Privacy Policy

This policy explains what information Corvyx ("we", "us") collects when you use corvyx.app (the "Service"), why we collect it, and who we share it with. It's written to describe what this product actually does, not generic boilerplate — but it is not a substitute for legal advice, and you should have it reviewed by a lawyer before relying on it, particularly regarding GDPR/CCPA compliance for your specific user base.

1. Information we collect

Account information. Email address, full name, and a hashed password if you register directly. If you sign in with Google or GitHub instead, we receive your name, email, and profile information from that provider rather than storing a password ourselves.

Resume and career content. Anything you enter into the resume builder, career profile, or job tracker — work history, education, skills, job applications, notes, and any documents or photos you upload. This is the core content of the Service and is stored so you can access and edit it later.

Payment information. If you subscribe to a paid plan, payment is handled entirely by Stripe. We do not receive or store your card number — we receive limited transaction metadata (subscription status, plan tier) from Stripe to manage your account.

Usage and analytics data. We use Google Analytics to understand aggregate usage patterns (which pages are visited, general traffic sources). We also use Microsoft Clarity, which records session replays and heatmaps of how visitors interact with the site (clicks, scrolling, mouse movement) to help us find and fix usability problems. Unlike Google Analytics, Clarity's recordings are not purely aggregate — they can include the actual content rendered on a page during that session. Neither tool sees the contents of your resume or job applications as data we deliberately send to them.

2. How we use your information

• To provide the Service — building, storing, and exporting your resume; tracking job applications
• To process AI-assisted features (resume chat, ATS scoring, job matching) — see Section 3
• To process payments and manage subscriptions
• To send account-related email (verification, password reset, receipts)
• To detect and prevent abuse, fraud, and security issues
• To understand aggregate product usage so we can improve it

3. AI processing

Features like AI resume chat, ATS scoring, and job matching send relevant portions of your resume and, where applicable, a job description you provide to a third-party AI provider (our infrastructure currently supports Anthropic and OpenRouter; OpenRouter forwards requests to the underlying model host it's configured to use — currently Google, for Gemini — as part of serving that request) in order to generate a response. These providers process that content to return the result to you; we do not control their internal retention practices and you should review their own policies if you have concerns about a specific provider.

4. Who we share information with

We share information only with the service providers necessary to run Corvyx, each acting on our behalf under their own security obligations:

• Stripe — payment processing and subscription billing
• Google / GitHub — optional sign-in (only if you choose to use them)
• Resend — transactional email (verification codes, password resets)
• Cloudinary — storage for uploaded profile photos and images
• Google Analytics — aggregate, anonymized usage analytics
• Microsoft Clarity — session replay and heatmap analytics (see Section 1)
• Our AI providers (Anthropic / OpenRouter, and the underlying model host OpenRouter is configured to use) — described in Section 3
• Our hosting and database providers — infrastructure that stores and serves the Service; they do not access your data except as needed to operate that infrastructure

We do not sell your personal information, and we do not share your resume content with advertisers.

5. Data retention

We retain your account and resume data for as long as your account is active. If you delete your account, we delete your personal data within a reasonable period, except where we're required to retain records (e.g. transaction records) for legal or accounting purposes.

6. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to certain processing. You can access and edit most of your data directly in your account settings, or contact us using the details below for anything else.

7. Security

We use industry-standard practices to protect your data, including encrypted connections (HTTPS), hashed passwords, and access controls on our infrastructure. No system is perfectly secure, and we can't guarantee absolute security of information transmitted to the Service.

8. Children's privacy

Corvyx is not directed at children under 16, and we do not knowingly collect personal information from them.

8a. Browser extension

The optional Corvyx browser extension works only with a Corvyx account you connect yourself, and only on the page you are viewing when you use it. It reads the job posting or application form on that page (title, company, location, description, URL, and form field labels) and sends job details you choose to save, or a job description you ask it to score, to corvyx.app only. When you ask it to autofill, it fetches your profile data, saved answers and the resume you pick from Corvyx. It does not collect page content in the background, includes no analytics or advertising, and never submits an application on your behalf. A connection token is stored in your browser; you can revoke it at any time in Settings. AI fit scoring is processed as described in Section 3.

On the Professional and Premium plans, when you press Autofill on a job page the extension also sends that job's details and description to corvyx.app, saves the job to your Job Application Tracker (or reuses it if you already saved it), and Corvyx uses AI to prepare a tailored copy of the resume closest to the job and, on Premium, a cover letter. These are stored in your account like any other resume or document, and you can review and edit them before the extension attaches the generated PDF files to the upload fields of that application form in your browser. AI processing for these documents is described in Section 3.

If a page does not work, you can choose to tell us about it from the extension. We then receive the page address you see in the form, your note and, only if you tick the box and see a preview, a screenshot of what is visible in that tab. We use it only to improve support for that page, and nothing is sent unless you press Send report. Where the extension does not recognise a job page, you can also type the job in yourself, or select text on the page to use as its description; that text is sent only when you press a button.

9. Changes to this policy

We may update this policy from time to time. We'll update the "Last updated" date above when we do; material changes will be communicated more prominently.

10. Contact us

Questions about this policy or your data: connect@corvyx.app
Carl-von-Ossietzky.19, 65197 Wiesbaden, Germany +49 176 72369217