Privacy

Privacy notice

This notice explains what we do with your data when you use RightFit. It is written to meet Articles 13 and 14 of the GDPR. Last updated 25 October 2026.

1. Who is responsible

The controller is [legal entity name], [registered address]. Contact for anything about your data: [support email].

2. What we process

• Account and order data: your email address, the tier you bought, payment status and the currency and country of the order. Card details go to Stripe and never reach us.
• Your CV as uploaded, the text we extract from it, and the summary you correct in the intake.
• Your intake answers: functions, locations, languages, seniority and pay floors, exclusions, what you are moving toward and away from, what makes you unusual, sectors, tone, and any writing samples you choose to give.
• What we produce for you: research runs and their transcripts, reports, the tailored CVs and cover letters you generate and edit, and the feedback you give on roles (good fit, applied, interviewing and so on).
• Emails we send you and whether they were delivered. We do not track opens or clicks.
• Sign-in data held by Firebase Authentication (Google): your email, a password hash or your Google account link, and sign-in timestamps.
• Technical logs of requests to our servers (IP address, time, path) kept for security and debugging for up to 30 days.
• Free fit check on the home page: the CV you upload is read once to produce the check and is not stored. We keep your email address, the posting link, the score and a hashed IP address for 30 days, to limit abuse and so we can tell you about the full report if you ask.

3. Why, and on what legal basis

• To deliver what you bought (Art. 6(1)(b), contract): the research runs, reports, watch updates, documents and your account.
• To bill you and keep accounts (Art. 6(1)(c), legal obligation): invoices and payment records are kept as tax law requires.
• To keep the service secure and working (Art. 6(1)(f), legitimate interest): request logs, abuse prevention, error diagnosis.

We do not sell your data, do not use it for advertising, and do not use it to train models. We do not make decisions about you with legal effect; the report is research for you to act on.

4. Who else sees it (processors)

• Anthropic (Claude API): your profile, CV text and the postings we read are sent to the model to produce your report and documents. Anthropic does not train on API data. Data may be processed in the United States under the EU-US Data Privacy Framework and standard contractual clauses.
• Google Cloud (Firestore, Cloud Storage, Cloud Run, Cloud SQL, Firebase Hosting and Authentication): hosting and storage in the EU region europe-west1.
• Stripe: payments, invoices and receipts. Stripe is an independent controller for the card data it collects.
• Resend: sending our emails to you.

5. What we look at on the web

To research for you we read company careers pages and public applicant-tracking feeds, and public news about companies. We do not access LinkedIn or any site that forbids automated access, and we do not research individuals at target companies. Company names and postings we read are kept in a shared index that contains no personal data about you beyond an opaque client id.

6. How long we keep it

• Subscriptions: everything about you is deleted 30 days after your subscription ends.
• One-off report: your data is kept while you have an account so you can reopen the report and generate documents. Delete it at any time from your account page; it is removed immediately.
• Research transcripts (the agent's step-by-step log) are kept for up to 90 days for quality checks, then purged.
• Invoices and payment records are kept as long as tax law requires, typically 10 years, in anonymised form where possible.

7. Cookies and local storage

We set one cookie, __session, when you sign in. It keeps you signed in for 14 days and is strictly necessary, so no consent banner is needed. We store your email address and currency choice in your browser's local storage to prefill forms. We use no analytics, advertising or tracking cookies.

8. Your rights

You can access, export, correct and delete your data, restrict or object to processing, and take your data elsewhere. The account page has Download my data (everything we hold, as JSON) and Delete my account (immediate deletion of all records, files and your sign-in). For anything else write to [support email]; we answer within 30 days. You may also complain to the supervisory authority in your country of residence.

9. Changes

If this notice changes in a way that matters, we email account holders before the change applies. The current version is always at this address.