Privacy Policy
Last updated: July 11, 2026
Job SuitUp helps you tailor your resume to job postings and track your applications. Doing that well means handling personal data — including the contents of your resume — and we take that seriously. This policy explains, in plain language, what we collect, why, who processes it on our behalf, and the rights you have under the EU General Data Protection Regulation (GDPR).
1. Who is responsible for your data
The data controller is Quantica Studio, which operates Job SuitUp. For any privacy request or question, contact nicsi.production@gmail.com. We respond to requests within 30 days as required by GDPR Article 12.
2. What we collect and why
| Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Account data — name, email address, sign-in provider (Google or email/password) | Creating and securing your account | Contract (Art. 6(1)(b)) |
| Resume content — the files you upload and the structured profile extracted from them (work history, education, skills, contact details, and anything else your resume contains) | The core service: analysis, tailoring, templates, PDF export | Contract (Art. 6(1)(b)) |
| Job data — job descriptions you paste, application status, notes, contacts | Your job tracker and per-job tailoring | Contract (Art. 6(1)(b)) |
| AI conversations — messages you exchange with the tailoring and interview assistants | Providing the assistant features and keeping your history available to you | Contract (Art. 6(1)(b)) |
| Onboarding survey answers — how you found us, your situation, field, main challenge | Understanding our users and improving the product | Legitimate interest (Art. 6(1)(f)); answering is optional |
| Feedback and NPS responses | Improving the product | Legitimate interest (Art. 6(1)(f)); always voluntary |
| Usage analytics — feature events, pages viewed, approximate device info | Understanding which features work and where users get stuck | Consent (Art. 6(1)(a)) — nothing is sent unless you accept analytics, and you can withdraw at any time in Settings |
| Technical data — rate-limit counters, security logs | Preventing abuse and keeping the service available | Legitimate interest (Art. 6(1)(f)) |
We practice data minimization: we don't collect anything beyond the list above, we don't sell personal data, and we don't show ads.
3. AI processing
When you use analysis, tailoring, cover letters, or interview prep, the relevant resume and job text is sent to Anthropic(the maker of Claude) to generate the result, under a data processing agreement. Per Anthropic's API terms, your data is not used to train their models. AI suggestions are exactly that — suggestions: every edit is shown to you for approval and you decide what to accept. We make no automated decisions about you that have legal or similarly significant effects (GDPR Art. 22).
4. Who processes data on our behalf
| Processor | What for | Location / transfer safeguard |
|---|---|---|
| Google Firebase / Google Cloud | Authentication, database, file storage | EU–US Data Privacy Framework + SCCs |
| Vercel | Application hosting | EU–US Data Privacy Framework + SCCs |
| Anthropic | AI processing (see section 3) | SCCs; no training on API data |
| Mixpanel (only with your consent) | Product analytics | EU data residency — analytics data is stored in the EU |
| Google Analytics (only with your consent) | Marketing analytics | EU–US Data Privacy Framework |
5. Cookies and local storage
- Session cookie (
tailorcv_session) — strictly necessary to keep you signed in. HttpOnly, no consent required. - Preferences— your theme choice and your analytics consent decision are kept in your browser's local storage. Strictly necessary.
- Analytics identifiers — set only after you accept analytics in the consent banner. Declining (or never answering) means no analytics run at all.
6. How long we keep data
- Account, resume, job and conversation data: for as long as your account exists.
- When you delete your account (Settings → Privacy & data), all of the above — including uploaded files, feedback you submitted, and your sign-in record — is deleted immediately and permanently. Residual copies in encrypted backups expire within 30 days.
- Analytics data follows Mixpanel's retention and is deleted on request.
7. Your rights
Under GDPR Articles 15–21 you can, at any time and free of charge:
- Access & portability— download everything we hold about you as a machine-readable JSON file: Settings → Privacy & data → "Download my data".
- Rectification — every piece of your data (resume, jobs, notes) is directly editable in the app.
- Erasure — delete individual jobs/resumes in the app, or your entire account in Settings. No email required, no waiting period.
- Withdraw consent — toggle analytics off in Settings; it takes effect immediately.
- Restriction & objection — contact nicsi.production@gmail.com.
- Complain — you can lodge a complaint with your local data protection authority (in Italy, the Garante per la Protezione dei Dati Personali).
8. Security
Data is encrypted in transit (TLS) and at rest. Access is restricted per-user by database security rules that are tested against tampering attempts; AI keys and processing live exclusively on our servers, never in your browser.
9. Children
Job SuitUp is a career tool and is not directed at children. You must be at least 16 to use it.
10. Changes
If we materially change this policy, we'll update the date at the top and notify you in the app before the change applies.