Your career credentials belong to you.

• •"Account" means a registered VeriWorkly user profile created via email OTP or OAuth sign-in.
• •"Guest Session" means unauthenticated, local-only use of the Service without an Account, identified only by a browser-set session cookie.
• •"Master Profile" means the single canonical record of your career facts (experience, education, skills, and similar sections) stored under your Account.
• •"Document" means any resume, cover letter, portfolio, or link-in-bio record you create, whether stored locally, synced to our servers, or published publicly.
• •"Local-First Storage" means data stored in your browser's LocalStorage rather than on our servers.
• •"Personal Data" means any information that identifies or could reasonably be used to identify you.
• •"Processing" means anything done with data - collecting, storing, using, disclosing, or deleting it.

3.1 Grievance Officer & Data Protection Contact

We acknowledge privacy requests and grievances within 3 business days and aim to resolve them within 30 days. If something will take longer, we will tell you where it stands rather than going quiet.

If your jurisdiction requires you to be told the identity of the party responsible for processing your data (a "data controller" under the GDPR, or a "Data Fiduciary" under India's DPDP framework), that party is VeriWorkly, reachable through the contact above.

• •Gautam Raj, Grievance Officer & Data Protection Contact
• •Email: [email protected]
• •Post: Phase-3, DLF Cyber City, Gurugram, Haryana 122010, India

3.2 EEA and UK users: how to reach us, and why there is no local representative

We are established in India. If you are in the European Economic Area or the United Kingdom, you can exercise every data protection right you have — access, correction, deletion, restriction, objection, portability — by writing to the Grievance Officer above. We answer those requests on the same timelines the GDPR and UK GDPR set, and we do not treat a request differently because of where it comes from.

We have not appointed an Article 27 representative inside the EEA or the UK. We would rather explain that than leave you to notice it. VeriWorkly is an open-core project run by one person without outside funding, and a representative service is a recurring cost we cannot currently carry. We also process no special-category data, run no advertising or profiling, and offer the service to individuals rather than targeting EEA users specifically — which is the basis on which we currently consider the exemption for occasional, low-risk processing to apply to us.

That is our reasoning, stated openly rather than assumed. We know a supervisory authority might weigh it differently, and if the project's scale or funding changes we will appoint a representative and name them here. In the meantime nothing about the absence of one limits your rights or your route to us: the contact above is a real person who reads and answers.

You can also complain to the supervisory authority where you live or work, without coming to us first. See the rights section below.

4.1 Information you provide directly

• •Account information: your email address, and if you sign in via Google, GitHub, or LinkedIn OAuth, the basic profile information those providers share with us (typically name, email, and avatar).
• •Master Profile and document content: the career facts, work history, education, skills, and any other text, links, or details you type into the Document Studio, Master Profile editor, or Portfolio Builder.
• •Portfolio content and media: text, project descriptions, and any images or screenshots you upload for a published portfolio (stored via Cloudflare R2 object storage).
• •Billing information: when you subscribe or make a purchase, our payment processor, Dodo Payments, collects your payment card or payment method details directly. We do not receive or store your full card number.
• •Support and contact form submissions: your name, email, subject, and message when you contact us.
• •Affiliate and Ambassador program applications: referral codes, payout details necessary to pay commissions, and - for the Student Ambassador program - your college/university name and graduation year.
• •Content you choose to import: if you use GitHub import, the repositories and profile data you authorize us to read. If you use LinkedIn import, the exported profile text you paste or upload. If you upload a legacy resume file (PDF, DOCX, TXT, MD, or JSON) for extraction, the contents of that file.

4.2 Information collected automatically

• •Aggregate, first-party product telemetry: counts of resumes created, documents exported, logins, and similar usage metrics, buffered and stored in aggregate form to help us understand product usage. This is not used to build individual behavioral profiles of you.
• •Portfolio visitor analytics: if you publish a portfolio, we record aggregate view counts, a recent-activity trend, and referrer domains for that portfolio. This works without setting tracking cookies and does not attempt to identify individual visitors.
• •Server and security logs: standard technical logs (IP address, user agent, request timestamps, and similar metadata) generated by normal web server and API operation, used for security, abuse prevention, and debugging, and retained only as long as reasonably necessary for those purposes.
• •Essential cookies: an authentication session cookie once you log in, and a Guest Session cookie (valid for 30 days) that lets you use the Service without an Account. We do not use advertising cookies, cross-site tracking pixels, or third-party analytics trackers, and we do not run mouse-tracking or heatmap scripts.

4.3 Information from third parties

• •OAuth sign-in providers (Google, GitHub, LinkedIn) share the basic profile information you authorize when you use them to sign in.
• •GitHub's API, when you use GitHub import, shares your public profile and repository data that you authorize us to access.
• •Dodo Payments shares transaction status, subscription state, and the metadata necessary for us to grant entitlements and credits after a purchase - not your full payment credentials.

