Privacy Policy

CandidateGPT is an AI-powered job-seeker platform operated by ExpertRecruiting Inc., the data controller responsible for your personal data. You can reach us about privacy at info@expertrecruiting.com. Our business address is ExpertRecruiting Inc., Texas, United States.

This service is intended only for individuals who are 18 years of age or older. We do not knowingly collect data from anyone under 18.

We collect the following categories of personal data, all provided by you or generated by your use of the service:

• Account and identity. Your email address, and (if you sign in with Google) basic profile information such as your name and avatar from your Google account. Optionally, your first name, last name, and phone number.
• Résumés and résumé content. The résumés you upload or build, their text, and the AI-generated analyses of them. Résumés are personal data and typically contain sensitive personal information (PII) such as your contact details, work history, and education.
• Profile and job-search preferences. Your target roles, locations, skills, job-search status, and application goals.
• Optional self-identified community / affinity data. If you choose to provide it, information about communities or affinities you identify with. See section 4 below — this is entirely optional.
• Job-search activity. Jobs you save, applications you track, their status, your notes, and generated cover letters.
• Billing data. Your subscription tier, status, and billing dates. Payments are processed by Stripe; we never receive or store your full card number or other payment-instrument data.
• Usage logs. Aggregate records of AI operations performed for your account (which feature, model, token counts, and cost) used to monitor cost and reliability. These logs do not store the content of your prompts or résumés.
• Authentication cookies / tokens. Session cookies and tokens needed to keep you signed in. These are strictly necessary for the service to function.

• To provide the service: analyze and improve your résumé, match and surface relevant jobs, generate cover letters, and track your applications.
• To operate your account, authenticate you, and keep you signed in.
• To process your subscription and payments (via Stripe).
• To monitor, secure, debug, and improve the reliability and cost of the service.
• To communicate with you about your account and the service.
• To comply with legal obligations.

We do not sell your personal data.

Some communities have dedicated job boards and resources. To help surface those, you may optionally tell us about communities or affinities you identify with. This data:

• is entirely optional and provided only by you, on an opt-in basis;
• is never inferred from your résumé or any other content — we only ever use what you explicitly enter;
• is used only to surface relevant job boards and resources to you;
• is treated as sensitive personal information; and
• can be cleared or changed by you at any time in your settings.

We do not use this information to make eligibility decisions about you and we do not share it for advertising.

Your data is stored in a PostgreSQL database hosted on Supabase, and processed on our application hosting. Your résumé content is stored as text within our database (hosted on Supabase); we do not maintain a separate file-storage bucket of your uploads. Hosting region: the United States.

If you access the Service from outside the United States, your information is transferred to and processed in the United States; where required we rely on Standard Contractual Clauses with our sub-processors to safeguard these transfers.

We share data with the following service providers strictly to operate the service:

• Anthropic — AI résumé analysis and other AI features. Your résumé text and related inputs are sent to Anthropic’s API to generate analysis and content.
• Stripe — payment processing and subscription management. Stripe handles your payment-instrument data directly.
• Google — sign-in via Google OAuth, if you choose it. If you book a coaching session, we also use Google Calendar to schedule it: your name and email address are added to a calendar event on your coach’s calendar so Google can send you the invitation, any updates if the session is moved or cancelled, and a Google Meet video link.
• Supabase — database hosting and authentication.
• RapidAPI / JSearch — job-listing search. We send search terms (such as role and location derived from your preferences) to retrieve relevant public job postings.

Each provider processes data under its own terms and privacy policy. This sub-processor list is current as of the effective date above and may be updated as the Service evolves.

We use strictly necessary cookies and tokens to authenticate you and maintain your session. We do not use them for third-party advertising. We use only the essential cookies needed to keep you signed in and to secure your session. We do not use third-party advertising or cross-site tracking cookies.

We retain your data for as long as your account is active. When you delete your account, we delete your associated data as described in section 9. Certain records may be retained where required for legal, tax, or accounting reasons. We keep your account, profile, résumé, and analysis data for as long as your account is active. When you delete your account we delete that data within 30 days and purge it from encrypted backups within 90 days. Aggregate usage logs are retained for up to 24 months.

Depending on where you live, you may have rights to access, correct, export, restrict, object to, or delete your personal data. CandidateGPT provides:

• Access & export. Download a machine-readable copy of your data at any time from Settings → Privacy & your data → Download my data.
• Deletion. Permanently delete your account and associated data from Settings → Delete account.
• Correction. Update your profile information in Settings.
• Affinity data. Clear your optional self-identified community/affinity data at any time in Settings.

To exercise any other right, contact us at info@expertrecruiting.com. You may also have the right to lodge a complaint with a supervisory authority. We do not currently maintain an establishment in the EU or UK; EU and UK residents may contact info@expertrecruiting.com to exercise their rights. California residents may exercise their CCPA/CPRA rights, including access and deletion, by emailing the same address. We do not sell or share personal information as those terms are defined under California law.

We use technical and organizational measures, including row-level access controls and encryption in transit, to protect your data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

The service is for adults 18 and older. We do not knowingly collect data from anyone under 18.

We may update this policy from time to time. We will post the updated version here and revise the “Last updated” date. Material changes will be communicated as required by law.

Questions about this policy or your data: info@expertrecruiting.com. This policy is governed by the State of Texas, United States.