Privacy policy
Effective 2026-11-10
Short version: we use your resume only to help you with it. We don't sell or share your data for advertising, we don't train AI on it, and you can delete everything from the app at any time.
Who we are
Cited Careers is operated by MYRSK DEVELOPMENT OÜ, Tiigi 84, Tartu, Estonia (“we”). Contact: admin@myrskdevelopment.com. We decide how your personal data is used (we are the “controller” or “business”).
What we collect, why, and how long we keep it
| Data | Why | Kept |
|---|---|---|
| Email address and login provider. If you sign in with Google or LinkedIn, we receive your name, email and profile picture from them, and nothing else (no contacts, posts or connections). | To log you in and contact you about your account and billing | Until you delete your account |
| Resume text, profile, interview answers, pasted job postings and program descriptions, your questions about suggested edits, saved versions | To provide the service and let you come back to your work | Until you delete them or your account |
| Voice answers (audio) | To turn your spoken answer into text | Not stored by us. Sent to the transcription provider and discarded after transcription. We keep only the text. |
| Plan, plan end date, Stripe customer ID, consent record for purchases | To give you what you paid for and prove you agreed to the purchase terms | Until you delete your account; Stripe keeps payment records as tax law requires |
| Daily usage counts | To apply plan limits | Until you delete your account |
| One-way hash of your IP address (no account) | To allow one free check a day and prevent abuse | Deleted after one day. We never store the raw IP address. |
| Page views (cookieless, aggregated) | To see which pages work | Aggregated statistics only |
We don't ask for and don't need sensitive data such as health, religion, government ID numbers or date of birth. Please leave it out of your resume. We don't collect your card number (Stripe does) and we don't buy data about you.
AI processing
- To analyze your resume we send its text to AI providers (Anthropic and OpenAI) through their business APIs. Before any scoring call we strip your name and contact details.
- Under their API terms, these providers don't use your data to train their models. They may keep it for a limited period to monitor for abuse, then delete it. We don't train models on your data either.
- Photos and scanned resumes: we send the image to the AI provider only to read its text, and we don't store the image. We keep the text, like any other resume.
- Voice: we use speech-to-text only. We don't use speaker identification or voice recognition, and we don't create or keep voiceprints or any other biometric identifier.
- AI output only gives you suggestions. We don't use it to make decisions about you, and we don't share it with employers.
Who we share data with
Only the service providers that run Cited Careers, under contracts that limit them to processing data on our behalf: hosting and analytics (Vercel), database and login (Supabase), payments (Stripe), and AI and transcription (Anthropic and OpenAI). If you click “Edit in Overleaf”, your resume is sent to Overleaf, a separate service with its own privacy policy, at your request. We may also disclose data if the law requires it, or to a successor if the service is transferred (we'd tell you first).
We don't sell your personal information and we don't share it for cross-context behavioral advertising, as those terms are defined in California law. We don't use advertising cookies or trackers.
Cookies and Do Not Track
We use only cookies that are needed to keep you logged in. Our analytics don't use cookies. Because we don't track you across sites, we treat Do Not Track and Global Privacy Control signals as already honored: there is nothing further to switch off.
Your rights
- Delete: “Delete account” in the app removes your account, resumes, answers, versions and usage counts immediately.
- Access, correct, export: view and edit everything in the app, or email us for a copy.
- US state rights: residents of California and other states with privacy laws can request access, correction, deletion and a copy of their data, and opt out of sale, sharing or targeted advertising (we do none of these). We won't treat you differently for using your rights. You can use an authorized agent; we may need to verify your identity. If we deny a request, you can appeal by replying to our answer.
- GDPR: because we're established in the EU, you also have the rights of access, rectification, erasure, restriction, portability and objection, and you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee). Our legal bases are: performing our contract with you (providing the service), legitimate interests (preventing abuse, security, simple analytics) and legal obligations (tax records).
To use any right, use the app or email admin@myrskdevelopment.com. We reply within 30 days at most.
Where data is processed
Our providers process data in the United States and other countries. Transfers out of the EU rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses.
Security
Data is encrypted in transit and at rest by our providers. Database access is restricted per user. Payment details never touch our servers. No system is perfectly secure; if a breach affects your data, we'll notify you as the law requires.
Children
Cited Careers is for people 13 and older; under 18 with a parent or guardian's permission. We don't knowingly collect data from children under 13. If you believe a child under 13 has given us data, email us and we'll delete it. We don't sell anyone's data or use it for advertising, and we treat data from users under 18 the same way: used only to provide the service.
Changes to this policy
We'll post any change here with a new effective date, and email you before material changes take effect.