Privacy Policy

This policy explains what information Corvyx ("we", "us") collects when you use corvyx.app (the "Service"), why we collect it, and who we share it with. It's written to describe what this product actually does, not generic boilerplate — but it is not a substitute for legal advice, and you should have it reviewed by a lawyer before relying on it, particularly regarding GDPR/CCPA compliance for your specific user base.

1. Information we collect

Account information. Email address, full name, and a hashed password if you register directly. If you sign in with Google or GitHub instead, we receive your name, email, and profile information from that provider rather than storing a password ourselves.

Resume and career content. Anything you enter into the resume builder, career profile, or job tracker — work history, education, skills, job applications, notes, and any documents or photos you upload. This is the core content of the Service and is stored so you can access and edit it later.

Payment information. If you subscribe to a paid plan, payment is handled entirely by Stripe. We do not receive or store your card number — we receive limited transaction metadata (subscription status, plan tier) from Stripe to manage your account.

Usage and analytics data. We use Google Analytics to understand aggregate usage patterns (which pages are visited, general traffic sources). We also use Microsoft Clarity, which records session replays and heatmaps of how visitors interact with the site (clicks, scrolling, mouse movement) to help us find and fix usability problems. Unlike Google Analytics, Clarity's recordings are not purely aggregate — they can include the actual content rendered on a page during that session. Neither tool sees the contents of your resume or job applications as data we deliberately send to them.

2. How we use your information

• To provide the Service — building, storing, and exporting your resume; tracking job applications
• To process AI-assisted features (resume chat, ATS scoring, job matching) — see Section 3
• To process payments and manage subscriptions
• To send account-related email (verification, password reset, receipts)
• To detect and prevent abuse, fraud, and security issues
• To understand aggregate product usage so we can improve it

3. AI processing

Features like AI resume chat, ATS scoring, and job matching send relevant portions of your resume and, where applicable, a job description you provide to a third-party AI provider (our infrastructure currently supports Anthropic and OpenRouter; OpenRouter forwards requests to the underlying model host it's configured to use — currently Google, for Gemini — as part of serving that request) in order to generate a response. These providers process that content to return the result to you; we do not control their internal retention practices and you should review their own policies if you have concerns about a specific provider.

4. Who we share information with

We share information only with the service providers necessary to run Corvyx, each acting on our behalf under their own security obligations:

• Stripe — payment processing and subscription billing
• Google / GitHub — optional sign-in (only if you choose to use them)
• Resend — transactional email (verification codes, password resets)
• Cloudinary — storage for uploaded profile photos and images
• Google Analytics — aggregate, anonymized usage analytics
• Microsoft Clarity — session replay and heatmap analytics (see Section 1)
• Our AI providers (Anthropic / OpenRouter, and the underlying model host OpenRouter is configured to use) — described in Section 3
• Our hosting and database providers — infrastructure that stores and serves the Service; they do not access your data except as needed to operate that infrastructure

We do not sell your personal information, and we do not share your resume content with advertisers.

5. Data retention

We retain your account and resume data for as long as your account is active. If you delete your account, we delete your personal data within a reasonable period, except where we're required to retain records (e.g. transaction records) for legal or accounting purposes.

6. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to certain processing. You can access and edit most of your data directly in your account settings, or contact us using the details below for anything else.

7. Security

We use industry-standard practices to protect your data, including encrypted connections (HTTPS), hashed passwords, and access controls on our infrastructure. No system is perfectly secure, and we can't guarantee absolute security of information transmitted to the Service.

8. Children's privacy

Corvyx is not directed at children under 16, and we do not knowingly collect personal information from them.

9. Changes to this policy

We may update this policy from time to time. We'll update the "Last updated" date above when we do; material changes will be communicated more prominently.

10. Contact us

Questions about this policy or your data: connect@corvyx.app
Carl-von-Ossietzky.19, 65197 Wiesbaden, Germany +49 176 72369217