• •Provide, operate, and maintain the Service - including the Document Studio, Master Profile, ATS Checker, Portfolio Builder, sharing, and export features.
• •Process the AI features you explicitly trigger (see Section 8, "AI Features & Third-Party AI Processing").
• •Process payments, manage subscriptions and credit balances, and enforce entitlements.
• •Send transactional emails: welcome emails, new-device login alerts, and account-deletion confirmations. We do not send marketing email unless you separately opt in, and any such email would include an unsubscribe option.
• •Detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms of Service.
• •Operate the affiliate and ambassador programs, including tracking referrals and calculating commissions.
• •Understand aggregate product usage so we can prioritize what to build next.
• •Comply with legal obligations and respond to lawful requests from public authorities.

• •Performance of a contract: processing your Account, Master Profile, and document data to provide the Service you've asked for.
• •Consent: for optional features you explicitly enable, such as AI processing of your content, GitHub/LinkedIn import, or publishing a portfolio publicly. You can withdraw consent by not using the relevant feature or by deleting the associated content.
• •Legitimate interests: aggregate product analytics, fraud and abuse prevention, and maintaining the security of the Service, balanced against your rights and freedoms.
• •Legal obligation: where we must retain or disclose information to comply with applicable law.

8.1 What gets sent, and when

Content is only sent to an AI model provider when you explicitly trigger an AI action - for example, clicking "Improve with AI," requesting AI resume tailoring against a job description, generating a cover letter, or requesting the AI-powered ATS deep-analysis layer. We do not run your Master Profile or documents through AI models in the background without your action.

Before an AI action runs, the Service shows you the credit cost and mode (Standard or Expert) so you know what you're triggering. After generation, you explicitly choose to replace your existing text or discard the AI's draft - nothing is overwritten silently.

8.2 How third-party AI providers handle that data

Content sent for AI processing is transmitted to the relevant third-party model provider's API solely to generate the requested output, and is subject to that provider's own data handling, retention, and (where applicable) API-data-training policies, which are outside our direct control. We do not use your content to train our own foundation models, and to the extent we can configure it, we use API terms with model providers that are intended to exclude submitted content from being used to train their models - but you should not treat this Policy as a substitute for reading a given provider's own privacy documentation if you have specific concerns.

We recommend avoiding pasting highly sensitive personal data (for example, government ID numbers, medical information, or financial account numbers) into AI-assisted fields beyond what is normal for a resume or cover letter.

8.3 Credits and processing records

We keep a ledger of AI credit grants, reservations, and debits tied to your Account so that a failed generation doesn't consume your balance, and so you can review your usage history from the Credits page. This ledger records that an AI action occurred and its cost - not necessarily the full content generated.

• •Authentication session cookie (HttpOnly, Secure): keeps you logged in across VeriWorkly subdomains once you sign in via Better Auth.
• •Guest Session cookie: a 30-day cookie that lets you use the Service without an Account and preserves your local session.
• •Theme preference: a local, non-tracking preference for light/dark mode, stored in your browser.

Because these cookies are strictly necessary to operate the Service, we do not present a cookie-consent banner for them; disabling cookies in your browser will simply prevent login and guest-session persistence from working correctly.

10.1 Subprocessors: who processes your data, what they see, and where

This is the complete list of third parties that may process your personal data on our behalf. Each entry says what the provider does for us, exactly what personal data reaches it, and where it processes that data. If we add or replace a subprocessor we update this list and note the change in the revision history at the end of this policy.

Some of these are unavoidable to run the service at all (hosting, database, email). Others are only reached when you take a specific action — no AI provider sees anything unless you use an AI feature, and no payment provider sees anything unless you buy something.

