Privacy Policy

1. Who We Are

Career Compass is a career intelligence platform operated by:

We are the data controller responsible for your personal data. This means we determine how and why your personal data is processed.

Given the current scale of our operations, we have not appointed a Data Protection Officer under Article 37 GDPR. All data protection inquiries can be directed to support@careercompass.pl. We will appoint a DPO if our processing activities require it.

Career Compass helps EU-based IT professionals, project managers, product owners, and delivery managers understand their career strengths through resume scoring, job matching, and market intelligence.

2. What Data We Collect

We collect and process the following categories of personal data:

Providing your resume and professional information is necessary to use Career Compass's core features. If you choose not to provide this data, we cannot deliver resume scoring, job matching, or AI-generated career content. Account registration requires only an email address and password (or Google OAuth).

2.1 Identity Information

2.2 Professional Information

2.3 Skills and Credentials

2.4 Job Search Preferences

2.5 Usage Data

2.6 Technical Data

2.7 Payment Information

We never store full credit card numbers. All payment processing is handled by Stripe, a PCI DSS Level 1 certified payment processor.

2.8 AI-Generated Content

3. How We Collect Your Data

We collect data through the following methods:

3.1 Direct Collection

• Registration forms: When you create an account using email/password
• Resume upload: When you upload your CV in PDF format
• Manual entry: When you edit or add information to your profile
• Settings updates: When you configure your job preferences

3.2 Automated Collection

• AI extraction: We use artificial intelligence to extract structured data from your uploaded resume
• Keyword matching: We identify skills, certifications, and tools using curated dictionaries
• Industry classification: We classify your work experience into industry categories using AI analysis
• Usage logging: We automatically record your interactions with the platform for security and service improvement

3.3 Third-Party Collection

• Google OAuth: If you sign up or log in with Google, we receive your name and email address from Google
• Job posting analysis: When you analyze a job posting URL, we extract information from that public job listing

4. Legal Basis for Processing

Under GDPR, we must have a valid legal basis to process your personal data. We rely on the following bases:

4.1 Contract Performance (Article 6(1)(b) GDPR)

We process data necessary to provide our services to you:

• Account creation and management
• Resume storage and display
• AI-powered resume extraction and analysis
• Resume scoring using the Three Pillars Model
• Job matching against external job postings
• AI-generated career content (cover letters, elevator pitches, interview prep)
• Storing and displaying extracted professional information

4.2 Consent (Article 6(1)(a) GDPR)

We process certain data only with your explicit consent:

• Analytics cookies (Google Analytics 4, via CookieYes consent banner)
• Marketing communications (when applicable)

You can withdraw consent at any time. For cookies, use the CookieYes preference center (cookie icon in footer). For marketing, use the one-click unsubscribe link. Withdrawal does not affect the lawfulness of processing before withdrawal. Note: Core service features operate under Contract Performance basis, not consent.

4.3 Legitimate Interest (Article 6(1)(f) GDPR)

We process some data based on our legitimate business interests, balanced against your rights:

4.4 Legal Obligation (Article 6(1)(c) GDPR)

We process some data to comply with legal requirements:

• Account deletion audit records (GDPR compliance documentation)
• Responding to lawful data access requests

Summary: Data Processing Legal Basis

5. How We Use Your Data

5.1 Resume Scoring

We analyze your resume using our Three Pillars Model:

• Experience Pillar: Evaluates career depth, industry breadth, and achievement impact
• Competencies Pillar: Assesses certifications, technical skills, soft skills, and tools
• Presentation Pillar: Reviews contact completeness, content structure, data quality, and language proficiency

This scoring helps you understand your CV's strengths and areas for improvement.

5.2 Job Matching

When you submit a job posting URL, we:

1. Extract job requirements from the posting
2. Compare your profile against job requirements
3. Calculate a match score across Role Fit, Skills Fit, and Preferences Fit
4. Identify skill gaps and provide actionable insights

5.3 Keyword Coverage Analysis

We analyze how well your resume keywords align with expected keywords for your target roles, helping you optimize your CV for specific career paths.

5.4 Account Management

We use your data to:

• Create and maintain your account
• Authenticate your identity
• Send important service communications
• Respond to your support requests

5.5 Service Improvement

We use aggregated, anonymized data to:

• Improve our scoring algorithms
• Develop new features
• Understand market trends in skills and certifications

5.6 Automated Profiling

Career Compass performs automated profiling under Art. 4(4) GDPR through the following mechanisms:

• Resume scoring: The Three Pillars Model (Experience, Competencies, Presentation) produces a 0-100 score for each pillar
• Job matching: Weighted comparison across Role Fit (35%), Skills Fit (35%), and Preferences Fit (30%)

These scores are informational only and do not result in any employment decisions. No decisions producing "legal effects or similarly significant effects" under Art. 22 GDPR are made based on this profiling.

You can review the scoring methodology on the platform. If you have concerns about any automated assessment, contact support@careercompass.pl for human review.

6. Data Sharing and Third Parties

6.1 Service Providers (Data Processors)

We share data with the following third-party processors who help us operate our platform:

*For US-based processors, we rely on Standard Contractual Clauses (SCCs) and their additional safeguards. See Section 10 for details.

6.2 What We Do NOT Do

We never:

• Sell your personal data to third parties
• Share your resume with recruiters without your explicit consent
• Use your data for advertising or marketing by third parties
• Share your data with other users of the platform

6.3 Legal Requirements

We may disclose your data if required by law, court order, or government request, or to protect our legal rights.

