Privacy Policy

1. Information we collect

We collect information you provide, information generated when you use a feature, technical information from your device and information returned by services you direct us to use. Some information is needed for an account or feature; other information is optional.

• Account and contact details: name, verified email, sign-in identifiers, profile image, professional links, phone or address you choose to provide, settings and support history.
• Career materials and preferences: resumes, cover letters, work and education history, skills, projects, stories, achievements, job preferences, compensation context, work authorization, sponsorship answers, photos and generated materials.
• Applications and messages: selected jobs and employers, form questions and options, answers, documents, saved choices, review settings, status, submission evidence, messages, recipients, attachments and delivery records.
• Sensitive information you choose to provide:disability or health information, race or ethnicity, gender, veteran status and other protected answers. We do not infer these details from your name, photo, voice, location or career history.
• AI and practice content: prompts, conversations, interview or drill answers, transcripts, feedback, microphone audio used by a voice feature and source or edited photos.
• Employer-account access: dedicated application passwords, encrypted saved copies, cookies, session references and verification or recovery messages when you authorize those steps.
• Purchases: billing-customer and transaction identifiers, subscriptions, entitlements, credit balances, refunds, cancellation records and receipt-verification information. Payment operators collect the card details required for checkout.
• Location and technical information: places you enter, approximate location from requests, precise coordinates only when you choose a location feature and grant permission, IP address, device and browser details, app version, push token, events, performance information, errors and security logs.
• Public and connected information: job listings, company and professional information returned by search providers, and public profile data from integrations you choose, such as a GitHub contribution calendar.

Do not send passwords, authentication codes, full payment-card details or unnecessary identity documents to support, prompts or feedback. Use the designated authentication flow for employer accounts and provide other people's private information only when you have authority to share it.

2. How and why we use information

We use relevant information to authenticate you, provide and personalize career tools, prepare documents and feedback, carry out authorized applications and communications, publish a professional page when you choose, manage purchases, deliver notifications, provide support, troubleshoot and correct failures, prevent abuse, secure the service and meet legal obligations.

Where EEA or UK law requires a legal basis, we rely on contract for information objectively needed to provide requested services, including core AI processing; we collect any explicit authorization required for third-party AI sharing in the signup flow; consent for optional analytics, recordings and sensitive answers where required; legitimate interests for proportionate security, fraud prevention, support and reliability; and legal obligations for accounting, transaction, privacy and lawful-request records. This policy does not replace a separate permission shown for a feature.

We may compare career information and preferences with job requirements to rank opportunities and provide recommendations or practice feedback. CareerMax does not decide whether an employer hires you; employers make their own decisions under their own notices.

3. Providers and recipients

A provider receives information relevant to its function, not necessarily everything in your account. We require providers that process information for us to follow their service agreement and applicable restrictions. Some services, sellers and employers act independently under their own notices.

An authorized application sends relevant information to the selected employer and its ATS. This can happen during account creation, validation, autosave or uploads before final submission. Employers, correspondents and visitors to a page you publish may retain copies under their own responsibilities. We may also disclose relevant information to advisers, authorities or a successor in a lawful investigation, claim, business transfer or compliance process.

4. AI processing, sensitive information and media

AI assistance is part of the core CareerMax service you request. Before account use that requires sharing personal information with third-party AI, our signup agreement discloses the required processing and records your express acceptance. The providers and relevant information are listed above. AI-dependent tools cannot work without the required processing. You can stop using those services or contact hey@careermax.ai to exercise applicable privacy rights or request deletion. Stopping use or making a request does not automatically delete stored information or recall information already sent.

CareerMax does not use private resumes, answers, stories, messages, photos or practice recordings to train or fine-tune AI models through its engaged business or API services. Provider retention varies by service, contract and configuration; authorized records can remain for delivery, security, abuse prevention, backup or legal purposes. We do not promise zero retention by every provider.

You choose whether to supply optional demographic or health answers. We explain the purpose and recipients and obtain additional permission where required. We do not infer protected answers or quietly reuse them outside the scope you authorize. The Consumer Health Data Privacy Notice supplements this policy for covered health information.

Voice features process microphone audio, transcripts or generated speech through the providers described above. We identify active use and provide a stop control. Browser speech services can have their own terms and retention. Record another person only with the necessary authority and permission. Professional-photo editing uses the photo and instructions you select; it is not a biometric-identification database.

5. Diagnostics, analytics and recordings

We use operational records to operate the service, verify authorized application workflows, diagnose errors, investigate support requests, test fixes, assess reliability, prevent abuse and resolve disputes. Optional website analytics begins only after the applicable choice described in Cookie and analytics choices.

