Privacy & Data Protection Policy

1Data We Collect

• Account Credentials: When you sign up via email or OAuth (Google, GitHub), we store your name, email address, and avatar URL to authenticate your session.

• Resume Content: All personal information, experience bullets, and skills are processed primarily in your browser and stored in local storage. If authenticated, backups are synced to our isolated PostgreSQL Supabase database protected with Row Level Security (RLS). When utilizing AI features, requested text is sent directly to your chosen AI provider (Google Gemini or OpenAI).

2How We Use Your Data

We utilize your information strictly to: (a) generate high-definition vector PDFs, (b) calculate algorithmic ATS compliance scores, (c) manage your quota and license validation, and (d) synchronize your documents across your personal devices.

3Zero Data Selling & Third-Party Sharing

We do NOT sell, rent, monetize, or disclose your resume data to advertisers, headhunters, or recruitment agencies. Your resumes are confidential.

4Security & Encryption (Row Level Security)

Cloud resume records are protected by PostgreSQL Row Level Security (RLS). Database policies restrict each authenticated account to its own resume rows.

5Your Rights, Account Deletion & Data Retention (GDPR / CCPA)

• Self-Service Erasure: You can initiate permanent deletion of your account and associated application records directly from Profile Menu → Delete Account. Once completed, the action cannot be undone from AuraCV.

• Scope of Erasure: After confirmation and a successful server response, the flow removes the authentication account and active data covered by the application, then clears AuraCV local state in the current browser. Minimal security records and provider-managed backups may remain for their applicable retention periods.

• Financial & Audit Retention: Dodo Payments, as Merchant of Record, retains financial records for applicable legal periods. AuraCV retains minimal billing events and a pseudonymized SHA-256 record of erasures for compliance and fraud prevention.

• Infrastructure Backups: If managed database backups exist, their availability and retention depend on the infrastructure provider plan and configuration in effect. They are not used to selectively reactivate a deleted account, except where a general restoration is required for disaster recovery.

• Support Fallback: If automated deletion fails, contact support@getauraleads.com from your account email to request manual verification and assistance. Response times may vary.