7. Data Retention

We retain your data only as long as necessary for the purposes described in this policy.

7.1 Retention Periods

7.2 After Account Deletion

When you delete your account:

1. Immediate: All personal data, including resume files, is deleted
2. Retained for 3 years: Anonymized audit record (SHA-256 hash of email only, no plain text) for GDPR compliance documentation

8. Your Rights Under GDPR

As an EU resident, you have the following rights regarding your personal data:

8.1 Right of Access (Article 15)

You can request a copy of all personal data we hold about you.

How to exercise: Email support@careercompass.pl with subject "Data Access Request"

8.2 Right to Rectification (Article 16)

You can correct inaccurate or incomplete personal data.

How to exercise: Edit your profile directly in the platform, or contact us for assistance.

8.3 Right to Erasure / "Right to be Forgotten" (Article 17)

You can request deletion of your personal data.

How to exercise: Use the "Delete Account" function in Settings, or email us.

8.4 Right to Data Portability (Article 20)

You can request a copy of all your data in a structured, machine-readable format (JSON/ZIP). This includes:

• Profile information and preferences
• Identity data (name, contact details)
• Extracted skills, certifications, and work history
• Job match results and history
• Cover letters, elevator pitches, and interview preparations
• Original uploaded resume file

How to exercise: Email support@careercompass.pl with subject "Data Export Request". We will fulfill your request within 30 days.

8.5 Right to Restriction of Processing (Article 18)

You can request we limit how we use your data in certain circumstances.

How to exercise: Contact us explaining the specific restriction you're requesting.

8.6 Right to Object (Article 21)

You can object to processing based on legitimate interests.

How to exercise: Contact us with your objection. We will stop processing unless we have compelling legitimate grounds.

8.7 Right to Withdraw Consent (Article 7)

Where processing is based on consent, you can withdraw it at any time through these specific channels:

• Cookie consent: Use the CookieYes preference center (cookie icon in the footer) to change your cookie preferences at any time
• Marketing communications: Use the one-click unsubscribe link in any marketing email (when applicable)

Core service features (resume scoring, job matching, AI content) operate under Contract Performance basis (Art. 6.1.b), not consent. These features are part of the service you signed up for.

Withdrawal does not affect the lawfulness of processing before withdrawal.

8.8 Right to Lodge a Complaint

You have the right to complain to a supervisory authority. In Poland, this is:

Response Timeline

We will respond to all rights requests within 30 days. If a request is complex, we may extend this by an additional 60 days, but we will inform you of any extension within the initial 30-day period.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

9.1 Technical Measures

• Encryption in transit: All data transmitted using TLS 1.3
• Encryption at rest: Database and file storage encrypted
• Secure authentication: Password hashing, OAuth 2.0 support
• Access controls: Role-based access, principle of least privilege

9.2 Organizational Measures

• Data minimization: We only collect data necessary for our services
• Access limitation: Only authorized personnel can access personal data
• Incident response: Procedures for detecting and responding to data breaches

9.3 Data Breach Notification

In the event of a data breach that poses a risk to your rights:

• We will notify the supervisory authority within 72 hours
• We will notify affected users without undue delay if high risk
• We will document all breaches and remediation actions

10. International Data Transfers

Your data is primarily stored in the European Union (Supabase EU - Paris).

When we transfer data to processors outside the EU (specifically to the USA for AI processing), we rely on:

10.1 EU-US Data Privacy Framework (DPF)

Stripe and Google are certified under the EU-US Data Privacy Framework. Vercel participates in the DPF. These certifications provide an adequate level of data protection for transfers to the United States.

10.2 Additional Safeguards for AI Processors

• Anthropic and OpenAI process data transiently with no long-term storage
• Only professional data is shared (resume content, job descriptions)
• No sensitive personal data categories are sent to AI processors

10.3 EU Data Storage

Supabase stores all persistent user data in the EU (Paris region). Langfuse (LLM observability) is hosted in the EU (Germany).

10.4 AI Processing Specifics

When your resume is processed by AI services:

• Identity data (name, email, phone number, LinkedIn URL) is extracted locally on our servers using pattern matching - no AI is involved in processing your personal identifiers
• Identity data is stripped from the resume text before it is sent to AI providers. Only professional content (skills, experience, education) reaches AI services
• Processing is transient (not stored by the AI provider beyond the request)
• Results are immediately returned and stored in our EU database

11. Cookies

We use cookies and similar technologies to operate our platform. For detailed information about the cookies we use and how to manage them, please see our Cookie Policy.

Summary:

• Essential cookies: Required for authentication and security (no consent needed)
• Functional cookies: Not currently used. May be introduced for preferences in the future (consent will be required)
• Analytics cookies: We use Google Analytics 4 to understand how visitors interact with our website and which features are most useful. Analytics cookies are only set after you provide consent via our cookie banner

12. Children's Privacy

Career Compass is designed for professionals and is not intended for anyone under 18 years of age.

We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately at support@careercompass.pl, and we will delete such data.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes:

13.1 Notification Process

• Minor changes: Updated policy posted on this page with new "Last Updated" date
• Material changes: Email notification to registered users at least 14 days before changes take effect

13.2 Continued Use

Your continued use of Career Compass after changes take effect constitutes acceptance of the updated policy. If you do not agree with changes, you may delete your account.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:

We aim to respond to all inquiries within 5 business days, and to formal rights requests within 30 days.