Privacy Policy

1. Introduction

This Privacy Policy explains how Careerforge (“we”, “us”, “our”) collects, uses, and protects personal data when you use our website, services, and browser extension (the “Service”).

Careerforge provides tools designed to help users manage and improve their job application process, including resume management, job tracking, and AI-assisted career tools.

We are committed to protecting your privacy and handling your personal data in accordance with the General Data Protection Regulation and applicable Swedish data protection laws.

If you have questions about this policy, you can contact us at: support@careerforge.se

2. Data Controller

The data controller responsible for processing your personal data is:

C&M Solutions AB
Org. no. 559592-8564
Sickla Kanalgata 11, 120 67 Stockholm, Sweden
Email: support@careerforge.se

3. Personal Data We Collect

3.1 Information You Provide

When you create an account or use the Service, we may collect:

Account information

• Name
• Email address
• Phone number
• Location

Profile information

• Work experience
• Education history
• Skills
• Certifications
• Languages
• References

Professional links

• LinkedIn profile
• GitHub profile
• Personal portfolio links

Documents

• Resumes (CV)
• Cover letters
• Other uploaded application documents

Job application data

• Employer names
• Job descriptions
• Application statuses
• Personal notes related to applications

3.2 Data Collected via Browser Extension

When you use the Careerforge browser extension:

Data from your Careerforge account

• Profile information described above
• Selected resumes and cover letters

Data collected from webpages (only when triggered by the user)

• Current page URL and full page content (converted to Markdown) when the user selects “Save Job”
• This data is sent to our backend API, which forwards it to Google Gemini AI (via Vertex AI on Google Cloud Platform) for structured job data extraction (job title, company, location, salary)

Feedback and issue reporting

• Current page URL
• Simplified page snapshot (HTML structure, up to 50KB)
• Detected form field metadata
• User-written feedback message

Local extension processing

• Form field metadata (labels, IDs, types) may be scanned locally to help fill job applications.
• This data is processed locally in the browser and is not transmitted to our servers.

The extension does not collect browsing history and does not access webpage data unless the user actively triggers a feature.

Authentication tokens from your account are transmitted to Supabase Auth for session validation when the extension communicates with the API.

3.3 Waitlist

While Careerforge is not yet open for new accounts, you can leave your email address on our waitlist. We store the address, the language you submitted it in, and the time of submission, and we use them for one purpose only: to send you an invitation when the Service opens. The legal basis is consent, given when you submit the form. Waitlist addresses are not used for marketing, are not shared with third parties, and are deleted once the invitation has been sent or on request to support@careerforge.se.

4. How We Handle and Use Your Data

We process, handle, and use personal data for the following purposes:

• Providing and maintaining the Service
• Creating and managing user accounts
• Generating resumes, cover letters, and career insights using AI tools
• Saving and organizing job applications
• Improving application materials through analysis and scoring
• Authenticating users and maintaining secure sessions
• Responding to support requests
• Maintaining platform security and preventing abuse

5. Legal Basis for Processing

Under the General Data Protection Regulation, we rely on the following legal bases:

Contractual necessity — Processing required to provide the Service you requested.

Legitimate interests — Improving the functionality, reliability, and security of the platform.

Consent — Where required, such as optional features or specific processing actions initiated by the user.

6. AI Processing

Careerforge uses artificial intelligence tools to assist with:

• Resume analysis and scoring
• Cover letter generation
• Job matching
• Career insights

To provide these features, portions of your profile data, resumes, or job descriptions may be processed by AI services operated through our backend infrastructure. Our AI processing uses Google Gemini AI (via Vertex AI on Google Cloud Platform), hosted in Google Cloud's EU multi-region, with data residency and AI processing within the European Union.

Data processed by Gemini AI includes:

• Resume parsing and scoring — uploaded resume files are processed to extract structured profile data and evaluate resume quality
• Cover letter generation — profile data, education history, and job descriptions are used to generate personalized cover letter content
• Job application parsing — page content (Markdown) and URL are processed to extract job title, company, location, and salary
• Experience description suggestions— resume section data is used to generate improved experience descriptions

AI processing occurs on servers located within the European Economic Area (EEA) whenever possible.

We do not use your personal data to train public AI models unless explicitly stated and consented to.

