Sub-processors

Database and authentication

Everything you save in your account: email, password hash, Resume text and structured data, Analyses, Target Roles, Cover Letters, Interview Session answers, saved stories, Applications, billing identifiers, and billing records.

Application hosting, content delivery, and visitor counting

Every request to supacv.com passes through Vercel, so it sees IP address, request path, and headers in transit. Vercel Web Analytics separately receives page path, referrer, coarse country, and device type. It sets no cookies and keeps no identifier beyond 24 hours.

AI features (Claude)

The Resume text, job description, and prompt for whichever AI feature you run, including Interview Session answers you write and the Resume bullets scored alongside them. Sent as you wrote it, without identifier removal.

Payment processing and subscription billing

Your email address, and the card details you enter on Stripe’s own hosted checkout page. Card numbers never reach SupaCV: we store Stripe reference ids and a billing record of amounts, plan, and dates, never card details.

Rate limiting

Your IP address or account ID as a counter key, to stop abuse of public endpoints. No content. Keys expire on their own within one hour for most limits and 24 hours for the free landing-page scan.

Transactional email

Your email address and the contents of the message being sent (score results, password resets, reminders, receipts).

Transactional and follow-up email

Your email address, optional first name, and the contents of the message being sent. No resume content.

Session replay and heatmaps

A recording of how you use the site: mouse movement, clicks, scrolling, and page structure. Loads only after you accept cookies, so it receives nothing at all if you decline or have not chosen.

Consent required. Receives nothing unless you accept cookies. See the Cookie Policy.

Aggregate traffic measurement

The URL of each page you visit, including signed-in pages, plus the referrer and coarse device information. Cookieless, and it sets no identifier on your device.

Bot protection (Turnstile)

On the sign-up, sign-in and password-reset pages, when you change your password, and when you start a free scan, Cloudflare’s Turnstile script runs in your browser and sends Cloudflare your IP address and technical signals about your browser and device, which it uses to tell people from automated traffic. The pass it issues is then sent back to Cloudflare, with your IP address, to be confirmed. It receives no email address, no password and no Resume content.

Internal error alerting

Error type, error message truncated to 300 characters, one stack frame, deployment environment, region, and timestamp. It is built from a fixed field set, so it carries no request URL, no request body, no email address and no Resume content. One rare failure path, a screenshot upload that could not be cleaned up, includes the storage path, which contains an account identifier.

Company logos next to job listings

Your browser requests logo images directly, so logo.dev sees your IP address and the company domain being displayed. It receives nothing about you or your Resume.

Text embeddings for keyword analysis

Short skill and keyword phrases, never a full Resume.

Not currently in use. Configured but not in the live path: semantic matching is switched off after evaluation, so no user text is currently sent.