Privacy Policy

Stellenzu (“we”, “our”, “us”) is an AI-assisted career platform for job seekers and, in a separate flow, for employers. The service includes a job search feed, a resume builder with AI tailoring, an Assisted Apply flow that helps you finish applications on employer sites, a career guidance chat, and a dashboard where your applications are tracked.

For questions about this policy or how we handle your data, contact us at [email protected] — or use the address on our Contact page.

When you create an account we collect the information you enter or that your identity provider shares with us:

• Name, email address, and password hash (if you sign up with email + password).
• OAuth identifier and email address returned by Google, GitHub, or LinkedIn when you sign up with those providers. We do not receive your OAuth password.
• Optional profile fields you choose to fill in: phone number, location, headline, avatar, LinkedIn URL, and portfolio URL.
• Whether you signed up as a job seeker or as an employer (this affects which parts of the product you can access).

Your password, if you set one, is stored only as a one-way cryptographic hash. We cannot read it and neither can our staff.

When you upload an existing resume for parsing, or build one inside the Resume Builder, we store the text and structured fields (name, contact, work history, education, skills, projects, certifications, publications, achievements, languages, and any customization you apply). These are stored in your account and are only visible to you inside your dashboard.

What we don't do

• We do not share your resume with employers unless you explicitly send it via Assisted Apply, download it and share it yourself, or submit it via a specific job application.
• We do not sell resume content to advertisers or third parties.
• We do not use your resume content to train third-party AI models on your behalf. When we send excerpts to our AI providers (Mistral / OpenAI), it is for the purpose of processing your request and is subject to those providers' data handling terms — see "Third-party services" below.

To personalise search results and Assisted Apply, we store the preferences you provide: preferred roles, locations, salary bands, work type (remote / hybrid / on-site), and any filters you apply. We also record the jobs you view, save, and apply to.

Applications you confirm through Assisted Apply — or resumes you tailor for a specific job description — are logged in your Dashboard under “Your applications” and “Resumes prepared for a role”. Each row is visible only to you and can be deleted from the dashboard at any time.

Stellenzu uses large language models for several features: resume tailoring, resume scoring, cover letter drafting, and the career-guidance chat (“Kyro”). When you use these features, the relevant text — your resume content, the job description, or your chat prompt — is sent to our AI provider for processing.

Our default provider is Mistral AI, with OpenAI as a fallback. The provider we call:

• Receives only the input needed to produce the response (for example, your resume text plus the job description when tailoring).
• Does not receive your name, email, or account identifier unless you type them into the prompt yourself.
• Is contractually bound not to train on the requests we send them, under their business API terms — but you should still avoid pasting information you would not want a third party to process.

We use privacy-first analytics to understand which pages people use and where the product falls short. We currently use Vercel Web Analytics, which counts page views and referrers on the frontend without setting a persistent identifier and without cross-site tracking.

We do not use ad-tech analytics (Google Analytics, Facebook Pixel, and similar are not installed). If we ever add another provider we'll update this section and notify you inside the product.

Stellenzu uses a small number of cookies to keep you signed in and to remember your preferences. We do not use advertising cookies. See our Cookie Policy for the full list and how to manage them in your browser.

We rely on the following providers to run the product. Each one only receives the data required to perform its role.

Infrastructure

• Vercel — hosts the frontend and serves the website. Receives standard request metadata (IP, user agent) plus Vercel Web Analytics counts.
• Railway — hosts the backend API and processes your API requests.
• Supabase — provides our production PostgreSQL database, which stores your account, resumes, applications, and dashboard data.

Authentication

• Google OAuth — if you sign up with Google, Google shares your email and name with us so we can create your Stellenzu account.
• GitHub OAuth — if you sign up with GitHub, GitHub shares your email and username / display name.
• LinkedIn OAuth — if enabled and you sign up with LinkedIn, LinkedIn shares your email and name via their OpenID Connect endpoint.

Job data

• SerpAPI — used to fetch Google Jobs results when you search. Receives the search query you enter (e.g. “senior data analyst, London”).
• Adzuna — used as a fallback job source when SerpAPI is unavailable. Receives the same kind of search query.

AI

• Mistral AI — our default LLM provider. Receives the specific text needed for each request (resume + job description for tailoring, your prompt for career chat).
• OpenAI — fallback LLM provider used if Mistral is unavailable. Same data-minimisation rule applies.

Each of these providers has its own privacy policy that governs what they do with the data we send them. Link check each one before enabling paid features if that matters to your workflow.

We keep your data for as long as your account is active. Specifically:

• Account details, resumes, and applications: stored until you delete them or close your account.
• AI request logs (which contain the text you sent to the model): stored for up to 30 days for debugging and abuse prevention, then deleted.
• Backup snapshots of the database: retained for up to 35 days for disaster recovery. Deleted data will disappear from backups once they roll off.
• Anonymised usage counts (page views, feature usage): retained indefinitely because we can no longer link them to you.

You can delete your account at any time from your profile page. Account deletion removes your account record, resumes, saved jobs, applications, dashboard entries, and AI request logs from our production database within seven days. Backup snapshots will roll off within 35 days.

Account deletion currently requires re-entering your password (or reauthenticating through your OAuth provider) so we can be sure it's really you making the request.

If you signed up through Google, GitHub, or LinkedIn and want to sever the connection, revoking Stellenzu's access in that provider's settings will stop future OAuth logins but will not delete data we've already stored — for that, delete your account from within Stellenzu.

Stellenzu is not directed at children under 16. Please don't create an account if you're under 16, and don't upload another person's resume without their consent. If we learn a minor has created an account we'll remove it.

Depending on where you live, you may have rights under laws such as the GDPR (EU / UK), the CCPA / CPRA (California), and India's Digital Personal Data Protection Act. These typically include the right to access, correct, delete, and export your personal data, and to object to certain processing.

To exercise any of these rights, email [email protected] from the address on your account. We'll respond within 30 days.

We'll update the “Last updated” date whenever this policy changes. For material changes we'll show a banner or send an email before the change takes effect so you have time to review it or close your account if you disagree.

Questions, requests, or complaints about this policy can be sent to: