Privacy Policy

1. Who We Are

CareerLah ("we", "us", "our") is a free AI-powered career platform designed to help job seekers evaluate role fit, discover matching careers, analyse their resume, generate application documents, track job applications, and map their career personality using the RIASEC framework.

This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our Service at careerlah.app (or any subdomain or locally-hosted instance).

By using CareerLah, you agree to the practices described in this policy. If you do not agree, please discontinue use.

2. What Data We Collect

2a. Data you provide directly

• Account information (email sign-up): Your full name, email address, and a bcrypt-hashed version of your password. Your plain-text password is never stored or logged.
• Account information (Google sign-in): Your Google account ID, full name, email address, and profile picture URL, obtained from Google OAuth. We do not receive or store your Google password.
• Saved career profile: The free-text description of your background, skills, and experience that you write and choose to save on your Profile page. This is entirely optional.
• Resume text: When you upload a PDF or Word resume for analysis, the text is extracted and sent to the AI for processing. We do not permanently store the original file or the extracted text — it is used only for the duration of your session request and discarded immediately after.
• Job descriptions: Text or URLs you paste into the Job Fit Analyser. The text is sent to the AI and a hash of the description is stored to enable caching of repeat queries. The raw text itself is not stored beyond the AI call.
• Discovery inputs: Your experience level, interests/keywords, and profile snippet entered into the Career Discovery tool. A snippet (up to 150 characters) of your profile is stored as part of your discovery history.
• Job application data: Company name, role title, job URL, location, application status, applied date, and notes that you manually enter into the Job Tracker.
• Job application timeline events: Event type (e.g. "Interview", "Offer"), title, scheduled date, and optional notes for each event you log under a tracked application.

2b. Data generated by your use of the Service

• Job Fit analysis results: For each Job Fit analysis you run while logged in, we store the job title/URL, a hash of the job description, the AI-generated fit score, skills gap, action plan, and the timestamp.
• Career Discovery history: The 6 AI-suggested roles with target companies, your experience level, interests, profile snippet, and the timestamp of each discovery run.
• RIASEC career personality scores: Your six Holland Code scores (Realistic, Investigative, Artistic, Social, Enterprising, Conventional) and the timestamp of your last quiz completion.

2c. Technical data

• Server logs: Standard web server logs may record your IP address, browser type, operating system, referring URL, and pages accessed. These are used for security monitoring and diagnosing errors, and are not linked to your user profile for analytics purposes.
• Session data: An encrypted session cookie is used to keep you logged in between page loads. It contains only a session identifier — no personal data.

2d. What we do NOT collect

• We do not store original resume files (PDF or Word) — only transiently extracted text during a session
• We do not store generated resume or cover letter documents — they are produced on demand and downloaded directly to your device
• We do not collect payment information — CareerLah is free
• We do not use advertising trackers, third-party analytics SDKs, or fingerprinting scripts
• We do not read your clipboard, monitor your keystrokes, or access any data beyond what you explicitly submit to the Service

3. How We Collect It

• Directly from you: When you register, fill in forms, upload a resume, run an analysis, or add a job application
• Via Google OAuth: When you choose "Sign in with Google", Google provides your name, email, and profile picture to our server
• Automatically: Session cookies and server logs are generated automatically as part of normal web operation
• Via your browser (localStorage): Your RIASEC quiz results are cached in your browser's localStorage for faster loading — see Section 7

4. Why We Use Your Data

We do not use your data for advertising, profiling for third parties, or any purpose not listed above.

5. How Long We Keep It

We retain your data for as long as your account is active. Specifically:

• Account data — kept until you delete your account
• Analysis & discovery history — kept until you delete individual entries or delete your account
• RIASEC scores — kept until you retake the quiz (replacing the old scores) or delete your account
• Job applications & events — kept until you delete individual entries or delete your account
• Server logs — typically retained for up to 30 days for security purposes, then purged

Account deletion

You can permanently delete your account at any time from your Profile page. Upon deletion, we immediately and irreversibly remove all of the following from our database:

• Your user record (name, email, hashed password or Google ID, profile picture URL)
• Your saved career profile
• All Job Fit analysis history records
• All Career Discovery history records
• Your RIASEC personality scores
• All job applications and associated timeline events

Note: Your browser's localStorage cache (RIASEC scores) is stored on your device and is not automatically cleared when you delete your account. You can remove it manually via your browser's developer tools or settings (clear site data for this domain).

6. Who We Share Your Data With

We share data with the following third-party processors only to the extent necessary to operate the Service:

OpenAI

When you run any AI-powered feature (Job Fit analysis, Resume Review, Career Discovery, Cover Letter generation, Resume generation), your career profile text, resume text, and/or job description text is sent to OpenAI's API servers to generate the AI response.

• We send only the text content required to generate the result — not your name, email, or account ID
• OpenAI may process and temporarily retain inputs according to their API data usage policy
• OpenAI's Privacy Policy and Usage Policy apply

Supabase

All server-side user data is stored in a PostgreSQL database managed by Supabase, hosted on AWS infrastructure.

• Data is encrypted at rest and in transit (TLS)
• Supabase acts as a data processor on our behalf and does not use your data for its own purposes
• Supabase's Privacy Policy applies

Google (OAuth only)

If you choose to sign in with Google, Google's authentication service handles your login. We receive only your name, email, and profile picture URL from Google.

• We do not share any of your CareerLah data back to Google
• Google's Privacy Policy applies

Legal disclosure

We may disclose your data if required to do so by law, court order, or legitimate government authority, and only to the minimum extent required.

7. Cookies & Local Storage

Session cookie

We use a single session cookie to keep you logged in. It contains only an encrypted session ID — no personal data. It expires when you close your browser or after a reasonable inactivity period. This cookie is:

• Marked HttpOnly (inaccessible to JavaScript)
• Marked SameSite=Lax (protects against cross-site request forgery)
• Marked Secure when the app runs over HTTPS

We do not use advertising cookies, tracking cookies, or any third-party cookie scripts.

localStorage (browser storage)

Your RIASEC quiz scores are cached in your browser's localStorage under a CareerLah-specific key. This is stored entirely on your device and is used only to display your career profile results instantly without a server round-trip. It is:

• Not transmitted to any server unless you are logged in (in which case the server copy is the authoritative source)
• Cleared automatically when you retake the quiz
• Clearable manually via your browser's "Clear site data" or developer tools

We do not use localStorage for any other purpose.

8. Your Rights

You have the following rights over your personal data:

• Access: You can view all data associated with your account (profile, history, quiz scores, job tracker) directly within the app at any time.
• Correction: You can update your name and career profile from the Profile page. Email changes can be requested via the feedback option in the app.
• Deletion: You can delete individual history entries, job applications, or your entire account (and all associated data) from the Profile page.
• Portability: Your discovery results can be exported as PDF from within the app. For a full data export, contact us via the feedback option.
• Restriction / Objection: If you wish to restrict how we process your data or object to a specific use, contact us via the feedback option. We will respond within a reasonable timeframe.

If you are located in the European Economic Area (EEA), the UK, or Singapore, you may have additional rights under GDPR, UK GDPR, or the Personal Data Protection Act (PDPA) respectively. We aim to honour these rights regardless of your location.

9. Children's Privacy

CareerLah is intended for users who are at least 16 years of age. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has created an account, please contact us and we will promptly delete the account and associated data.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the Service, our data practices, or applicable law. When we do, we will update the "Last updated" date at the top of this page and bump the version number.

For material changes — such as collecting a new category of personal data or sharing data with a new third party — we will make reasonable efforts to notify registered users before the changes take effect.

Continued use of CareerLah after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.

11. Contact

If you have questions, concerns, or requests relating to this Privacy Policy or your personal data, please reach out through the feedback option available within the app.

We take privacy concerns seriously and will respond within a reasonable timeframe.

You may also refer to our Terms & Conditions for related information about your rights and obligations when using CareerLah.