Privacy Policy

1. Privacy Officer

In accordance with PIPEDA's accountability principle, we have designated a Privacy Officer responsible for our compliance with this policy and applicable privacy laws.

2. Information We Collect

2.1 Information You Provide

Resume/CV Upload:

When you upload a resume or CV file (PDF or DOCX format), we process the document to extract structured career information including:

• Job titles and roles held
• Skills and competencies
• Industries and sectors of experience
• Years of experience
• Education level

Important: We do NOT store your uploaded resume file. The file is processed in-memory and immediately discarded after text extraction. We do NOT store the raw text content of your resume. We store only the structured data extracted from it (skills, industries, experience level) and a cryptographic hash (SHA-256) of the text for deduplication purposes. This hash cannot be reversed to recover your resume content.

Payment Information:

When you purchase a report or subscription, payment is processed entirely by Stripe, Inc. We never receive, process, or store your credit card number, bank account details, or other financial account information. We receive only a transaction confirmation and your email address from Stripe.

Email Address:

If you subscribe to our Weekly Digest service, we collect your email address to deliver the service.

2.2 Information Collected Automatically

Server Logs:

Our hosting provider (Vercel, Inc.) automatically collects standard server log information including IP addresses, browser type, referring URLs, and timestamps. This data is used for security, rate limiting, and infrastructure monitoring. We do not use this data for tracking or profiling.

We do NOT use:

• Tracking cookies
• Analytics cookies
• Third-party advertising pixels
• Browser fingerprinting
• Cross-site tracking technologies

If we introduce analytics or cookies in the future, we will update this policy and implement appropriate consent mechanisms before doing so.

2.3 Information We Do NOT Collect

We do not collect or process:

• Social Security Numbers, Social Insurance Numbers, or government IDs
• Date of birth or age
• Race, ethnicity, or national origin
• Religious or political beliefs
• Health or medical information
• Biometric data
• Precise geolocation
• Information about children under 16

3. How We Use Your Information

We use the information we collect for the following specific, identified purposes:

We will NOT use your personal information for any purpose not identified above without first obtaining your consent, except where required by law.

4. Third-Party Service Providers

We share your information with the following third-party service providers, strictly for the purposes described:

4.1 Anthropic (AI Processing)

• What we share: The text extracted from your resume (skills, experience, role descriptions) is sent to Anthropic's Claude API for AI-powered skill extraction and opportunity matching.
• Purpose: Generate your career analysis and match scores.
• Retention by Anthropic: Anthropic does not use API inputs to train its models. Data is processed and not retained beyond the API request lifecycle.
• Location: United States

4.2 Stripe, Inc. (Payment Processing)

• What we share: Your email address and payment amount.
• Purpose: Process payments for reports and subscriptions.
• What they collect directly: Your payment card information (collected by Stripe, never transmitted to us).
• Privacy Policy: https://stripe.com/privacy
• Location: United States

4.3 Vercel, Inc. (Hosting)

• What they collect: Server logs (IP addresses, request data).
• Purpose: Host and deliver the Service.
• Privacy Policy: https://vercel.com/legal/privacy-policy
• Location: United States (edge network globally)

4.4 Supabase, Inc. (Database)

• What we store: Extracted career profiles, match results, report data, subscription status.
• Purpose: Store and retrieve your report data.
• Privacy Policy: https://supabase.com/privacy
• Location: United States

4.5 Job Data Sources

We query the following third-party services to find matching opportunities. No personal information is sent to these services. We only send search queries based on skills and industries (e.g., “python developer government” — not your name, email, or resume).

• USAJOBS (U.S. Office of Personnel Management)
• JSearch via RapidAPI
• Adzuna
• GovBid (our own government tender database)
• Additional sources as disclosed on our website

5. Data Retention and Deletion

After the 30-day retention period, your report data is permanently deleted and cannot be recovered. We recommend downloading your report as a PDF before expiry if you wish to keep it.

6. Data Security

We implement the following technical and organizational measures to protect your personal information:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher (HTTPS).
• Encryption at rest: Database records are encrypted at rest using AES-256 encryption (provided by Supabase/AWS).
• Access controls: Database access is restricted via Row-Level Security (RLS) policies. Service keys are stored as encrypted environment variables, never in source code.
• No resume storage: Resume files are processed in-memory and never written to disk or persistent storage.
• Hashing: Resume text is hashed using SHA-256 (one-way, non-reversible) for deduplication only.
• Rate limiting: API endpoints are rate-limited to prevent abuse.
• Webhook verification: Stripe webhook signatures are cryptographically verified to prevent tampering.
• Minimal data collection: We collect only the minimum information necessary to provide the Service.

