Privacy Policy

Account data: name, email, your organization name and password (stored only as an Argon2id hash, never in plaintext).

Usage data: domains you register, scan results, and technical metadata needed to provide the Service.

We do not collect card data: it is handled directly by Lemon Squeezy in its checkout.

To operate your account, run scans, generate reports, send you security alerts and transactional emails (verification, invitations), and manage your subscription. We only send marketing communications with your explicit consent, which you can withdraw anytime.

We rely on trusted third parties that process data on our behalf: Lemon Squeezy (payments and billing), Resend (email delivery), Groq (AI report generation), and Cloudflare together with our hosting provider (delivery and infrastructure). Each accesses only the data needed for its function.

Scans analyze only publicly accessible information about domains you verified as your own. We do not access private content of your systems or store sensitive data hosted on them.

When you use the CV generator we process: your experience/CV text, the job posting text (that you paste or that we extract via OCR from an image you upload) and the generated CV. This data may include your personal information.

To generate the CV, that text is sent to Groq (our AI provider, with infrastructure in the United States): this is an international data transfer, performed solely to generate your CV. Images you upload are processed to extract their text and are NOT stored.

We store your generated CVs in your account so you can reuse and edit them (you chose to keep history). We keep them while your account is active or until YOU delete them: you can delete any CV at any time from the tool (right to erasure), and deletion is permanent.

We use strictly necessary cookies to keep you securely signed in (httpOnly session cookie). We do not use advertising or third-party tracking cookies.

We keep your data while your account is active. If you delete it, we erase or anonymize your personal data within a reasonable period, except what we must retain for legal or accounting obligations.

You can access, rectify, export or request deletion of your personal data, and object to certain processing, under applicable law (including GDPR and Ecuador's LOPDP). To exercise them, contact us.

We apply encryption in transit, strong password hashing, role-based access control, infrastructure isolation and audit logging. No system is infallible, but we handle your information with industry standards. See our Security page for details.

We may update this Policy; material changes will be notified by reasonable means. For privacy questions, write to javiercaiza220158@gmail.com.