Privacy Policy

CareerFlowCV (“we”, “us”) is operated by Apitech Ventures, of Bangalore. For the purposes of the DPDP Act we are the Data Fiduciary: we decide why and how your personal data is processed. You are the Data Principal.

CareerFlowCV is a web service that lets you upload a resume, have it parsed, scored against a job description (ATS and AI semantic scoring), corrected and optimised using AI, and exported as a PDF or LaTeX file. This policy applies to our website and web application. It does not apply to websites of third parties that we link to.

We collect only the data listed below.

We do not knowingly ask for sensitive categories such as health, religion, caste or financial account details. If you include such information in your resume, it is processed as part of your resume for the purposes in section 3. Please consider removing anything you do not want processed before uploading.

We use your personal data only for the purposes below and not for anything incompatible with them.

We do not sell your personal data. We do not use your resume to train AI models, and we do not display advertisements.

When you sign up we ask for each of the following separately. None is pre-selected. The first three are needed to provide the service; the last two are optional and you can use the service without them.

• Account (required): we create your account and store your profile to run the service.
• Resume processing (required): we store and process your resumes.
• AI processing (required): your resume text is sent to third-party AI providers.
• Signup analytics (optional): we keep your email and job role for internal analytics.
• Marketing (optional): we may contact you with product updates or offers.

Every consent you give or withdraw is recorded with the date, time, policy version and your IP address. If we change this policy in a material way, we will ask you to review and accept it again before you continue.

Withdrawing consent. You can change the optional consents at any time in Settings → Privacy & data. It is as easy to withdraw as it was to give. Because the service cannot work without them, withdrawing Resume processing or AI processing deletes all your resumes immediately. The Account consent cannot be withdrawn on its own; the way to withdraw it is to delete your account (section 10). Withdrawal does not affect processing done before you withdrew. If you do not agree to the required consents you will not be able to use CareerFlowCV.

To parse, score, correct and optimise your resume, we send your resume text and the job description to large-language-model providers. We currently use OpenAI. These providers process the text only to return a result to us. We do not send your name-and-email account data to them for this purpose, although your resume text may itself contain such details.

AI output can contain mistakes. Please review every generated resume before you use it. We do not take decisions that have legal or similar effects on you purely by automated means; the scores and suggestions are for your own use.

If you add your own AI provider API key, we use it only to make requests on your behalf, store it encrypted, and delete it when you remove it or delete your account.

We share personal data only with processors that help us run the service, under written terms that require them to protect it and use it only on our instructions:

• Google— for “Sign in with Google”. We receive your email and profile identifier.
• AI providers — receive resume text and job descriptions (section 5).
• Cloud storage and hosting providers (Amazon Web Services S3 for files; [hosting and database provider]) — store files and databases.
• Logging — application logs are viewed with Dozzle, a self-hosted tool, so log data is not sent to a third party.
• Payment processor ([name, once paid plans are live]) — receives the details needed to take payment. We do not store your card number.

We may also disclose data to a court, regulator or government authority when the law requires it, or to professional advisers bound by confidentiality. If our business is sold or reorganised, your data may transfer to the new owner, who must honour this policy.

Our servers and some providers may be located inside or outside India (files are stored with AWS in the ap-south-1 region; [confirm hosting and database regions]). Under Section 16 of the DPDP Act, we transfer personal data outside India only to countries that the Central Government has not restricted, and we require the same level of protection from the provider. AI providers in particular may process your resume text outside India.

When the purpose is complete or you withdraw consent, we erase the data unless the law requires us to keep it.

Under the DPDP Act you have the right to:

• Access a summary of the personal data we process about you, the processing activities, and the other parties we have shared it with (Section 11).
• Correct inaccurate or misleading data, complete incomplete data, and update it (Section 12). You can edit your resume content in the app.
• Erase your personal data when it is no longer needed for the purpose it was collected (Section 12), and withdraw consent at any time (Section 6).
• Get your grievance redressed by us (Section 13).
• Nominate another person to exercise your rights if you die or become unable to (Section 14).

Most of these you can do yourself in Settings → Privacy & data. For anything else, write to hr@talentxminds.com from the email address on your account. We may need to verify your identity first. We aim to respond within [30 days]. If you are not satisfied with our response to a grievance, you may complain to the Data Protection Board of India.

You also have duties under Section 15 of the DPDP Act, including to give accurate information, not to impersonate anyone, and not to file false or frivolous complaints.

In Settings → Privacy & data you can:

• Delete stored files only (original PDF, optimised PDF, LaTeX). Your extracted resume content and history stay.
• Delete all resumes. This is immediate and permanent and removes files, extracted content, versions and scores.
• Delete your account. This erases your resumes, files, scores, wallet and credit history, AI request log, consent records, stored API keys, analytics records and the account itself.

Deletion safeguard. Free credits are given once per person. To stop them being claimed again by deleting and re-creating an account, when you delete your account we keep, for 30 days only, a one-way hash of your email address together with your remaining credit balances and next refill date. We cannot read your email from the hash. If you sign up again with the same email within 30 days, your previous balance is restored and no new free credits are given. After 30 days the record is deleted and a new sign-up receives the normal free credits.

CareerFlowCV is intended for people aged 18 and over. Under Section 9 of the DPDP Act we do not process the personal data of a child (under 18) without the verifiable consent of a parent or lawful guardian, and we do not track or monitor children or target advertising at them. If you are under 18, do not create an account. If you believe a child has given us personal data, contact us and we will delete it. [Age confirmation at sign-up is to be added.]

We use reasonable security safeguards as required by Section 8 of the DPDP Act, including encrypted connections (HTTPS), encryption of stored API keys, hashed passwords, access controls, and separation of environments. No system is perfectly secure.

If a personal data breach occurs, we will inform the Data Protection Board of India and each affected user, in the form and within the time the law requires.

We store the following in your browser. All of it is strictly necessary to sign you in and run the service:

• Sign-in cookie (cvforge_auth) — a first-party cookie that lets us send signed-out visitors to the login page. It holds no personal data or token and expires after 24 hours.
• Local storage — your sign-in tokens, basic profile details, display preferences and per-resume settings, kept on your device. Your tokens and profile are removed when you sign out.

We do not use analytics, advertising or cross-site tracking cookies. Google Sign-In may set its own cookies under Google's policy. If we add analytics or similar tools in future, we will update this policy and ask for your consent first.

We also offer an API for business partners to process resumes on behalf of their own users. The partner decides why that data is collected and is responsible for obtaining the consent of its users; we process it for the partner. Its retention and handling are described in the partner terms. [Partner terms to be published.]

We may update this policy. The version and date at the top show the current text. If a change is material, we will ask you to accept it again before you continue using the service. Earlier versions are available on request.

For questions, to exercise your rights, or to make a complaint, contact our Grievance Officer:

General privacy requests: hr@talentxminds.com.

Our Terms of Service are at /terms.