CareerFlip — Privacy notice
This notice covers data processing for careerflip.app. The sico-wide privacy notice applies in addition.
1. What data we collect
- Account data — email address, hashed password (via SuperTokens).
- CV / résumé content — a file you upload (PDF, DOCX) is virus-scanned, read and then discarded; the file itself is not kept. What we store is the employment history, education and skills extracted from it (or from a CV you paste), used solely to generate your career analysis.
- Professional profile data — current role, years of experience, target roles, skills, and preferences you enter in the app.
- Analysis outputs — skill scores, role match scores, upskill recommendations, and career pivot suggestions generated from your CV and profile. These are stored so you can return to them across sessions.
- Usage telemetry — page views and feature interactions via PostHog (EU). CV content is never sent to PostHog.
2. Legal basis
Processing is necessary to perform the contract you entered when signing up (UK GDPR Art. 6(1)(b)). CV upload and AI analysis is voluntary — you may use the app without uploading a CV, though some features will be unavailable.
3. How we use the data
Your CV and profile data is used to generate personalised career analysis via the Anthropic API. The content of your CV is sent to Anthropic as part of the analysis prompt. Anthropic does not use API inputs for model training by default (see Anthropic's privacy policy). We do not share your CV or profile data with any other third parties. To find live job listings we send job boards (Adzuna, Reed, CareerJet, The Muse, RemoteOK, Jooble) search queries built from career direction titles only — nothing from your CV or account.
4. Special category data
CVs may incidentally contain special category data (health conditions, disability disclosures, religious affiliations). We do not ask for this data, do not process it intentionally, and do not store it separately. If your CV contains such data and you wish to have it removed, email privacy@sico.software.
5. Data retention
CV-derived profile data and analysis outputs are retained while your account is active. You may delete an individual profile from the app at any time; deletion is immediate and permanent. On account deletion, all CV files, profile data, and analysis outputs are purged within 30 days.
6. Sub-processors
- Anthropic — AI career analysis. CV content is sent as part of the analysis prompt. Anthropic processes data under its standard API terms.
- Hetzner — VPS hosting; data stored in EU.
- Stripe — billing for the one-off Discover pass and the Pro subscription.
- Resend — transactional email.
- PostHog (EU) — product analytics (no CV content).
7. Contact
Privacy queries: privacy@sico.software.