1. Who We Are
CareerBrains, Inc. (“CareerBrains,” “we,” “our,” or “us”) is the data controller responsible for your personal data. We operate the CareerBrains platform at CareerBrains.com — an AI-powered career and job application platform.
For users in the European Economic Area (EEA) and the United Kingdom, CareerBrains, Inc. acts as the data controller under the General Data Protection Regulation (GDPR) and UK GDPR, respectively.
EU/UK Data Protection Officer (DPO): dpo@CareerBrains.com
2. Data We Collect
We collect data in three ways: directly from you, automatically when you use our platform, and from third parties.
2.1 Data You Provide Directly
- Account data: email address, password (bcrypt-hashed, never stored in plaintext), name, and role (candidate or recruiter).
- Profile data: first and last name, biography, phone number, LinkedIn URL, GitHub URL, personal website URL.
- Resume data: uploaded resume files (PDF, DOC, DOCX). We extract structured data (work history, skills, education, certifications) and generate a 1,536-dimension semantic embedding for AI matching. The raw file is stored separately.
- Job postings (recruiters): job title, description, company name, location, salary, screening questions.
- Application data: job applications you submit, including screening question answers and a snapshot of your resume at the time of applying.
- Communications: messages you send to our support team or through the platform.
- OAuth identifiers: if you register via Google or LinkedIn, we receive your name, email, and provider user ID. We do not receive your social media passwords.
2.2 Data Collected Automatically
- Usage data: pages visited, features used, session duration, clicks, and navigation paths.
- Technical data: IP address, browser type and version, operating system, device type, timezone, and referring URL.
- Log data: server logs recording API requests, timestamps, and error events (without personally identifying content).
- Cookies and similar technologies: session identifiers, preference tokens, and analytics identifiers. See Section 10.
2.3 Data from Third Parties
- OAuth providers (Google, LinkedIn): name, email address, and profile identifier upon successful OAuth authentication.
- Payment processors: we receive transaction confirmations and billing status from our payment processor. We do not store full card numbers.
2.4 AI-Processed Data
Resume text and job descriptions are transmitted to OpenAI’s API to generate structured analysis, match scores, cover letters, and interview preparation materials. This data is processed under OpenAI’s data processing agreement. OpenAI does not use API-submitted data to train its models by default.
3. How We Use Your Data
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Create and manage your account | Account data, OAuth identifiers | Contract (Art. 6(1)(b) GDPR) |
| Provide AI job matching, resume analysis, cover letter generation, interview prep | Resume data, job data, AI outputs | Contract |
| Send OTP verification emails | Email address | Contract |
| Process payments and manage subscriptions | Billing data via payment processor | Contract |
| Personalise your job feed and recommendations | Resume embedding, saved jobs, application history | Legitimate interest |
| Improve our AI models and platform features | Aggregated, de-identified usage patterns | Legitimate interest |
| Detect fraud, abuse, and enforce our Terms of Service | Account data, usage logs, IP address | Legitimate interest |
| Send platform announcements and product updates | Email address | Legitimate interest / Consent |
| Comply with legal obligations | Applicable data as required | Legal obligation (Art. 6(1)(c)) |
| Analytics and platform performance monitoring | Usage data, technical data | Legitimate interest / Consent |
4. Legal Bases for Processing (GDPR / UK GDPR)
For users in the EEA and UK, we rely on the following legal bases under Article 6 of the GDPR:
- Performance of a contract (Art. 6(1)(b)): processing necessary to deliver the services you signed up for — account creation, AI features, job matching, and resume analysis.
- Legitimate interests (Art. 6(1)(f)): fraud prevention, platform security, service improvement, and personalisation, where these interests are not overridden by your fundamental rights.
- Consent (Art. 6(1)(a)): non-essential cookies, marketing communications, and optional features. You may withdraw consent at any time without affecting prior processing.
- Legal obligation (Art. 6(1)(c)): retaining records as required by applicable law (tax, financial reporting, anti-money-laundering).
We do not process any special category data under Article 9 GDPR (e.g., health data, racial or ethnic origin, political opinions, biometric data). If your resume contains such information incidentally, it is processed only to the extent necessary to provide the service you requested.
6. International Data Transfers
CareerBrains is headquartered in the United States. If you access our platform from the EEA, UK, or other jurisdictions with data transfer restrictions, your personal data will be transferred to and processed in the USA.
We ensure that such transfers are protected by appropriate safeguards, specifically:
- Standard Contractual Clauses (SCCs):the European Commission’s 2021 SCCs are incorporated into our DPAs with all relevant processors. UK addendums (IDTA) are used for UK-to-third-country transfers.
- Adequacy decisions: where the European Commission or UK ICO has issued an adequacy decision for the destination country, transfers proceed on that basis.
- Supplementary measures: encryption in transit (TLS 1.2+) and at rest, access controls, and pseudonymisation where technically feasible.
You may obtain a copy of the relevant safeguards by contacting us at dpo@CareerBrains.com.
7. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law.
| Data Category | Retention Period | Reason |
|---|---|---|
| Account and profile data | Duration of account + 30 days after deletion request | Service provision; deletion verification |
| Resume files and AI-parsed JSON | Duration of account + 30 days | Core service feature |
| Resume vector embeddings | Duration of account | Job matching |
| Application records | 3 years from application date | Dispute resolution, legal claims |
| Billing and payment records | 7 years | Tax and financial regulation |
| Server logs | 90 days | Security and debugging |
| OTP codes (Redis) | 10 minutes (TTL-enforced) | One-time verification only |
| Session tokens (Redis) | 7 days (TTL-enforced) | Refresh token lifetime |
| Audit logs | 3 years | Accountability obligations |
When you delete your account, we initiate a deletion cascade within 30 days. Certain data may be retained beyond this period where required by law (e.g., billing records for tax purposes), after which it is securely deleted or anonymised.
8. Your Privacy Rights
Depending on where you are located, you have the following rights regarding your personal data:
8.1 Rights Under GDPR / UK GDPR (EEA & UK Residents)
- Right of access (Art. 15): request a copy of the personal data we hold about you.
- Right to rectification (Art. 16): request correction of inaccurate or incomplete data.
- Right to erasure / ‘right to be forgotten’ (Art. 17): request deletion of your data where there is no overriding legitimate reason to retain it.
- Right to restriction (Art. 18): request that we limit processing of your data in certain circumstances.
- Right to data portability (Art. 20): receive your data in a structured, machine-readable format and transfer it to another controller.
- Right to object (Art. 21): object to processing based on legitimate interests or for direct marketing (unconditional right).
- Rights related to automated decision-making (Art. 22): not be subject to solely automated decisions that have significant legal effects.
- Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing.
- Right to lodge a complaint: you have the right to lodge a complaint with your local data protection authority.
8.2 Rights Under Other US State Laws
Residents of Virginia, Colorado, Connecticut, Texas, Oregon, Montana, and other states with comprehensive privacy laws have equivalent rights including the right to access, correct, delete, and opt out of targeted advertising.
8.3 How to Exercise Your Rights
Submit a request to legal@CareerBrains.comor via your account settings under “Privacy & Data.” We will respond within 30 days (GDPR: one calendar month, extendable by two months for complex requests).
9. California Residents — CCPA / CPRA
9.1 Categories of Personal Information Collected
- Identifiers (name, email, IP address, OAuth provider ID)
- Personal information categories under Cal. Civ. Code § 1798.80 (name, address)
- Internet or other electronic network activity (usage logs, page views)
- Professional or employment-related information (resume, work history)
- Inferences drawn from personal information (job match scores, resume quality scores)
9.2 Your California Rights
- Right to Know: request disclosure of categories and specific pieces of personal information collected, purposes of collection, and third parties with whom it is shared.
- Right to Delete: request deletion of your personal information, subject to exceptions.
- Right to Correct: request correction of inaccurate personal information.
- Right to Opt-Out of Sale or Sharing: we do not sell or share personal information for cross-context behavioural advertising.
- Right to Limit Use of Sensitive Personal Information: we do not use sensitive PI beyond what is necessary to provide the requested service.
- Right to Non-Discrimination: we will not discriminate against you for exercising your CCPA rights.
9.3 Shine the Light (Cal. Civ. Code § 1798.83)
We do not disclose personal information to third parties for their own direct marketing purposes.
11. Children's Privacy
The Platform is intended for users who are at least 18 years old. We do not knowingly collect personal information from children under 13 (COPPA) or under 16 (GDPR) without verified parental consent. If we discover we have inadvertently collected such data, we will delete it promptly.
12. Security
- Passwords hashed with bcrypt; never stored in plaintext.
- All data transmitted over TLS 1.2 or higher.
- JWT tokens signed with HS256; 30-minute access token lifetime.
- OTP codes stored in Redis with a 10-minute TTL; never persisted to the database.
- Resume files stored with UUID names, type-validated at upload.
- Role-based access controls enforced at the API layer.
- HTTP security headers:
X-Content-Type-Options,X-Frame-Options: DENY, CSP, HSTS (production). - Rate limiting on authentication endpoints.
In the event of a personal data breach posing risk to your rights, we will notify the relevant supervisory authority within 72 hours (GDPR Art. 33) and affected individuals without undue delay (GDPR Art. 34).
13. Changes to This Privacy Policy
We may update this policy periodically. For material changes, we will update the “Last updated” date, send a notice to your registered email address, and display a platform banner for 30 days. Continued use after the effective date constitutes acceptance.
14. Contact Us & Data Protection Officer
- Email (general privacy): legal@CareerBrains.com
- EU/UK Data Protection Officer: dpo@CareerBrains.com
- Postal address: CareerBrains, Inc., [Company Address], USA
EEA residents may lodge a complaint with their Member State’s data protection authority. UK residents may contact the ICO at ico.org.uk.