This Privacy Policy explains how Huntfolio(“Huntfolio”, “we”) processes personal data of users in the European Economic Area (EEA), the UK, and Switzerland, in accordance with the EU General Data Protection Regulation (GDPR). For the purposes of the GDPR, Huntfolio is the data controller of the personal data described below.
1. What data we collect
- Account data — your name, email address, and a hashed password (or a Google/GitHub identifier if you sign in with those providers).
- Profile & career data — everything you add to your Master Profile: work experience, education, skills, projects, achievements, certifications, and any resume/portfolio content you create.
- Uploaded documents — resumes (PDF, Word, ODT, RTF or text) you import, which we parse into structured profile data.
- Job-hunt data — applications you track, companies/contacts, cover letters, and skill-gap notes.
- Referral data — if you use the referral marketplace: non-identifying search facets (skills, seniority, target roles), and for referrers, a company email used for verification. Your contact details are never shared without your explicit consent.
- Usage & technical data — AI feature usage and token counts, and standard server logs.
- Security & authentication logs — sign-in attempts (success and failure), including your IP address and browser/device user-agent, used to protect your account against unauthorised access and abuse. We never log passwords.
2. How we use it, and our legal bases
- To provide the service (build resumes/portfolios, track applications, publishing) — legal basis: performance of a contract (Art. 6(1)(b)).
- AI features (tailoring, ATS checks, summaries, cover letters, skill suggestions) — legal basis: performance of a contract and, where applicable, your consent.
- Referral matching & revealing your contact details — legal basis: your explicit consent (Art. 6(1)(a)), which you can withdraw at any time.
- Security, abuse prevention, and rate limiting — legal basis: our legitimate interests (Art. 6(1)(f)).
- Transactional email (password reset, verification) — legal basis: performance of a contract.
3. Where your data is stored & who processes it
Your data is stored in a PostgreSQL database hosted on Railway. We share the minimum necessary data with the following sub-processors, each under contractual data-protection terms. Transfers outside the EEA rely on Standard Contractual Clauses or an equivalent safeguard.
- Railway — Application hosting + PostgreSQL database (all core account, profile, resume, portfolio, referral, and usage data) (United States / EU regions).
- Google (Gemini API) — AI features: resume parsing, tailoring, ATS checks, summaries, cover letters, skill suggestions (United States).
- Cloudinary — Optional image uploads (profile photos, portfolio media) (United States / EU).
- Resend — Transactional email (password reset, referral verification) (United States).
- GitHub / Vercel / Netlify — Optional portfolio publishing to the destination you choose (United States).
We do not sell your personal data, and we do not use it to train third-party AI models beyond what is necessary to return your result for the request you made.
4. How long we keep it
We keep your account and profile data for as long as your account is active. When you delete your account, we delete your personal data (cascading across resumes, portfolios, applications, and referral records), except where we must retain limited records to meet legal obligations or resolve disputes.
Operational logs are pruned on a schedule so we don't keep them longer than needed: authentication/security logs (including IP and device) for about 90 days, AI-usage and product-analytics logs for about 180 days, and error logs for about 30 days. Records of purchases and credits are kept for as long as needed for accounting and dispute resolution.
5. Your rights under the GDPR
You have the right to:
- Access the personal data we hold about you, and receive a copy (data portability). You can export your data in-app.
- Rectify inaccurate data (you can edit your profile directly).
- Erase your data (“right to be forgotten”) by deleting your account.
- Restrict or object to processing based on legitimate interests.
- Withdraw consent at any time (e.g. for referral contact reveal or AI features), without affecting prior lawful processing.
- Lodge a complaint with your local supervisory authority.
To exercise any of these, use the in-app export/delete tools or email us at privacy@huntfolio.app.
6. Automated processing
Our AI features generate suggestions (rewritten bullets, match scores, skill ideas) that you review and choose whether to accept. These do not produce legal or similarly significant decisions about you, and a human (you) is always in the loop.
7. Security
Passwords are hashed (bcrypt); reset tokens are hashed and short-lived. AI/PDF rendering runs with network egress locked down. Access to your data is scoped to your authenticated account. No system is perfectly secure, but we apply industry-standard safeguards.
8. Cookies & local storage
We use only the cookies and browser storage needed to run the service — there are no advertising or cross-site tracking cookies, and no third-party analytics that profile you.
- Strictly necessary — a session cookie keeps you signed in and protects against CSRF. Without it, you can't log in, so it needs no consent under the ePrivacy rules.
- Preferences — your theme (light/dark) and similar settings are stored locally in your browser, not sent to us for tracking.
You can clear or block these in your browser settings, but blocking the strictly necessary cookie will stop you from signing in. We do not set any cookie that requires a consent banner.
9. Age & children
Huntfolio is a professional job-search tool intended for adults. You must confirm you are at least 18 years old when you create an account, and we record that confirmation. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us at privacy@huntfolio.app and we will delete it.
10. Changes & contact
We may update this policy; material changes bump the version shown above and we may ask you to re-consent. Questions or requests: privacy@huntfolio.app.