01
Information we collect
We only collect what is necessary to provide the service. There are three sources:
Information you provide directly. When you sign up and use Emplirao you give us: your name and email; a password (stored only as a bcrypt hash, never in plaintext); an optional profile photo for your CV; the content you enter in the CV editor (work experience, education, skills, languages, certifications, summary); cover letters; job applications and tracker notes; saved jobs; search alerts; career goals and preferences; and any message you send us by email.
Information collected automatically. While you browse the platform we log basic technical data: IP address (used for rate limiting and abuse prevention), browser and device type, requested route, timestamps and strictly-necessary cookies (see the cookie policy). We also log minimal operational events: for example, how many times you've used an AI feature, whether an AI provider call succeeded or failed, its latency and token counts (needed to enforce plan limits and manage operational cost). We do not log the contents of your prompts in these logs.
Information from third parties. If you choose to sign in with Google, we receive your email, name and profile picture (subject to the permissions you grant on the Google consent screen). Job listings shown in Emplirao come mostly from third parties: companies' public applicant tracking systems (Greenhouse, Lever, Ashby, Workable, Recruitee, SmartRecruiters, BambooHR, Adzuna, and others) and public jobs APIs (Reed, USAJobs, France Travail, Bundesagentur, Remotive, Remote OK).
02
How we use your information
We use the information we collect to:
· Provide the service: create and manage your account, save your CVs, letters and applications, run the job search and compute matches, personalize recommendations and execute the AI features you invoke.
· Process subscriptions and charges when you choose a paid plan.
· Send transactional emails related to your account (verifications, plan changes, optional weekly digests).
· Provide support when you contact us.
· Keep the platform secure, apply rate limits, prevent fraud and audit usage.
· Comply with applicable legal obligations.
· Measure aggregate usage (without PII) to improve the product.
03
AI data processing
Emplirao offers AI-powered features — CV review, cover letter drafting, interview preparation, CV-to-job tailoring and career coach. These features require sending the necessary content to a third-party large-language-model provider. Emplirao currently uses OpenAI or Anthropic (depending on the service's configuration, controlled by the AI_PROVIDER variable).
What you should know:
· We only send the content necessary for the task (for example, your CV, the job description or your prompt). We do not send your password, private session identifiers or internal cookies.
· How the AI provider processes, retains or otherwise uses those requests (including any eventual training use) is governed by the provider's own terms and privacy policy. Emplirao does not control OpenAI's or Anthropic's internal systems; we recommend that you review their policies before submitting sensitive data.
· AI output may contain errors, inaccuracies, bias or unverified statements. You must review and validate any output before using it in real applications.
· AI is not a substitute for professional, legal, financial, medical or HR advice.
· Emplirao does not guarantee that AI features will produce any particular employment outcome (interview, offer, hire).
04
Job listings and third-party data
Job listings displayed in Emplirao come mostly from public applicant tracking systems operated by the companies themselves and from public jobs APIs. Emplirao aggregates, normalizes, deduplicates and displays that information, but we are not responsible for the accuracy, availability, freshness, stated salary or conditions of any listing. The "Apply" links typically direct you to the employer's site or the corresponding ATS platform; the handling of your data on those sites is governed by their own privacy policies.
05
Who we share information with
Emplirao does not sell your personal data. We share information with the following categories of providers, strictly to operate the service:
· Hosting and CDN — Vercel Inc. (web application and edge network).
· Database and file storage — Supabase (managed PostgreSQL database and the `cv-photos` storage bucket for CV photos).
· Authentication — Google LLC (only when you choose "Continue with Google").
· Payments and billing — Stripe, Inc. processes subscriptions and charges. Card data is entered on Stripe-hosted UI; Emplirao only stores non-sensitive identifiers (`stripeCustomerId`, `stripeSubscriptionId`, `stripePriceId`), plan and status.
· AI provider — OpenAI, L.L.C. or Anthropic, PBC (depending on the current configuration), only when you invoke an AI feature.
· Transactional email — Resend, Inc., to send product emails (verifications, weekly digests, notifications).
· Rate limiting and anti-abuse — Upstash, Inc. (Redis), for short-lived per-IP or per-user counters on sensitive endpoints.
· Legal or regulatory authorities — when required by law or to respond to lawful requests.