• •Neon (serverless PostgreSQL) — our primary database, holding your Account, Master Profile, synced documents, portfolio publications, credits, and billing records. Processing region: Asia-Pacific (Singapore). Transfer basis: Standard Contractual Clauses.
• •OpenRouter — the AI gateway we send requests through. It receives the text you submit when you use an AI feature (resume tailoring, cover letter drafting, portfolio copy, AI ATS analysis, and LinkedIn import parsing) and routes it to a model provider on our behalf. It is the reason we describe the AI boundary as leaving our infrastructure. Processing region: United States. Transfer basis: Standard Contractual Clauses.
• •Model providers reached through OpenRouter — the underlying model that answers a request, such as an Anthropic, OpenAI, or Google model. We hold no direct account with any of them: every AI request goes through OpenRouter, and which model serves it is set in our runtime configuration and can change. That is why we name the gateway rather than promise you a specific vendor. The model provider receives only the text of that request, is contractually prohibited from training on it, and never receives your name, email, or account identifiers. Processing region: primarily the United States, depending on the model selected. Transfer basis: Standard Contractual Clauses.
• •Dodo Payments — merchant of record for all purchases. It collects and processes your payment method directly; we never receive or store a full card number, only transaction status, subscription state, and the metadata needed to grant what you bought. Dodo Payments states that it handles card data under PCI-DSS. Processing region: United States and India. Transfer basis: Standard Contractual Clauses.
• •Cloudflare R2 — object storage for portfolio images, avatars, and other files you upload. It sees the file contents and filenames, not your Account details. Processing region: distributed, with automatic region selection. Transfer basis: Standard Contractual Clauses.
• •Google, GitHub, and LinkedIn (OAuth) — only if you choose to sign in with one of them. They confirm your identity to us and share your email address and basic profile; we never receive your password. Processing region: United States. Transfer basis: Standard Contractual Clauses.
• •GitHub API — only if you use GitHub import. We read the public repository and profile data you authorise. Processing region: United States. Transfer basis: Standard Contractual Clauses.
• •Hostinger (VPS) — the virtual private server that runs our web applications and API, and that our Redis cache runs on. It processes the request metadata described in Section 4 (IP address, user agent, timestamps) and, as the host, has infrastructure-level access to the machine our services run on. Hostinger also delivers our transactional email over SMTP: sign-in codes, purchase confirmations, portfolio notifications, and account-deletion confirmations, which means it sees your email address and the content of those messages. Processing region: European Union (Lithuania). Transfer basis: EU adequacy — no additional mechanism is needed for EEA transfers.

10.2 What is NOT a subprocessor

Better Auth is an authentication library that runs on our own server, not a service we send you to. Your session data never leaves the machine described above, so it is deliberately not listed as a subprocessor even though it handles your login.

Our Redis cache runs on that same server rather than as a separate hosted service. It holds short-lived session and rate-limit data, not a copy of your documents. It is covered by the Hostinger entry above rather than being its own subprocessor.

We use no advertising networks, no analytics vendors, no session-recording or heatmap tools, and no data brokers. There is nothing to list under those headings because we do not use any.

10.3 International transfers, and being honest about the limits

We are established in India, and as the table shows, most of our providers process data in the United States or across distributed regions. Where personal data moves internationally we rely on the transfer mechanism named against each provider — in almost every case the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum for UK transfers, or an adequacy decision where one covers the destination.

In practice these mechanisms are the ones each provider offers in its own data processing agreement, which we accept as their customer. We are a small independent project: we are not in a position to negotiate bespoke terms with a hosting or payment provider, and we would rather tell you that than imply a level of control we do not have. If a particular transfer matters to you, ask us and we will tell you exactly what is in place for it.

10.4 Public by your own choice

If you publish a portfolio, or create a public or unlisted share link for a document, the content of that portfolio or document becomes accessible to anyone with the URL (or, for public portfolios, to search engines and site visitors generally), until you unpublish it, revoke the link, or add password protection.

10.5 Legal and safety disclosures

We may disclose information if required to do so by law, subpoena, or other legal process, or where we believe in good faith that disclosure is reasonably necessary to protect the rights, property, or safety of VeriWorkly, our users, or the public, or to detect, prevent, or address fraud, security, or technical issues.

10.6 Business transfers

If VeriWorkly is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you (for example, via email or a prominent notice on the Service) before your Personal Data becomes subject to a different privacy policy.

Two of these pull in opposite directions and we would rather say so plainly than let you discover it. We keep no record of your ATS scans, but we must keep billing records for years — so if you paid us, closing your Account removes your documents and profile, not the fact of the transaction.

A note on how these periods work in practice. Account deletion is a real, immediate operation: it removes the rows and the uploaded files. The other periods above are policies we follow, not timers enforced by scheduled jobs — we are a small team and we have not built that automation yet. We have written what we actually do rather than the tidier version, because a retention period you can hold us to is worth more than one that only reads well.