7. Information Sharing and Third-Party Services

We only share your data with the following third parties to provide our service. We rely on these service providers to operate the Service:

Infrastructure and hosting

• Google Cloud Platform – backend infrastructure and AI services (European region)
• Vercel – frontend hosting

Authentication, database, and storage

• Supabase Auth – user authentication, JWT token issuance and validation (hosted in eu-central-1, EU region)
• Supabase Database (PostgreSQL) – storage of profile data, resumes, cover letters, job applications, and user settings (hosted in eu-central-1, EU region)
• Supabase Storage – file storage for uploaded resume and cover letter documents (hosted in eu-central-1, EU region)

These providers process personal data on our behalf under data processing agreements and in accordance with applicable data protection laws.

Careerforge does not sell your data, nor do we transfer or share it with unrelated third parties for advertising or marketing purposes.

8. Potential Sharing with Recruiters or Employers

In the future, Careerforge may offer optional features that allow users to share parts of their professional profile with recruiters or potential employers in order to improve job opportunities.

If such features are introduced:

• Users will always have full control over whether their data is shared.
• Personal information will never be shared with recruiters or employers without the user's explicit consent.
• Users will be able to choose what information is shared, such as selected profile details, resumes, or work experience.
• Users will be able to withdraw their consent at any time, after which their information will no longer be shared.

Careerforge does not sell personal data to recruiters, advertisers, or other third parties.

9. Data Storage and Security

We take appropriate technical and organizational measures to protect personal data, including:

• Encryption of data in transit using HTTPS
• Secure authentication using JWT tokens
• Restricted internal access controls
• Secure cloud infrastructure

Some data may be cached locally on the user's device through the browser extension for usability purposes.

10. Local Storage in the Browser Extension

The extension may store limited information locally using chrome.storage.local, including:

• Authentication tokens
• Cached profile data
• Selected resume or cover letter identifiers

Local data:

• Is stored only on the user's device
• Is cleared when the user logs out
• Is not synchronized or transmitted without user interaction

Cached profile information is stored for a maximum of 24 hours.

10.1 Chrome Web Store Limited Use

The Careerforge extension's use and transfer to any other app of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. We do not sell, trade, or otherwise transfer your Google API or extension-collected data to third-party AI models, data brokers, or advertising networks.

10.2 Google Drive Export

Careerforge lets you save exported resumes and cover letters directly to your own Google Drive. This is optional and only happens when you click a "Save to Google Drive" action and grant permission in Google's consent dialog.

• We request only the drive.file scope, which gives access solely to files and folders created by Careerforge, never your wider Drive contents
• Files are uploaded directly from your browser to Google; they do not pass through our servers
• The Google access token is short-lived, held only in your browser's memory, and never stored by Careerforge

Careerforge's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

11. Data Retention

We retain personal data only as long as necessary to provide the Service. Typical retention periods include:

• Account and profile data — until account deletion
• Uploaded documents — until deleted by the user
• Job application records — until deleted by the user
• Logs and technical records — limited retention for security and troubleshooting
• Payment and invoicing records — 7 years, as required by the Swedish Bookkeeping Act (bokföringslagen). These records are kept even after an account is deleted, because we are legally obliged to keep them (Article 6(1)(c) GDPR)

Users may request deletion of their data at any time by emailing our Data Controller at: support@careerforge.se, or through their account settings page.

When you delete your account from the settings page, the account is immediately locked and scheduled for deletion. It remains recoverable for 30 days, so an accidental or unauthorised deletion can be undone by signing back in and choosing to restore the account. After 30 days the account and its contents are permanently deleted, with the single exception of the payment records described above, from which your identifying details are separated and retained only for the statutory bookkeeping period.

12. Anonymized Data for Research and Service Improvement

When a user deletes their account, personal data associated with the account is deleted from our active systems.

Before deletion, certain information may be transformed into irreversibly anonymized data that can no longer be used to identify an individual. During this process:

• All direct identifiers (such as name, email, phone number, and account identifiers) are removed.
• Any internal user identifiers are replaced with a newly generated random identifier that cannot be linked back to the original user account.
• Information that could directly identify a person (such as specific employers, exact locations, or document text) is removed or generalized.

The resulting anonymized data may be retained for purposes such as:

• Statistical analysis of job search patterns
• Improving the functionality and quality of our services
• Research and development, including improving internal AI systems

Once anonymized, this information cannot be used to identify any individual and is no longer considered personal data under the General Data Protection Regulation.

13. Your Rights

Under the General Data Protection Regulation, you have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Restrict or object to certain processing
• Request data portability
• Withdraw consent where applicable

To exercise your rights, contact: support@careerforge.se