Privacy Policy

Who can use DebriefCV

DebriefCV is for people 18 and older in the United States. We do not knowingly collect information from anyone under 18. If you believe someone under 18 has created an account, email us and we will delete it.

What we collect

Information you give us

• Account details: your name, email address, and password. We store your password only as a salted hash. If you sign in with GitHub, we receive your GitHub name, email address, profile picture, and account ID instead of a password.
• Your material: files you upload, documents you import, and the text we extract from them; job postings and companies you add; resumes and study plans you generate; and instructions you save for generation.
• Your Anthropic API key, if you choose to add one. We encrypt it before storing it and show only its last four characters.
• Ratings of generated content, if you turn on rating on your account page. While it is on, we store the full prompts sent to the AI models for your requests and the responses they returned, which contain your material, so that a thumbs up or down and any comment you give can be read with them.
• Messages you send us, such as support or privacy requests.

Information from services you connect

• Google Drive: if you connect a Google account to import documents, we receive the email address of that Google account and access to the specific files you pick. We cannot see any other file in your Drive. See Google user data.
• Stripe: if you subscribe to a paid plan, Stripe tells us your customer ID, plan, and subscription status. Stripe collects your payment card details directly; we never see or store your full card number.

Information collected automatically

• Session information: when you sign in, we record your IP address and browser user agent with your session, to keep you signed in and to help detect misuse of your account.
• Rate-limit records: we count requests per account and per IP address to prevent abuse.
• Usage records: for each AI request, we record which feature made it, the model, the number of tokens used, how long it took, and whether it ran on your own API key. We use these records to enforce plan limits and track costs. They do not contain your material.
• Server logs: our servers log errors and request metadata, which can include your account ID. We do not log the contents of your material.

Cookies

We use only cookies the site needs to work:

We do not use analytics, advertising, or tracking cookies, and we do not allow third parties to track you on DebriefCV.

How we use your information

We use your information to:

• create and manage your account and keep it secure;
• run the features you ask for, such as extracting text from uploads, reading job postings, and generating resumes and study plans;
• process payments and apply your plan's limits;
• send emails the service needs, such as email verification, password resets, and notices about this policy or your account;
• prevent fraud, abuse, and security incidents;
• understand costs and fix problems;
• improve the quality of generated content, if you turn on rating: our administrators can read your ratings and the stored prompts and responses behind them; and
• comply with the law.

We do not sell your personal information, share it for cross-context behavioral advertising, or use it to send you marketing.

AI processing

To generate content, we send the relevant parts of your material, such as your uploaded work, the job posting, and your saved instructions, to Anthropic, which provides the AI models DebriefCV uses. When a feature needs to read a job posting from a link or look up public information about an employer, Anthropic's web tools fetch that page or run that search on our behalf.

When you use DebriefCV on our API account, Anthropic processes your material under its commercial terms to provide the service to us and does not use it to train its models. When you add your own Anthropic API key, requests for your account run on your key, and Anthropic's terms with you apply to them.

We do not use your material to train AI models.

Shared interview timeline estimates

When you add a role, we may estimate the employer's interview process. These estimates are stored by employer, job level, and job function so that other users applying to similar roles can reuse them. An estimate contains interview steps and time ranges only, never your material or text from a job posting, and is not linked to you.

Who we share information with

We share personal information only with these service providers, and only as needed for them to provide their service to us:

We may also disclose information if the law requires it, to protect the rights, safety, or property of our users or others, or as part of a sale or transfer of DebriefCV, in which case this policy continues to apply to your information.

Google user data

If you connect a Google account, DebriefCV requests access only to your email address and to the Google Drive files you choose with the Google file picker. We use this access only to import and refresh the documents you pick as material in your account. Imported content is processed like any other material you upload, including being sent to Anthropic when you generate a resume or study plan.

We do not use Google user data for advertising, sell it, or use it to develop, improve, or train generalized AI or machine learning models. People do not read your Google data unless you ask us to for support, it is needed for security, or the law requires it.

DebriefCV's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We encrypt your Google access tokens. You can disconnect Google at any time on your account page, which revokes our access and deletes the tokens. You can also remove DebriefCV from your Google account's third-party access settings.

How long we keep information

• Your account and material: for as long as your account is open. When you delete an item, such as an uploaded file, we delete it, including the stored file.
• After you delete your account: we delete your account, material, uploaded files, saved instructions, ratings and the prompts and responses stored for them, stored API key, and Google connection within 30 days. Copies in database backups are deleted when those backups expire, within 30 days. We keep usage records without any link to you, for cost accounting.
• Sessions: until the session expires or you sign out, then deleted within 30 days.
• Rate-limit records: deleted within 30 days.
• Prompts and responses stored for rating: deleted within 30 days unless you rated the content they produced, and as soon as you turn rating off. Ratings you gave, and the prompts and responses behind them, are kept until you delete your account.
• Server logs: kept for up to 30 days.
• Billing records: Stripe and we keep payment and invoice records as long as tax and accounting laws require.

How we protect information

We use HTTPS for all traffic, store passwords as salted hashes, encrypt stored API keys and Google tokens, and limit administrator access to what is needed to run the service. Administrators can see account details such as names, email addresses, plans, and usage, and, if you turn on rating, the prompts, responses, and ratings stored for it. No method of storage or transmission is completely secure, so we cannot guarantee absolute security. If a breach affects your information, we will notify you as the law requires.

Your choices and rights

You can:

• See and correct your account details and material in the app at any time.
• Delete individual items in the app, or delete your whole account on your account page.
• Disconnect Google Drive or remove your stored API key on your account page.
• Cancel a paid plan on your billing page.
• Get a copy of your information, or ask anything about it, by emailing privacy@debriefcv.com.

We respond to requests within 45 days. We may need to confirm your identity first, usually by asking you to email us from your account's address.

California residents

If you live in California, you have the right to:

• know what personal information we collect, use, and disclose, and get a copy of it;
• ask us to delete or correct your personal information;
• opt out of the sale or sharing of your personal information, although we do not sell or share it;
• limit our use of sensitive personal information, although we use it, such as your password and account credentials, only to provide the service; and
• not be treated differently for using these rights.

In the past 12 months we have collected these categories of personal information, from you and the services listed above, for the purposes described in this policy: identifiers (name, email address, IP address, account IDs); customer records (account and billing details); commercial information (plan and subscription history); internet activity (session and usage records); professional or employment information (your work history and the roles you apply to); and account login credentials. We disclose them only to the service providers listed above, for business purposes. We have not sold or shared personal information, including that of anyone under 16.

To make a request, email privacy@debriefcv.com. You may use an authorized agent; we will ask for proof of their authority and may ask you to confirm your identity directly.

California's “Shine the Light” law lets California residents ask which personal information a business disclosed to third parties for their direct marketing. We do not disclose personal information for that purpose.

Do Not Track and Global Privacy Control

DebriefCV does not track you across other websites and does not sell or share personal information, so we treat every visitor the same whether or not their browser sends a Do Not Track or Global Privacy Control signal.

Where we process information

We store and process information in the United States.

Changes to this policy

We may update this policy. We will post the new version on this page with a new effective date, and if a change is significant, we will email you before it takes effect.

Contact

Email privacy@debriefcv.com.