Privacy Policy

1. Data We Collect

We collect only the personal information required to deliver our resume building and AI services: your verified email address and full name (received from Google OAuth or email magic link), resume text and structured documents you create, and operational metrics (page hits, feature actions). We do NOT collect GPS location, financial credentials, credit card numbers, or biometric data.

2. Purpose & Lawful Basis

Your data is processed strictly to furnish resume compilation, PDF/DOCX generation, ATS scoring, and AI rewriting. We do NOT sell, lease, or monetize your personal or professional data to recruiters, marketers, or data brokers.

3. Data Retention & Storage Isolation

Your data is hosted in encrypted PostgreSQL databases via Supabase, with strict Row-Level Security (RLS) ensuring that your records are accessible only to your authenticated identity. Active account documents are retained until you elect to delete them. In accordance with zero-log principles, resume content is never emitted into persistent application runtime logs.

4. AI Processing & Cross-Border Transfers

When you explicitly trigger AI enhancement or cover letter generation, your drafted text is securely transmitted via TLS 1.3 to our LLM inference providers (Groq Inc. and OpenAI) located in the United States/EU. Such transmission is stateless and processed for transient generation only. We prohibit our AI providers from using your resume text to train foundation models.

5. Cookies & Local Storage

We employ only strictly necessary HTTP-only authentication session cookies managed via Supabase SSR. We do not use third-party advertising cookies, cross-site tracking pixels, or marketing beacons.

6. Children's Privacy

Xenvra is intended for professionals and job seekers who have reached the age of majority (18 years or older). We do not knowingly solicit or collect personal information from minors.

7. Account Deletion & Data Erasure

You maintain complete ownership of your data. You may execute permanent account deletion at any time in Settings. Deletion irreversibly cascades across all database tables (profiles, resumes, cover letters, tracker items, versions, and payment history), removing your data from active storage immediately.

8. Data Breach Notification

In the unlikely event of a verified data breach impacting your personal information, Xenvra will notify affected users via their registered email address without undue delay, outlining the nature of the event and recommended remedial steps.

9. Indian DPDP Act (2023) Compliance & Grievance Officer

In alignment with the Digital Personal Data Protection Act (DPDP Act, 2023), Indian data principals hold rights of access, correction, erasure, and grievance redressal. For any statutory requests, data corrections, or security disclosures, contact our designated Grievance Officer at xenvra.official@gmail.com (Subject: DPDP Grievance Officer).