Privacy Policy

We collect the following categories of personal data: Account Information: Your name, email address, and password when you register. Profile & CV Data: Information you provide in your profile, including your CV, work history, education, skills, salary expectations, and job preferences. Usage Data: Information about how you use the Service, including pages visited, features used, job searches performed, and applications submitted. Device & Technical Data: Your IP address, browser type and version, device identifiers, operating system, and referral source. Communication Data: Records of your communications with us, including support queries. Coaching Session Data: If you book a career coaching session, the transcript of that session and the insights we derive from it. This is only collected with your explicit consent, and is described in full in Career Coaching Sessions & Transcripts below. Payment Data: If you subscribe to a paid plan, payment is processed by our third-party provider (Stripe). We store only a tokenised reference and the last four digits of your payment card; we never store full card details. We collect this data when you register, use the Service, correspond with us, or when you grant us permission to access third-party accounts (e.g., LinkedIn).

We use your personal data to: • Provide and improve the CareerAI Service, including AI job matching, resume optimisation, and auto-apply features. • Create and manage your account. • Process subscription payments. • Send you transactional emails (e.g., application confirmations, account notifications). • Send you marketing communications where you have given consent or we have a legitimate interest. • Analyse usage to improve our AI models and Service quality. • Comply with legal obligations and enforce our Terms of Service. • Prevent fraud and ensure the security of the Service. Our legal bases for processing are: performance of a contract (providing the Service), legitimate interests (improving the Service), compliance with legal obligations, and your consent (where applicable).

We use cookies and similar tracking technologies to: Essential Cookies: Enable core functionality (authentication, session management). These cannot be disabled. Analytics Cookies: Help us understand how users interact with the Service. We use Google Analytics 4, which records the pages you visit, the features you use, and the device and approximate location you use them from, so we can see what works and what does not. These are only set with your consent. Marketing Cookies: Allow us to measure our advertising and serve relevant advertisements. Only set with your consent. Google Analytics runs in consent mode. Before you make a choice, and if you decline, it is loaded without cookies and without any identifier for you or your device, and Google is instructed not to use the data for advertising. Nothing is shared with Google, and no advertising or third-party cookie is set, until you accept. Referral Cookie: We set one first-party cookie, ca_attribution, on your first visit. It records only how you arrived - the campaign parameters in the link you followed, the site that referred you, the page you landed on, and your approximate country. It holds no name, email address, account identifier, or advertising identifier, is never shared with anyone else, and expires after 30 days. If you create an account, we attach it to your account so we know which of our own channels reached you, and the cookie is then discarded. This is the only way we can tell whether our marketing works at all, and it is used for nothing else. If you are signed in, we attach your account identifier to analytics events once you have accepted analytics cookies, so we can tell one person using two devices from two people. That identifier is a random string; we never send your name, email address, CV, or any content you create to Google. You can manage cookie preferences via the cookie banner shown on your first visit, or at any time through your browser settings. Disabling certain cookies may affect the functionality of the Service.

If you book a 1:1 career coaching session, that session takes place over a video meeting that is transcribed. This section explains exactly what that means. What we collect: a written transcript of the session, with turns attributed to you or to your coach; the times each of you joined and left; your intake questionnaire answers; any notes your coach writes; and structured insights we derive from the transcript (your stated goals, target roles, constraints, skills to develop). Consent: transcription is explained at the point of booking and requires your explicit agreement. Your coach agrees separately when they join the platform. Google Meet also displays its own persistent notice to everyone in the call while transcription is running. Declining is always an option. If you do not consent, the session still goes ahead - it simply is not transcribed, and no transcript or insights are produced. Declining never blocks a booking. How we use it: to show you a summary and action items after the session, and to improve the job matches and interview preparation we produce for you. You can switch this off at any time, either for a single session or for your whole account, and switching it off is retroactive - past sessions stop informing your matches too. We do not use your coaching transcripts to train AI models. If that ever changes, we will ask for your consent separately and specifically. Sub-processors: sessions run on Google Workspace (Google Meet), which acts as a processor for the meeting and its transcript. The transcript is also processed by our AI provider to produce the insights described above. Retention: the copy of the transcript held by the meeting provider is deleted 30 days after the session. The written transcript and the insights we derive from it are kept for the lifetime of your account, and are deleted when your account is deleted, along with the meeting records and calendar entries. Your coach can see your intake answers and their own notes. Coaches do not have access to your payment data or to your account beyond the sessions they run with you.

We retain your personal data for as long as necessary to provide the Service and for legitimate business purposes: • Account data is retained for the duration of your account and for 90 days after deletion (to allow recovery of inadvertent deletions). • CV and profile data is deleted when your account is deleted. • Usage logs are retained for 13 months. • Payment records are retained for 7 years to comply with UK financial regulations. • Coaching session recordings held by the meeting provider are deleted after 30 days; the written transcript and session insights are deleted with your account (see Career Coaching Sessions above). You can request deletion of your account and personal data at any time (see GDPR Rights below).

If you are based in the UK or European Economic Area, you have the following rights under GDPR and UK GDPR: Right of Access: Request a copy of the personal data we hold about you. Right to Rectification: Request correction of inaccurate or incomplete personal data. Right to Erasure: Request deletion of your personal data ("right to be forgotten"), subject to certain exceptions. Right to Restrict Processing: Request that we limit how we use your personal data. Right to Data Portability: Receive your personal data in a structured, machine-readable format. Right to Object: Object to processing based on legitimate interests or for direct marketing purposes. Right to Withdraw Consent: Where processing is based on consent, withdraw that consent at any time. To exercise any of these rights, contact us at privacy@careerai.io. We will respond within 30 days. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Data Protection Officer: CareerAI Limited Data Protection Officer Email: privacy@careerai.io Address: 1 Harbour Exchange Square, London, E14 9GE, United Kingdom This Privacy Policy was last updated on 10 August 2026.