• •Account, Master Profile, and synced document data: kept while your Account is active. If you delete your Account we remove this data within 30 days, other than anything we must keep under the rows below.
• •Guest Session (local-first, no Account): stays in your browser. The Guest Session cookie expires 30 days after your last visit. We hold nothing server-side for guest use.
• •ATS scans: your resume text and the resulting report are never written to our database. A scan is processed in memory and discarded when the response is sent. We do record that a scan happened, against your quota, so the rate limits can work — that counter holds no document content.
• •AI request text: not retained by us after the request completes. The model provider's own retention applies to the request itself, which is why Section 8 asks you to treat an AI action as a deliberate choice.
• •Server and security logs: we do store these. They hold request metadata (IP address, user agent, timestamps, error traces), not the contents of your documents. We have not yet built an automatic deletion schedule for them, so we will not quote you a number we do not enforce: today they are kept as long as our hosting provider retains them, and we delete them when they are no longer useful for security, abuse prevention, or debugging. If you want yours removed sooner, ask our Grievance Officer.
• •Takedown and grievance records: kept for up to 3 years from resolution, so we can apply our repeat-infringer policy consistently and show how a complaint was handled. These are reviewed and cleared by hand rather than by an automated job.
• •Billing and tax records: kept for as long as tax, accounting, and financial-regulation law requires of us, which is a period of years rather than months. We cannot delete these on request, and closing your Account does not remove them.
• •Aggregate usage telemetry: kept indefinitely in de-identified, aggregated form, from which you cannot be re-identified.

• •Access: request a copy of the personal data we hold about you.
• •Correction: fix inaccurate or incomplete data - most of this you can do yourself directly in the Master Profile or Account settings.
• •Deletion: request deletion of your Account and associated data at any time from the "Danger Zone" on your Profile page in the Studio, or by emailing [email protected]. Deletion permanently destroys your documents, Master Profile, portfolios, share links, and active sessions; see the retention section for the statutory billing records we are required to keep.
• •Portability: every document can be exported as structured JSON from the editor at any time, without contacting anyone. For a full copy of everything associated with your Account rather than a document at a time, email [email protected] and we will put one together.
• •Objection / restriction: object to or request that we restrict certain processing, such as aggregate analytics.
• •Withdraw consent: for anything based on consent (for example, GitHub/LinkedIn import or AI processing), simply stop using that feature, or ask us to delete data already collected through it.
• •Non-discrimination: we will not deny you service, charge you a different price, or provide a different level of service because you exercised a privacy right.
• •Complain to a regulator: if you think we have mishandled your data, you can lodge a complaint with a data protection authority. You do not have to come to us first, though we would like the chance to put it right.

12.2 Complaining to a regulator

If you are in the EEA or the UK, you can complain to the supervisory authority in the country where you live or work, or where you think the problem happened. In the UK that is the Information Commissioner's Office. If you are in India, you can escalate to the Data Protection Board once we have had a chance to respond to your grievance.

We would rather hear from you first — most problems are quicker to fix directly — but this right exists whether or not you use ours, and we will never treat you differently for exercising it.

12.3 California residents (CCPA/CPRA)

California residents have the rights above, plus the right to know the categories of personal information we've collected and the categories of third parties we've shared it with (both described in this Policy), and the right to opt out of the "sale" or "sharing" of personal information - which we do not do; we do not sell or share your personal information for cross-context behavioral advertising.

12.4 How to exercise these rights

Use the self-service export and delete tools in your Account dashboard where available, or email [email protected] with your request. We may need to verify your identity (typically by confirming the email address on your Account) before fulfilling certain requests.

• •Encryption in transit via HTTPS/TLS across all VeriWorkly domains and subdomains.
• •Passwordless authentication (email OTP) plus OAuth, so there is no password database to compromise; sessions are secured with HttpOnly, Secure cookies.
• •API keys and equivalent secrets are stored as irreversible hashes, never in plaintext.
• •Tiered rate limiting across the API, with stricter limits on authentication endpoints and credit/quota-based (rather than raw-rate) limits on AI endpoints.
• •Server-side-request-forgery (SSRF) protections on features that fetch external URLs (for example, the ATS Checker's "fetch job description from a URL" feature): HTTPS-only, private/loopback IP ranges blocked, resolved IPs pinned, and redirects/response size capped.
• •Scoped CORS policy limited to VeriWorkly domains and portfolio subdomains, plus standard security headers applied globally.
• •Internal audit logging of administrative actions (manual credit or entitlement grants, affiliate withdrawal approvals, and similar actions), so privileged access is accountable.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If you discover a security vulnerability, please report it responsibly per our Security Policy rather than disclosing it publicly.

13.3 If something goes wrong: breach notification

A policy that says nothing about breaches reads as unprepared, so here is our commitment. If personal data we hold is breached, we will notify the relevant supervisory authorities within the deadlines the applicable law sets, which are short — in the EEA and UK that is 72 hours from becoming aware, and India's framework sets its own tight reporting window.

Where a breach is likely to result in a high risk to your rights and freedoms, we will tell you directly and without undue delay. We will tell you what happened, what data was involved, what we have done about it, and what you can do to protect yourself — in plain language, not a legal notice designed to be skimmed past.

We will notify you even where doing so is embarrassing for us. If we are still working out the scope, we will say that rather than waiting for a complete picture before telling you anything.