Privacy Policy

Last updated: [Month DD, 2026]

This Privacy Policy explains how [Legal Entity Name] ("we", "us", "our"), operating ChartedCV at https://chartedcv.com (the "Service"), collects, uses, shares, and protects personal information. Contact: support@chartedcv.com.

1. Who we are and our role

We are the controller of personal data processed through the Service, and we are the seller of the products you buy from us. Payments are processed by Stripe (Stripe, Inc. and its affiliates). Stripe processes your payment card and billing details to complete the transaction and prevent fraud, as described in the Stripe Privacy Policy.

2. Information we collect

• Account information: name, email address, login credentials (or sign-in via [Google]), and account preferences.
• Resume and career content you provide: resumes and cover letters you upload or write, job postings you paste, work history, education, licenses (type, state, expiration; license numbers are optional), certifications, clinical rotation details, skills, and contact details you choose to include.
• Generated content: AI-generated drafts, edits, scores, and suggestions created for you.
• Purchase information: product purchased, order ID, purchase date, and refund status. We do not receive or store your full card number; Stripe collects payment details. We may receive your name, email, billing country/postal code (for tax), card brand, and last four digits.
• Usage and device data: pages viewed, features used, IP address, browser and device type, approximate location (from IP), referral source, and ad click identifiers (such as the Google Click ID, "gclid").
• Support communications: messages you send us.

Free ATS check: the free ATS check on our website runs entirely in your browser. The resume and job posting text you paste or upload there are processed on your device and are not sent to us or stored by us. If you accept analytics cookies, we record only that a check was started and completed, and the resulting score and keyword counts, never the text itself.

Please do not include patient information or other people's health information in your documents. The Service is not designed to store protected health information.

3. How we use information

• To provide the Service: build, check, tailor, and export your resume and cover letter.
• To process AI requests (see Section 4).
• To manage your purchase, access period, fair-use limits, and refunds.
• To provide customer support and send service messages (receipts, access expiry notices, security alerts).
• To measure and improve the Service and our advertising (analytics and conversion measurement).
• To prevent fraud and abuse, and to comply with legal obligations.

We do not use your resume content to train our own AI models. [If this changes, we will ask for your consent first.]

4. AI processing by third-party model providers

To generate and improve your documents, we send the relevant text (for example, your resume content and the job posting you paste) to third-party AI model providers: [AI Provider(s), e.g. "OpenAI, L.L.C."]. These providers process the data on our behalf to return a result. Under their API terms as of [date checked], [they do not use API data to train their models / retain API data for up to [30] days for abuse monitoring] — [verify and update]. AI output can be inaccurate; review everything before you submit it to an employer.

5. Legal bases (EEA/UK users)

• Contract: to provide the Service you requested.
• Legitimate interests: security, fraud prevention, and improving the Service.
• Consent: non-essential cookies, analytics, and advertising measurement where required; you can withdraw consent at any time.
• Legal obligation: tax, accounting, and responding to lawful requests.

6. How we share information

We share personal information only with: - Service providers (processors): hosting (Cloudflare Pages), database and authentication [Supabase], AI model providers [listed above], email delivery [Email Provider], analytics [Google Analytics 4, PostHog], and advertising measurement [Google Ads]. - Stripe, our payment processor, for payments, sales tax/VAT calculation (Stripe Tax), receipts, refunds, and dispute handling. - Authorities, if required by law, or to protect rights and safety. - A successor, in a merger or sale of the business, with notice to you.

We do not sell your resume content, and we do not sell personal information for money. See Section 10 regarding "sharing" for advertising under California law.

7. Cookies and similar technologies

• Strictly necessary cookies: keep you signed in and secure the Service.
• Analytics: Google Analytics 4 and [PostHog] help us understand how the Service is used.
• Advertising measurement: Google Ads conversion tracking (gtag) records when a visitor who clicked our ad signs up or purchases. [We do / do not use remarketing audiences.]
• Your choices: EEA/UK visitors see a consent banner, and non-essential cookies stay off until you accept (we use Google Consent Mode). Everyone can change choices at any time via [Cookie Settings link]. You can also use browser settings or Google's Ads Settings.
• We honor Global Privacy Control (GPC) signals as an opt-out of sharing for advertising where required by law.

8. Data retention and deletion

• Account and documents: kept while your account is active. You can delete individual documents, or your whole account, at any time in Settings → Delete account.
• After account deletion: removed from active systems within [30] days and from backups within [90] days.
• Inactive accounts: we may delete accounts with no sign-in for [24] months, after an email notice.
• Pasted job postings and AI request logs: kept up to [90] days for troubleshooting and abuse prevention.
• Purchase and tax records: kept as long as required for tax and accounting (typically [7] years). Stripe also keeps its own transaction records.
• Expired 30-day passes: your documents stay available to download until you delete them or your account.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, export (portability), restrict, or object to processing of your personal information, and to withdraw consent. To make a request, email support@chartedcv.com. We will verify your request and respond within the time required by law (for example, one month under GDPR, or 45 days under California law). EEA/UK residents may also complain to their local data protection authority.

10. California privacy notice (CCPA/CPRA)

• Categories collected (last 12 months): identifiers; professional or employment-related information; commercial information (purchases); internet activity; approximate geolocation; and inferences (resume match scores).
• Sources: you, your device, and our service providers.
• Purposes: as described in Section 3.
• Sale/sharing: we do not sell personal information. Using Google Ads conversion or remarketing cookies may count as "sharing" for cross-context behavioral advertising. You can opt out through [Do Not Sell or Share My Personal Information link] or a GPC signal.
• Sensitive personal information: we do not use it to infer characteristics about you.
• Rights: to know, delete, correct, and opt out of sale/sharing, without discrimination. You may use an authorized agent.

11. International transfers

We are based in [Country], and our providers may process data in the United States and other countries. Where required, we rely on safeguards such as the European Commission's Standard Contractual Clauses.

12. Security

We use encryption in transit (HTTPS), access controls, and reputable infrastructure providers. No method is 100% secure; please use a strong password.

13. Children

The Service is not intended for anyone under 16, and we do not knowingly collect their data.

14. Changes

We will post updates here and change the "Last updated" date. If changes are material, we will notify you by email.

15. Contact

[Legal Entity Name], [Business Address], support@chartedcv.com