VantageCV Privacy Policy

VantageCV ('we,' 'our,' or 'us') is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website at vantage-cv.com, our browser extensions for Google Chrome and Microsoft Edge (the 'Extension'), and all related services (collectively, the 'Service').

By using VantageCV — including installing or using the Extension — you agree to the collection and use of information in accordance with this policy. If you do not agree, please discontinue use of the Service and uninstall the Extension.

Account Information: When you create an account, we collect your name, email address, and profile information provided through Replit authentication.

Resume Data: When you upload or paste your resume, we temporarily process this content to provide our AI-powered analysis and optimization services.

Job Application Data: When you use the job tracker (via the website or Extension), we store the company name, job title, URL, and location you provide. This data is associated with your account for tracking purposes.

Browser Extension Data: The VantageCV Extension collects limited data to provide its features:

• Page content on job sites: The Extension reads the current page to extract the company name, job title, and job description text when you are on a supported job board. This data is processed locally in your browser and sent to our servers only when you initiate a ghost job check or save a job.

• Extension token: A unique token linking the Extension to your VantageCV account, stored locally in your browser via chrome.storage.local.

• Language preference: Your selected language, stored locally in your browser.

• Active tab URL: The URL of the current tab, used solely to auto-fill the job URL field when saving a job. This URL is not transmitted unless you explicitly save the job.

Usage Data: We collect information about how you interact with our Service, including features used, session duration, and preferences. We do not use third-party analytics trackers.

Payment Information: Payment processing is handled securely by Stripe. We do not store your complete payment card details. We retain only a record of your subscription status and billing history.

We use the information we collect to:

• Provide and maintain our resume optimization and ghost job detection services

• Process ghost job check requests submitted through the website or Extension

• Save job applications to your personal tracker when you choose to do so

• Process your transactions and manage your subscriptions

• Improve our AI algorithms and service quality

• Communicate with you about your account and service updates

• Ensure the security and integrity of our platform

We do not use your data for advertising, user profiling, or sale to third parties.

VantageCV uses Google Gemini AI and OpenAI to analyze and provide suggestions for your resume and job postings. When you use our AI-powered features:

Data Sent to AI Providers:

• Your resume content (for analysis, scoring, and optimization suggestions)

• Job title, company name, and job description (for match scoring and ghost job detection)

• Text you paste into Quick Tools (for polishing and formatting)

How AI Providers Process This Data:

• Data is transmitted securely using TLS encryption

• AI providers process your data solely to generate responses for VantageCV

• VantageCV does not use your data to train any AI models, and our agreements with AI providers prohibit them from using API inputs for model training

• AI processing occurs in real-time to deliver the service

• Each provider's handling of API data is governed by their respective data processing agreements

For complete information about how these providers handle data, please refer to Google's Privacy Policy and Gemini API Terms of Service, and OpenAI's API Data Usage Policy.

The VantageCV browser extension for Chrome and Edge requests the following permissions:

• activeTab: Allows the Extension to read the content of the currently active tab when you open the Extension popup. This is used to extract job posting details (company name, job title, job description) from supported job boards. The Extension does not read tabs in the background or access tabs you have not interacted with.

• storage: Allows the Extension to store your API token, language preference, and API server setting locally on your device using chrome.storage.local. This data never leaves your browser unless you explicitly initiate an action.

• Host permission (https://vantage-cv.com): Allows the Extension to communicate with VantageCV servers to submit ghost job checks, save jobs, and validate your account token.

What the Extension Does NOT Do:

• Does not track your browsing history or activity

• Does not run in the background or monitor pages you visit

• Does not inject advertisements or modify web page content (except for displaying ghost job status badges on supported job boards when the feature is active)

• Does not collect or transmit data from non-job-related pages

• Does not access bookmarks, downloads, or other browser data

• Does not use remote code execution; all Extension code is bundled locally

Data Transmitted by the Extension:

• Ghost job check requests: company name, job title, and job description text are sent to our API over HTTPS when you click "Check Ghost Job Risk."

• Save job requests: company name, job title, URL, and location are sent to our API over HTTPS when you click "Save Job."

• Account validation: your extension token is sent to our API to verify your account status.

All Extension data transmission occurs over encrypted HTTPS connections to vantage-cv.com.

We practice data minimization and retain your information only as necessary:

What We Store (Persistent):

• Account information (name, email) — retained while your account is active

• Authentication session — stored securely for 7 days or until you log out

• Subscription and payment status — retained for billing and tax compliance purposes

• Saved job tracker entries — retained until you delete them or delete your account

• Ghost job database contributions — aggregated and anonymized company-level data

What We Do NOT Store (Ephemeral/Session-Only):

• Resume content — exists only in your browser session memory

• AI analysis results (match scores, critiques, suggestions) — stored only in browser memory

• Job descriptions you provide for analysis — not saved to our database after analysis completes

• Ghost job check results — stored only in browser memory or Extension popup memory

When Session Data Is Automatically Deleted:

• When you create a new project (previous analysis is replaced)

• When you refresh or close your browser

• When you log out of your account

• Temporary PDF exports are automatically deleted from our servers after 10 minutes

This ephemeral approach means your resume and analysis data is under your control. If you want to keep your optimized resume, you must export it as a PDF before ending your session.

You can request deletion of your account and all associated data at any time through the Settings panel in your dashboard or by contacting us.