Kernel may capture the remote application browser, including visible forms, documents, answers, navigation and results, within the scope of the workflow. Necessary execution evidence and optional recordings are different from website measurement and practice media. Capture is not a recording of your entire device and does not authorize unrelated apps. We use exclusions and masking for passwords, authentication codes, secret tokens and unrelated sensitive information, but no system is perfect.

We obtain express permission before consent-dependent capture and provide the applicable indication and controls. Optional website replay or analytics can be declined without disabling unrelated career tools. Records are not sold to advertisers or used to train AI model weights. We do not currently enable website session replay.

6. Sponsored jobs and marketing

Where offered, placements paid for by sponsors are labeled Sponsored or Ad. We may use non-sensitive job-search preferences, broad location and interactions within CareerMax to select and measure placements. Payment may affect visibility or order. We do not use health, disability, demographic answers, private messages, photos, recordings or credentials to target sponsored placements, and we do not sell personal information or share it for cross-context behavioral advertising.

You can object to direct marketing at hey@careermax.ai or through an available preference control. Service, security, receipt and requested-support messages remain separate.

7. Cookies, device controls and analytics choices

Essential cookies, local storage and identifiers support authentication, security, preferences and requested services. On the CareerMax website, optional PostHog measurement is off until you choose Allow analytics. When you allow it and are signed in, measurement can be linked to your CareerMax account. The website banner and the Analytics preferences control let you choose Reject optional or change the choice later. You can also use the control shown at the top of this page. Native app measurement covers product interactions and reliability, can be linked to your signed-in account, and excludes private career content. Contact us to exercise applicable privacy rights or ask questions about this processing.

An analytics choice does not cancel AI or application instructions, delete earlier records or change essential account and security processing. Device settings control microphone, camera, location and push permissions. Notifications can reveal job or employer details on a lock screen according to your device preview settings.

8. Retention and account deletion

We retain account, career, application, email and practice information while your account is active or until you remove it, subject to the purpose for which it is needed and limited lawful exceptions. Public pages remain available while you publish them; unpublishing cannot remove independent copies. Credentials and browser access remain while authorized and needed, and revocation or deletion starts cleanup of resources we control.

Raw diagnostics and replays may be retained as needed to verify execution, diagnose a failure, investigate a support matter, address security or abuse, or resolve a legal claim. Provider and configured operational retention cycles can differ. Relevant extracts can be held for an unresolved support matter, security incident or legal claim until that purpose ends. Purchase, tax, acceptance, dispute and necessary security records can be retained for applicable legal periods. Backups and provider copies follow restricted service-retention cycles; deleted information is not restored to ordinary use merely because a backup exists.

In the web app, open Settings → Account → Delete accountand confirm. You can request deletion without waiting for a subscription to expire. Deletion removes access and starts removal of profile, private career content, applications, answers, inbox, practice history, public page and credentials we control. It does not cancel an Apple subscription, delete an employer account, erase an employer's copy or recall a delivered message. Save important documents and correspondence first.

9. Security and international processing

We use authenticated access, access restrictions, protected transmission and dedicated encryption for saved application passwords. Access is limited to personnel and providers who need it for operations, support, diagnostics, security, legal or requested service purposes. No system is completely secure.

Information may be processed in the United States and other countries where our providers operate, and accessed by authorized personnel in the United Arab Emirates. Where required, transfers use an applicable adequacy arrangement or appropriate safeguards. Contact us for information about relevant safeguards, subject to necessary redactions.

10. Your choices and rights

Contact hey@careermax.ai for access, correction, a copy or export, deletion, restriction, objection, withdrawal of consent or a privacy complaint. People without an account can also contact us about information concerning them. We may verify identity or an agent's authority in a proportionate way.

Where processing relies on consent, you can withdraw it through the relevant control or by contacting us. Withdrawal does not make earlier lawful processing unlawful and does not recall information already sent. Stopping necessary AI processing makes dependent tools unavailable; optional analytics, replay, marketing and protected answers have separate choices.

Where applicable law provides rights, they can include access, correction, deletion, portability, restriction, objection, appeal and protections concerning certain automated decisions. We respond within applicable deadlines and explain a permitted extension or refusal. You may complain to a competent privacy authority without first obtaining our permission. We honor legally applicable opt-out signals for the processing they cover.

11. Adults and policy changes

CareerMax is intended for people 18 or older. We do not knowingly permit children's accounts. Contact us about suspected collection from a child so we can investigate. Do not upload unnecessary information about children into an adult account.

We update this policy when practices, providers or legal requirements change. The date identifies the current revision. We provide appropriate notice of material changes and obtain new permission where required; a policy update alone does not authorize an incompatible new use.