Privacy policy

1. Who is responsible

The controller of your personal data is CareerCraft Europe, the company behind careercraft-europe.com, based in the Netherlands. For any question about this policy or your data, write to contato@careercraft-europe.com.

2. What we collect

• Account data. Your name, e-mail address, a hashed password (or your Google account’s identifier if you sign in with Google), your plan and, if you pay, the identifier of your Stripe customer record. We never see or store card numbers.
• Uploaded career documents. The files you upload and the text we extract from them. Upload only what you are entitled to share.
• Generated documents. The CVs and cover letters we write for you, their versions and your edits, and their PDF and Word files.
• Job description texts. The job descriptions you paste or pick, kept with the documents written for them.
• Matching profile, matches and job alerts. The skills, experience, education and languages read from your documents (without your name or contact details), the match of each job, the jobs you hide and, if you turn alerts on, their settings and the jobs we sent you.
• Usage logs. Technical events such as sign-ins, generation steps, errors and the feedback you send. Logs never contain the text of your documents.
• How the site is used. Vercel Web Analytics counts visits to the public pages, without cookies. Microsoft Clarity records how pages are used (clicks, scrolling, the pages you open) so we can improve them: without cookies until you accept them in the cookie card, with cookies after. The text of your CVs, letters and uploaded files is masked in these recordings.
• Advertising measurement (Meta). The Meta pixel runs on the site’s pages for every visitor (not on the pages opened from an e-mail link). It tells Meta the address of each page you open, when you see the prices, when you start a payment and when you complete one, with the amount, together with Meta’s cookies and your browser’s details. When you start a payment and when you pay, our server also sends Meta those two events with your e-mail address and account number scrambled (hashed), your IP address, your browser and Meta’s cookies. Meta uses this to tell us which ads bring visitors and buyers, and to show our ads to people likely to be interested. The text of your documents and your profile are never sent.

3. Why we use it

• To run your account, write your documents and show your matches (contract, GDPR art. 6(1)(b)).
• To send the job alerts you turn on (consent, art. 6(1)(a)). Every alert has a one-click unsubscribe link.
• To take payment (contract, and the legal duty to keep invoices).
• To keep the service working, secure and improving (legitimate interest, art. 6(1)(f)): logs, error records, visit counts and Clarity recordings.
• To measure and improve our advertising (legitimate interest, art. 6(1)(f)): the Meta pixel and the events our server sends Meta (section 2). You can object by writing to us; a tracker blocker or your browser’s tracking protection stops the pixel.
• To send account e-mail: the confirmation of your address, sign-in links, password resets and a welcome message. No newsletters without asking first.

Your matches are scored by an AI that reads your documents and what you tell us you look for, the way a recruiter screens an application; you decide where to apply. We make no automated decisions with legal effect about you and never sell data.

4. Who processes data for us

• Vercel: hosting, region Frankfurt (EU), with Vercel Blob for uploaded and generated files and Vercel Web Analytics for visit counts.
• Neon: the database, region Frankfurt (EU).
• OpenAI: the language model that writes your documents and reads them for your matches, through the OpenAI API. Under its API terms this data is not used to train models. OpenAI processes data in the United States under the EU standard contractual clauses.
• Stripe: payments, which Stripe collects on its own checkout page; Stripe is an independent controller for the payment itself.
• Resend: sending our e-mail (address confirmation, sign-in links, password resets, job alerts).
• Microsoft Clarity: the recordings of how pages are used described in section 2.
• Meta Platforms Ireland: the advertising measurement described in section 2 (the Meta pixel and the Conversions API). Meta also uses this data as a controller for its own purposes under its terms, and may process it in the United States.

We never share your documents with employers or recruiters.

5. How long we keep it

As long as your account exists. When you delete your account from the Account page, your documents, files, applications and account data are deleted at once, and an active pass is cancelled. Payment records stay with Stripe as the law requires.

6. Your rights

You can ask for access to your data, a copy, correction or deletion, and object to how we use it. The Profile and Applications pages show what you gave us, and the Account page deletes it. For anything else, write to contato@careercraft-europe.com. You can also complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

7. Cookies

• Necessary, always on: the session cookie that keeps you signed in; cc_lang, the site’s language; cc_auth, a hint that you are signed in, so the site shows the right buttons; and cc_flash, a two-minute note after a payment that opens the welcome.
• Your cookie choice is kept in your browser’s storage, not in a cookie.
• Performance, only after you accept them: Microsoft Clarity’s cookies (such as _clck and _clsk), which link the pages of a visit and your visits over time. “Continue with necessary cookies only” leaves them off.
• Advertising, for every visitor: the Meta pixel’s cookies _fbp (your browser, 90 days) and _fbc (the ad click that brought you, 90 days), and cc_purchase, a two-minute note after a payment that lets the pixel report it. The cookie card’s choice covers Clarity only; it does not switch these off.

8. Security

Connections are encrypted, passwords are stored hashed, every query is scoped to your account, and files are kept in a private store and served only to you.

9. Changes

This policy changes as the service does; the date at the top shows the current version. See also the terms of service.