We implement appropriate technical and organizational measures to protect your personal information, including:

• TLS encryption for all data in transit (website, API, and Extension communications)

• Encryption of data at rest for stored account and job tracker data

• Secure authentication via Replit's OAuth system

• Extension token authentication using unique per-user tokens

• Regular security assessments and dependency audits

• Access controls limiting data access to authorized personnel

• No storage of plaintext passwords — authentication is delegated to Replit OAuth

While we take reasonable measures to protect your data, no method of electronic transmission or storage is 100% secure. We encourage you to use strong passwords and keep your Extension token confidential.

We use the following third-party services (subprocessors) to provide our services:

• Replit (USA): Hosting, infrastructure, database, and authentication

• Google Gemini AI (USA): Resume analysis, ghost job detection, and AI processing

• OpenAI (USA): Supplementary AI processing for specific features

• Stripe (USA): Payment and subscription processing

• Neon (USA): PostgreSQL database hosting

• Google Chrome Web Store / Microsoft Edge Add-ons: Distribution of the browser extension (subject to their respective privacy policies)

Each subprocessor is contractually bound to handle your data in accordance with applicable data protection laws. We do not share your personal data with any subprocessor for purposes unrelated to providing the Service.

For users in the European Economic Area (EEA), United Kingdom, and Switzerland, we process your personal data based on the following legal grounds:

• Contract Performance (Art. 6(1)(b)): Processing necessary to provide the services you requested (resume analysis, ghost job detection, job tracking, account management)

• Legitimate Interest (Art. 6(1)(f)): Processing for service improvement, security, fraud prevention, and aggregated analytics. You may object to processing based on legitimate interests at any time.

• Consent (Art. 6(1)(a)): Where you have explicitly consented to specific processing activities. You may withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

• Legal Obligation (Art. 6(1)(c)): Processing required to comply with applicable laws, such as tax and financial record-keeping requirements

VantageCV is operated from the United States. If you are located outside the United States, please be aware that your data will be transferred to and processed in the United States.

For EEA/UK users: We rely on Standard Contractual Clauses (SCCs) approved by the European Commission (and the UK equivalent, the International Data Transfer Agreement) and supplementary measures to ensure adequate protection for international data transfers.

We regularly assess the legal framework in the countries where data is processed to ensure continued adequacy of protection.

All Users Have the Right To:

• Access the personal information we hold about you

• Request correction of inaccurate data

• Request deletion of your data (including job tracker entries and account data)

• Withdraw consent for data processing

• Export your data in a portable format

• Uninstall the Extension at any time, which immediately stops all Extension data collection

Additional Rights for EEA/UK Residents (GDPR):

• Right to object to processing based on legitimate interests

• Right to restrict processing

• Right to data portability

• Right to lodge a complaint with your local data protection authority (e.g., the ICO in the UK, CNIL in France, BfDI in Germany)

Additional Rights for California Residents (CCPA/CPRA):

• Right to know what personal information is collected, used, and disclosed

• Right to delete personal information

• Right to opt-out of the sale or sharing of personal information — VantageCV does not sell or share your personal information as defined under the CCPA/CPRA

• Right to non-discrimination for exercising your privacy rights

• Right to limit use of sensitive personal information (Note: we do not collect sensitive personal information as defined by the CPRA)

Additional Rights for Other Jurisdictions:

• Users in Brazil (LGPD), Canada (PIPEDA), and other jurisdictions with data protection laws may have additional rights. Contact us to exercise any applicable rights.

To exercise any of these rights, please contact us at vince.lupe@gmail.com. We will respond within 30 days (or sooner if required by applicable law). We may ask you to verify your identity before fulfilling your request.

VantageCV uses essential cookies required for the service to function. We do not use third-party tracking cookies, behavioral advertising, or retargeting.

• Session Cookies: Used to maintain your login session (expires after 7 days or logout)

• Preference Cookies: Used to remember your language and theme preferences (stored locally in your browser)

• Extension Local Storage: The Extension uses chrome.storage.local to store your API token, language preference, and API server setting. This is local to your browser and is not transmitted to us except as described in Section 5.

Because we only use strictly necessary cookies, no cookie consent banner is required under ePrivacy regulations. However, we inform you of our cookie practices here for full transparency.

VantageCV is not intended for users under the age of 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately and we will promptly delete such information.

VantageCV does not track users across third-party websites and therefore does not respond to Do Not Track (DNT) signals. We do not engage in cross-site tracking of any kind.

In the event of a data breach that affects your personal information, we will:

• Notify affected users via email within 72 hours of becoming aware of the breach (or as required by applicable law)

• Notify the relevant supervisory authority where required by GDPR or other applicable law

• Provide a description of the breach, the data affected, and the measures taken to address it

• Take immediate steps to contain the breach and prevent further unauthorized access

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on our website with a new "Last Updated" date

• For significant changes, notifying you via email or through the Service

• Updating the Extension listing on the Chrome Web Store and Microsoft Edge Add-ons store when changes affect Extension data practices

Your continued use of VantageCV (including the Extension) after changes are posted constitutes your acceptance of the updated policy. If you do not agree with the changes, please discontinue use and uninstall the Extension.

If you have questions about this Privacy Policy, our data practices, or wish to exercise your privacy rights, please contact us at:

Email: vince.lupe@gmail.com

For GDPR-related inquiries, this email serves as our primary contact point for data protection matters. We aim to respond to all inquiries within 30 days.