MyCareerCopilot ("we", "us", "our") operates the website at mycareercopilot.ca and the MyCareerCopilot Chrome browser extension (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the rights you have.
1. Single Purpose & What the Service Does
MyCareerCopilot is an AI-assisted career management platform. The Service helps you discover job opportunities that match your skills, tailor application materials (resumes and cover letters) to specific roles, prepare for interviews, and explore career paths. The accompanying Chrome extension helps you autofill repetitive job application forms on supported job boards. We do not perform actions on your behalf without your explicit click-through approval.
2. Information We Collect
2.1 Account information you provide
- Name, email address, and password (encrypted at rest)
- Authentication identifier from Google when you sign in with Google
- Optional profile information: phone, address, work authorization status, links to LinkedIn/portfolio
- Resume file uploads (PDF / DOCX) and the parsed text extracted from them
- Job application history and notes you create
- Saved job listings and career path selections
2.2 Information collected automatically
- Session cookies needed to keep you signed in (HttpOnly, Secure, SameSite)
- CSRF security tokens
- IP address and basic browser metadata, used only for security (rate limiting, brute-force detection)
- Audit logs of significant account activity (logins, failed login attempts, admin actions)
- Per-feature monthly usage counters to enforce free-tier limits
2.3 Information collected by the Chrome extension
- The URL of the job posting you are viewing at the moment you click the extension icon
- The structure of the application form being filled (field labels, not other users' data)
- The values pulled from your account profile that are written into the form on your click
The extension does not read or transmit pages you visit when the extension is idle. It only activates when you click the extension icon on a recognized job application page.
2.4 Payment information
Payments are processed by Stripe. We never see or store your full credit card number, CVV, or bank account number. Stripe provides us only a customer ID, your subscription status, and the last four digits of the card for receipt purposes.
3. How We Use Your Information
- To create and maintain your account
- To autofill job applications on your explicit request
- To generate AI-tailored resumes, cover letters, interview prep, and career path recommendations
- To process subscription payments and send billing receipts
- To send transactional emails (welcome, password reset, email verification, subscription notices)
- To protect the Service against abuse, fraud, and brute-force attacks
- To comply with legal obligations
We do not use your data for marketing to third parties. We do not sell your data. We do not train AI models on your resume content or application history.
4. Service Providers We Share Data With
We use a small number of trusted third-party processors to operate the Service. Each receives only the data needed for its specific function:
- Stripe — payment processing. Sees your billing info and email. Their privacy policy is at stripe.com/privacy.
- Resend — transactional email delivery. Sees your email address and the content of the emails we send you (welcome, password reset, etc.).
- OpenAI and Anthropic — power our AI features (resume tailoring, interview prep, career coach). Snippets of your profile and the specific prompt for each request are sent. OpenAI / Anthropic state in their API terms that they do not train their models on API-submitted data.
- Google OAuth — only if you choose to sign in with Google. Google sees only that you used your Google account to log in. We receive your name, email, and Google account ID.
- JSearch (RapidAPI) — used to discover job listings across multiple job boards. We send only the search query you enter.
- MongoDB Atlas — encrypted database hosting for your account and content. Hosted in North America.
We do not share your data with advertisers, data brokers, or marketing networks.
5. Data Security
- All connections to and from the Service use HTTPS (TLS 1.2+).
- Passwords are hashed with bcrypt (industry standard).
- Sensitive profile fields (e.g., resume text, phone, address) are encrypted at rest in our database.
- Session cookies are HttpOnly, Secure, and SameSite to mitigate XSS and CSRF.
- The application has a CSRF middleware that rejects state-changing requests without a matching CSRF token.
- Rate limiting and account lockout protect against brute-force attacks.
- Admin actions are recorded in audit logs.
No system is perfectly secure. If we ever discover a breach involving your personal information, we will notify you by email within 72 hours of confirming it.
6. Data Retention
- While your account is active, we retain your data so the Service can function.
- You can request deletion of your account and all associated data at any time by emailing support@mycareercopilot.ca. Deletion is completed within 30 days.
- Some records (audit logs, payment receipts) may be retained for up to 7 years to comply with tax and accounting laws.
- Backup snapshots are retained for up to 30 days after deletion before being purged.
7. Your Rights
Depending on where you live, you may have the following rights under laws such as GDPR (EU/UK), PIPEDA (Canada), and CCPA/CPRA (California):
- Right to access a copy of your data
- Right to correct inaccurate data
- Right to delete your account and data
- Right to port your data to another service in a machine-readable format
- Right to object to certain processing
- Right to withdraw consent at any time (where processing is based on consent)
To exercise any of these rights, email support@mycareercopilot.ca. We respond within 30 days.
8. Children's Privacy
MyCareerCopilot is not directed at children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us information, contact us and we will delete it.
9. Cookies & Tracking
We use only the cookies strictly necessary to operate the Service: the session cookie that keeps you signed in, and the CSRF cookie that protects against cross-site request forgery. We do not use third-party advertising or tracking cookies, and we do not employ analytics scripts that fingerprint your device.
10. International Data Transfers
MyCareerCopilot is operated from Canada. Some of our service providers (Stripe, OpenAI, Anthropic, Resend) operate primarily in the United States. When your information is transferred internationally, we rely on appropriate safeguards including standard contractual clauses where required by law.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we make a material change, we will notify you by email (using the address associated with your account) and update the "Last updated" date at the top of this page at least 14 days before the change takes effect.
12. Contact Us
If you have any questions about this Privacy Policy or our data practices, contact us at support@mycareercopilot.ca.
Data Controller: MyCareerCopilot, Canada
