Privacy Policy
Your privacy is our priority. Learn how we protect and handle your information.
Last updated: July 29, 2026
Introduction
CareerCraft Studio (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered career development platform.
This policy explains what we do with your information. It applies whenever you use CareerCraft Studio.
Information We Collect
Personal Information
We collect information you provide directly to us, including:
- Account information (name, email address, profile details)
- Professional information (work history, education, skills, achievements)
- Resume and cover letter content
- Job posting information you import or analyze
- Communications with our AI chat system
Automatically Collected Information
We automatically collect certain information when you use our service:
- Usage data and analytics
- Device information and browser type
- IP address and location data
- Cookies and similar tracking technologies
How We Use Your Information
We use the information we collect to:
- Provide, maintain, and improve our AI-powered career services
- Generate personalized resumes and cover letters
- Analyze job compatibility and provide career recommendations
- Process your requests through our AI chat system
- Send you service-related communications
- Ensure security and prevent fraud
- Comply with legal obligations
AI Processing and Third-Party Services
How your content reaches AI models
Important: our AI features do not run on our own computers. Every time we draft a resume, write a cover letter, analyze a job posting, or answer you in the career chat, we send your content to AI companies we do not own or operate.
What we send is the actual text, not a summary: your resume — often the whole document — your work history, your skills and achievements, job postings you save, and what you type into the chat. We send the model’s reply back to you.
Some of the models we use are reached directly, and the rest through a routing service called OpenRouter, which passes a request on to whichever company is serving the model we asked for. When a model is reached that way, OpenRouter is not just a pipe — your content passes through its systems, so it is a recipient in its own right.
Which company receives any given request depends on which model we picked for that feature, and sometimes on which of that model’s providers is available at that moment. That choice is ours and the system’s, not yours. Every company that can receive your content is named on our Who receives your content page, along with what it receives, where it is based, and whether it is receiving anything today. We disclose every company before it can receive your content, not after.
What those companies may do with your content
Each company sets its own rules about how long it keeps what it receives and whether it uses that content to train AI models. Those rules differ from company to company, and some of them allow both. Put plainly: some of the companies we send your content to may keep it, and some may use it to train their models.
We have not restricted our routing to companies that promise otherwise. The options exist — we could send requests only to providers that delete content immediately, or only to providers that agree not to train on it. We have not turned those options on, because we chose the freedom to move to a better or cheaper model over that restriction. We would rather tell you that than describe a safeguard we do not have.
Some of the models we can use are free-of-charge versions. Free access is generally the arrangement most likely to come with training rights for the provider, and we permit those models in the product.
We also cannot tell you how often this happens. We do not currently record which company served a particular request, so we cannot say what share of requests reach a provider that trains on them — not for you, and not overall. The honest summary is this: treat anything you put into CareerCraft Studio as content that could end up in another company’s training data.
When the provider is chosen automatically
Some models do not have a fixed provider. For those, the routing service picks a provider for each request, at the moment the request is made. When one of those models is in use, your content may reach providers we have not named, in jurisdictions we have not named, under terms we have not reviewed.
Our sub-processors page cannot list those providers in advance, because the choice happens after the request leaves us. The same applies, on a smaller scale, when a provider we did choose is unavailable and the routing service falls back to another one. This is the one part of this disclosure we cannot make complete, and we would rather say so than publish a list that looks complete and is not.
Diagnostics and debugging
When we are investigating a problem, our AI requests can be recorded by a diagnostics service called LangSmith, run by LangChain, Inc. What it records is the request as we actually sent it — which for resume features means your resume text — plus the model’s reply. This is how we find out why a generation failed or produced something wrong.
This one differs from the model providers in an important way. LangSmith holds a stored record, not a trained model, which means deletion is technically possible here in a way it is not once content has been used for training. If you email us with the subject line “Privacy Policy Inquiry” we will tell you what we hold and delete what we can identify as yours. We are being careful with that wording because we do not want to promise more than we can deliver: we can delete stored records, and we cannot delete anything from a provider’s training data.
You cannot turn this off
There is no setting that keeps your content inside CareerCraft Studio. We do not offer a way to opt out of AI routing, a way to choose which providers receive your content, or a plan that keeps it with one company. Using the AI features means accepting the routing described above.
What you do control is what you put in and whether you keep an account. You do not have to upload a full resume to use the app, you can leave details out of anything you type, and you can delete your account at any time from the Account page. See Data retention and deletion below for what deletion reaches and what it cannot.
One clarification, because the same word appears twice on this page: the Opt-out listed under Your Rights and Choices refers to marketing email. It does not apply to AI processing.
We rely on these kinds of third-party services:
- AI model providers: the companies that actually run the AI models. Named individually on Who receives your content.
- OpenRouter: routes our AI requests to those providers. Your content passes through it.
- Diagnostics: records AI requests when we are debugging, as described above.
- Authentication Providers: For secure account creation and login
- Cloud Infrastructure: For hosting and data storage
- Analytics Services: For usage analytics and service improvement
Each of these companies has its own privacy policy and its own terms, and those — not ours — govern what it does with your content. We link to them on Who receives your content so you can read them yourself.
