keeping the service secure and preventing abuse (plan limits, the AI usage log, server logs), answering support requests, and counting public resume views.

4. How We Use Your Data

To create, authenticate, and manage your account.
To store and display your resumes, applications, and career data.
To run the AI features you start, such as parsing, tailoring, scoring, translating, and generating content (see section 5).
To show resumes you choose to share on a public link (see section 6).
To fetch job postings and company career pages for you (see section 7).
To send in-app notifications when background work finishes.
To provide your calendar subscription link (see section 7).
To answer your support requests.
To show your AI usage and apply your plan's limits.
To improve the platform with analytics, only with your consent.

We do not sell your data. We do not use your data for advertising. We do not use your data to train AI models.

5. AI Processing

Several features use AI: reading uploaded resumes and job postings, suggesting and applying resume changes, scoring a resume, a job match, or a cover letter, writing cover letters, translating resumes, building learning plans and interview preparation, and importing timeline entries. When you start one of these, the relevant part of your data (for example resume text or a job description) is sent to an AI model and the result is returned to you. Processing happens only when you start an AI action, except the automatic refresh of your watchlists, which may use AI to read a public career page.

AI processing is performed by Amazon Bedrock (Claude models via AWS). Requests start in the EU (Frankfurt, Germany) and stay within AWS regions in the EU. AWS processes this data as our processor and does not use it to train the underlying AI models.

AI-generated content is a tool to help you. Always review it before you use it. We make no guarantees about the accuracy of AI outputs.

6. Public Resume Links

You decide whether a resume gets a public link. Anyone who has the link can see that resume and download it as a PDF. The link contains your username.
Contact details you choose to hide (email, phone, location) and sections that are not on the resume are removed on our servers and never reach the visitor.
By default, public resumes ask search engines not to index them. If you allow indexing, the resume may appear in search results.
When the link is posted on a website or messaging app, that service may show a preview with your name and headline.
You can change or turn off the link at any time. Search engines and other services may keep copies for some time after that, which we cannot control. We may turn off a link that breaks our Terms of Service.

7. Calendar, Job Pages, and Imports

Calendar subscription link

If you create a calendar subscription link, your calendar app (for example Google Calendar, Apple Calendar, or Outlook) reads your meetings from it, including company, role, meeting type, time, location, and notes. Anyone who has the link can read them, so keep it private. You can revoke it at any time, which stops the old link from working.

Job postings and career pages

When you add a job by URL or follow a company on your watchlist, our servers request that page or the company's job board. The website sees a request from our servers, not from you. Watchlists are refreshed automatically twice a day.

Calendar file imports

When you import a calendar file (.ics) into a meeting, it is read in your browser and only the details you save are stored.

8. Third-Party Services

Service	Purpose	Location
Amazon Web Services (Cognito, DynamoDB, S3, Lambda, SQS, Amplify, CloudWatch)	Hosting, sign-in, account emails, data and file storage, background processing, logs	EU (Frankfurt)
Amazon Bedrock (Claude models)	AI processing	EU (AWS EU regions)
Google (Sign in with Google)	Sign-in, only if you choose it	USA (EU–US Data Privacy Framework / SCCs)
Google Analytics 4	Usage statistics, only with your consent	USA (EU–US Data Privacy Framework / SCCs)

SCCs = Standard Contractual Clauses (EU Commission approved transfer mechanism).

9. Cookies and Browser Storage

Strictly necessary cookies

We use cc_id_token, cc_access_token, and cc_refresh_token to keep you signed in. These are httpOnly, secure, SameSite cookies. The ID and access tokens inside them expire after 1 hour and are renewed automatically; the cookies themselves last up to 400 days and are extended while you stay signed in. The underlying Cognito refresh credential expires after 90 days (or sooner if you sign out). Short-lived cookies also protect the "Sign in with Google" step. These cookies are essential to the service and cannot be declined.

Browser storage

Your browser's local storage keeps your cookie choice and the list of background tasks you are waiting for (so their progress survives a page reload). The public resume page uses session storage to count a view only once per session. None of this is used to track you.

Analytics cookies (optional)

With your consent, Google Analytics 4 places cookies to measure usage. You can accept or decline them in the banner shown on your first visit, and change your choice at any time under Cookie preferences on your Account page.

10. Data Retention

Account and career data: kept for as long as your account is active. Items you delete are removed from the service right away; the original resume files you uploaded stay in storage until your account is deleted.
Resume history: each saved version is deleted after 90 days.
Notifications: deleted after 7 days.
Data exports: the ZIP file is deleted 24 hours after it is created.
Support requests: kept while your account exists, so we can follow up, and deleted with it.
After a deletion request: when you request deletion (from your Account page or by email), your account is deactivated immediately and all your personal data (account, content, photos and files, public links, support requests, and your sign-in account) is permanently deleted within 14 days.
AI usage logs: records with token counts, estimated costs, and timestamps, containing no name, email, or resume content, may be kept after deletion for accounting purposes. Once your account is deleted these records can no longer be linked back to you.
Server logs: request logs are kept for up to 30 days for security and debugging.
Analytics: Google Analytics data is kept for up to 14 months.

11. Your Rights (GDPR)

As an EU/EEA resident you have the following rights under the GDPR:

Right of access (Art. 15):Request a copy of all personal data we hold about you.

Right to rectification (Art. 16):Correct inaccurate data in the app or by emailing us.

Right to erasure (Art. 17):Delete your account and all associated data.

Right to restriction (Art. 18):Ask us to pause processing of your data in certain circumstances.

Right to data portability (Art. 20):Get your data in a structured, machine-readable format.

Right to object (Art. 21):Object to processing based on legitimate interests.

Right to withdraw consent:Turn analytics off at any time under Cookie preferences on your Account page.

To exercise any of these rights, email support@careercompile.com. We will respond within 30 days.

You can delete your account yourself on your Account page (Danger Zone → Delete Account). Your account is deactivated immediately and all your data is permanently deleted within 14 days. If you change your mind during that period, email support@careercompile.com to cancel the deletion and restore your account.

To get a copy of your personal data, use Data Export on your Account page. Your export (a ZIP with all your data in machine-readable JSON plus your uploaded files) is usually ready within minutes. You can also email support@careercompile.com with the subject "Data Export Request" and we will respond within 30 days.

You also have the right to lodge a complaint with your national data protection authority (e.g. the German BfDI or your local supervisory authority).

12. Data Security

All data is encrypted in transit (TLS 1.2+) and at rest (AES-256, managed by AWS). Authentication tokens are stored as httpOnly cookies to prevent JavaScript access. Calendar subscription links use a long random value that cannot be guessed. We apply the principle of least privilege: each component accesses only the data it needs.

13. Children

Career Compile is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top. Material changes will be communicated via a notice on the platform. Continued use of Career Compile after changes constitutes acceptance of the updated policy.

15. Contact

For any privacy-related questions or to exercise your rights, contact us at: support@careercompile.com