Privacy Policy

• Account identifiers from Supabase Auth, such as user ID and email address.
• Profile fields the user enters or imports during onboarding and settings.
• Onboarding answers, interview records, interview messages, progress snapshots, and acknowledgment records.
• Uploaded CV metadata and private storage paths when a user uploads a CV.

• Authenticated app routes are protected by server middleware that confirms the Supabase session.
• User-owned database tables use Row Level Security policies scoped to the current authenticated user.
• CV files are stored in a private Supabase Storage bucket under user-specific paths and viewed with short-lived signed URLs.
• Service-role operations, such as account deletion, are implemented only in server-side API routes.

The current code uses Supabase for authentication, database, and storage. Provider and international transfer details should be confirmed by the business owner before publication.

The app includes retention metadata fields. Final retention durations should be defined by the business owner and reflected in operational policy.

Authenticated users can download their data, withdraw optional consent, delete uploaded CVs, delete interview history, sign out, and request account deletion from Data & Privacy Settings.