We should also be straight about what we have not signed. We do not have a data processing agreement with OpenRouter, and we have no contract of any kind with the model providers it routes to. They are OpenRouter’s suppliers, not ours. In practice that means we cannot impose our own rules on them, cannot audit them, and cannot require them to delete anything. We are seeking a data processing agreement with OpenRouter and will update this page if we obtain one. Until then, please do not read anything here as a promise made to us by anyone downstream.
Information Sharing and Disclosure
What We Don’t Do
We do not sell or rent your personal information, and we do not share it with advertisers or marketing companies. We do not run ads against your career data, we do not build advertising profiles from it, and we do not hand it to anyone for their own marketing.
To be clear about the edge of that promise: it is about advertising and marketing. It is not a promise that no third party ever receives your content. The AI providers described above do receive it, we are not paid by them for it, and some of them may use it to train their models. That is disclosed under AI Processing and Third-Party Services, and the promise above does not cover it.
We share your information in these circumstances:
- Service Providers: With third-party services that help us operate our platform, including the AI providers and the routing service described above
- Legal Requirements: When required by law, court order, or government request
- Safety and Security: To protect our users, prevent fraud, or address security issues
- Business Transfers: In connection with a merger, acquisition, or sale of assets (with user notification)
- With Your Consent: When you explicitly authorize us to share specific information
Data Security
We implement appropriate technical and organizational security measures to protect your personal information, including:
- Encryption of data in transit and at rest
- Secure authentication and access controls
- Regular security assessments and updates
- Limited access to personal data on a need-to-know basis
However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.
Your Rights and Choices
You have the following rights regarding your personal information:
- Access: Request access to your personal information
- Correction: Request correction of inaccurate information
- Deletion: Request deletion of your personal information
- Portability: Request a copy of your data in a portable format
- Opt-out of marketing email: Unsubscribe from marketing communications. This does not affect AI processing — there is no opt-out from that, as explained under AI Processing and Third-Party Services.
To exercise these rights, please use the Account page in your dashboard. You can request a copy of your data or request account deletion at any time. Data requests and deletion requests are processed within 48 hours. When you request deletion, your account is immediately flagged for deletion (soft delete) and will be permanently deleted soon after. You will receive confirmation via email when your request is processed.
Data Retention and Deletion
What we keep
We retain your personal information for as long as necessary to provide our services and fulfill the purposes outlined in this Privacy Policy. We will delete or anonymize your information when:
- You request deletion of your account
- Your account has been inactive for an extended period
- We are no longer required to retain it for legal or business purposes
What deletion reaches
Deleting your account covers CareerCraft Studio’s own systems — our database and our file storage. That is the part we control and the part we can promise.
What deletion does not reach
It does not reach content that has already been sent to an AI provider.
If a provider kept a copy of a request, we cannot make it delete that copy. We have no contract with it, and we do not have a record of which provider served which request. And if content has already been used to train a model, deletion is not something anyone can do — once text has been absorbed into a model there is no separate copy to remove. That is not a gap in our process; it is how model training works. It is the reason we are telling you this before you upload rather than after you ask.
So, plainly: deleting your account stops future sends. It does not undo past ones.
There is one exception that works in your favor — our diagnostic records, described under AI Processing and Third-Party Services. Those are stored records rather than trained models, so a deletion request can actually reach them.
Children’s Privacy
CareerCraft Studio is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete such information promptly.
Where in the World Your Information Goes
Our own servers and database are in the United States. If you use CareerCraft Studio from anywhere else, your account and your documents are stored in the US.
AI processing does not stay in the United States. The companies that can receive your content are based in several different countries, and some of them are outside the US — including companies based in China. Our Who receives your content page lists where each one is based, as far as we have been able to determine it, and says so plainly where we could not.
We do not have a way to keep your AI requests inside the US, or inside your own region. The routing service we use offers regional routing only on its enterprise plans, and we are not on one.
The list of companies, and how to get it
Your data may be sent to any of the sub-processors we use — not a subset you have chosen, and not only the one serving a particular feature at a particular moment. When we add one, it joins the set your data may be sent to.
You should not have to ask to find out who they are, so we publish the list: Who receives your content names every one of them, what it receives, where it is based, and whether it is receiving anything today. If you would rather have it in writing, email us at support@careercraft.studio and we will send you a written list of our sub-processors. That commitment stands whatever happens to the page.
If you are in the UK, the EU, or another region with rules about sending personal data abroad, please read this section and the sub-processors page before you upload anything. We do not currently offer standard contractual clauses or a regional processing option.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by:
- Posting the new Privacy Policy on this page
- Updating the “Last updated” date at the top of this policy
- Showing a notice inside the app to signed-in users for significant changes
- Sending you an email notification for significant changes
When we add or change the companies that can receive your content, we tell you — we do not ask you to re-accept, because there is no opt-out to offer you. Your continued use of CareerCraft Studio after any changes indicates your acceptance of the updated Privacy Policy. If a change is one you are not willing to accept, you can delete your account from the Account page.
Contact Us
If you have any questions about this Privacy Policy or our privacy practices, please contact us at:
Email: support@careercraft.studio
Subject Line: Privacy Policy Inquiry