In the event of a data breach that poses a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by PIPEDA's breach notification provisions, and the appropriate US state authorities as required by applicable law.

7. Your Privacy Rights

7.1 Rights Under PIPEDA and BC PIPA (Canada)

If you are a Canadian resident, you have the right to:

• Access: Request a copy of the personal information we hold about you. We will respond within 30 days.
• Correction: Request correction of inaccurate personal information.
• Withdrawal of consent: Withdraw your consent to our processing of your personal information at any time. Note that withdrawing consent may affect our ability to provide the Service to you.
• Complaint: File a complaint with the Office of the Privacy Commissioner of Canada (www.priv.gc.ca) or the Office of the Information and Privacy Commissioner for British Columbia (www.oipc.bc.ca) if you believe your privacy rights have been violated.
• Deletion: Request deletion of your personal information. We will delete all personal information within 30 days of your request, except where retention is required by law.

7.2 Rights Under CCPA/CPRA (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act:

• Right to Know: You have the right to request that we disclose what personal information we collect, use, disclose, and sell about you.
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions.
• Right to Correct: You have the right to request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do NOT sell or share your personal information as defined by the CCPA/CPRA. We do not sell your data to third parties. We do not share your data for cross-context behavioral advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights.
• Right to Limit Use of Sensitive Personal Information: We do not collect sensitive personal information as defined by the CPRA.

Categories of Personal Information Collected (CCPA Disclosure):

• Identifiers: email address, IP address
• Professional information: job titles, skills, industries, experience (extracted from your uploaded resume)
• Commercial information: purchase history (report/subscription purchases)

Categories of Personal Information Sold or Shared:

None. We do not sell or share your personal information.

Categories of Personal Information Disclosed for a Business Purpose:

• To Anthropic: Professional information (for AI analysis)
• To Stripe: Identifiers (for payment processing)
• To Vercel/Supabase: As necessary for hosting and data storage

We will respond to verifiable consumer requests within 45 days.

7.3 Rights Under Other US State Privacy Laws

If you are a resident of Virginia, Colorado, Connecticut, or another US state with comprehensive privacy legislation, you may have similar rights to access, delete, correct, and opt out of certain processing of your personal information. Contact us to exercise these rights.

7.4 How to Exercise Your Rights

To exercise any of the rights described above, contact us at:

We will verify your identity before processing your request. For California residents, we may ask you to provide your email address and report ID to verify your identity. We do not require you to create an account to make a request.

You may also designate an authorized agent to make a request on your behalf.

8. International Data Transfers

Your personal information may be transferred to and processed in the United States, where our service providers (Anthropic, Stripe, Vercel, Supabase) are located.

For Canadian residents: We ensure that any transfer of personal information outside Canada provides a comparable level of protection through contractual obligations with our service providers.

By using the Service, you consent to the transfer of your information to the United States for the purposes described in this policy.

9. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16, we will take steps to delete such information promptly. If you believe a child has provided us with personal information, please contact us at privacy@swerv.work.

10. Do Not Sell or Share My Personal Information

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. Because we do not engage in these practices, there is no need to opt out. However, if you have questions, contact us at privacy@swerv.work.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the updated policy on this page with a revised “Last Updated” date
• Sending an email notification to active subscribers

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

12. Consent

By uploading your resume to the Service, you expressly consent to:

• The extraction and storage of your career-related information (skills, industries, experience level) for up to 30 days
• The transmission of your resume text to Anthropic's API for AI analysis
• The use of your extracted profile to search for matching opportunities

You may withdraw your consent at any time by contacting privacy@swerv.work. Upon withdrawal, we will delete your personal information within 30 days.

By subscribing to the Weekly Digest, you expressly consent to:

• Receiving weekly emails containing matched opportunities
• The retention of your email address and skill profile for the duration of your subscription

You may withdraw consent by cancelling your subscription at any time.

13. Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or our privacy practices, please contact us:

For complaints regarding our handling of your personal information:

• Canada: Office of the Privacy Commissioner of Canada — www.priv.gc.ca
• British Columbia: Office of the Information and Privacy Commissioner — www.oipc.bc.ca
• California: Office of the Attorney General — oag.ca.gov