Each of these providers acts under its own terms and privacy policy.
06
Payment information
Subscriptions are processed by Stripe. Emplirao does not store full card numbers, CVV, PIN or raw payment credentials. We only store the identifiers Stripe returns (customer id, subscription id, price id), plan and subscription status to manage your access. Payment data is governed by Stripe's privacy policy and PCI-DSS compliance: https://stripe.com/privacy.
07
Cookies and similar technologies
We use a minimal set of strictly-necessary cookies (Auth.js session, CSRF protection) and a language-preference cookie (`NEXT_LOCALE`). We do not use advertising cookies or cross-site tracking. See the cookie policy at https://emplirao.com/cookies for the full breakdown.
08
Analytics
Emplirao does not currently load Google Analytics or equivalent scripts on the site. There is an internal layer that aggregates operational events (for example, how many times a tool has been invoked) without PII, with minimal metrics used for debugging and product prioritization. If we integrate third-party analytics in the future, we will update this policy and, where applicable law requires it, ask for your prior consent.
09
Data retention
We keep your information while your account is active and for the time necessary to provide the service, comply with legal obligations, resolve disputes, prevent fraud and enforce our agreements.
When you delete your account, we start deleting your personal data from our active systems. Some copies may remain in backup and audit logs for a limited period before being deleted according to our operational cycles. Information retained by legal, accounting or tax obligation (for example, payment records) is kept for the period required by applicable law.
Internal technical logs (AI calls, errors) are kept in aggregate form for the time necessary to operate and audit the service.
10
Security
We apply reasonable technical and organizational measures to protect your information:
· Encrypted connections in transit (HTTPS/TLS).
· Passwords stored exclusively as bcrypt hashes (not reversible).
· Signed-session authorization (JWT) and per-resource access controls: each CV, letter or application is accessible only by its owner, unless you explicitly enable the public share link for a CV (an opt-in feature you can revoke at any time).
· Elevated-privilege keys (for example, the Supabase service-role key) are used only on the server and never exposed to the browser.
· Rate limits on sensitive endpoints (sign-in, sign-up, autocomplete, click logger) to prevent abuse.
· Scheduled (cron) routes protected by a shared secret.
· Stripe webhook signature verification with an idempotency ledger to prevent duplicate processing.
No system is 100% secure. If you discover a vulnerability, please email support@emplirao.com.
11
Your rights
Subject to applicable law, you have the right to:
· Access the personal data we hold about you.
· Correct inaccurate information from your account preferences.
· Request deletion of your account and personal data.
· Request an exportable copy of your data.
· Object to or restrict certain processing, where applicable law grants you that right.
· Withdraw your consent at any time when processing is based on consent (without affecting the lawfulness of processing before withdrawal).
· File a complaint with your local data protection authority.
To exercise any of these rights, email support@emplirao.com or visit https://emplirao.com/contact. We will respond within a reasonable time and, in any case, within the deadlines required by applicable law.
12
Minors
Emplirao is not intended for users under 16. We do not knowingly collect personal data from minors under that age. If we detect an account belonging to a minor, we will delete it. If you are a parent or guardian and believe a minor has provided us with personal information, please email support@emplirao.com and we will act promptly.
13
International data transfers
Our providers (Vercel, Supabase, Stripe, OpenAI, Anthropic, Google, Resend, Upstash) may process information in countries other than yours, including the United States. When an international transfer occurs, it will be carried out under the applicable legal mechanisms required by the corresponding law (for example, standard contractual clauses or approved adequacy frameworks). You can request specific information by writing to support@emplirao.com.
14
Third-party links
Emplirao contains links to third-party sites, mostly employer sites and ATS platforms to complete applications, as well as links to our providers (Stripe, Google, etc.). Those sites have their own privacy policies and terms, and Emplirao is not responsible for their content, practices or data handling.
15
Changes to this policy
We may update this policy from time to time. The last updated date is shown at the top of the document. If we make material changes, we will notify you in advance by email or through a prominent notice inside the product before the changes take effect.
16
Contact
For any question about this policy or the processing of your personal data, email support@emplirao.com or visit https://emplirao.com/contact. The identity of the legal entity operating Emplirao and its jurisdiction is detailed in the Terms & Conditions.