Privacy Policy
Your CV is sensitive. This page explains exactly what we collect, why, who processes it, and how you remove it.
1. What we collect
Account data: email address, authentication identifiers, and, if you sign in with Google, your name and profile email.
Documents you submit: the CVs and pitch documents you upload, plus the extracted text used to generate a review.
Review data: critique, scores, rewritten documents, roadmaps and research briefs generated for you.
Mentor conversations and career memory: your messages, the mentor's replies, and a compact summary of your background and goals used to keep advice consistent.
Usage data: credit transactions, timestamps and basic technical logs needed to run and secure the service. Anonymous free reviews use a locally generated identifier to enforce the three-review limit.
2. Why we process it
To deliver the reviews you request, maintain your history, keep your mentor's memory accurate, enforce credit limits and prevent abuse, and to comply with legal obligations. We do not use your CV to train third-party foundation models.
3. Who processes your data
Our hosting and database provider stores your account, documents and reviews. Our AI gateway provider processes the content of your CV and messages to generate output. Research queries send the employer and role you name — never your CV — to public web search. These providers act as processors on our instructions.
4. Never shared with employers
We do not send your CV, reviews or conversations to any employer, recruiter or third-party job platform, and we do not sell your personal data to anyone.
5. Retention
We keep your data while your account exists. Deleting a review removes it immediately. Deleting your account permanently removes your profile, documents, reviews, conversations and career memory. Anonymous review records are kept only as long as needed to enforce the free-use limit.
6. Your rights
You can access and export everything we hold about you as JSON from Settings, correct your profile at any time, and delete your account and all associated data yourself. Depending on where you live, you may also have rights to object to or restrict processing — email privacy@kiba.app and we will action requests within 30 days.
7. Security
Documents are stored in a private bucket accessible only to your account. Database access is enforced by row-level security so one user can never read another's data. Traffic is encrypted in transit.
8. Contact
Privacy questions and data requests: privacy@kiba.app.
This document is provided for transparency and does not constitute legal advice. If you have questions, contact support@kiba.app.