Privacy Policy

1. Who we are

StashXP is a career-ledger service that helps you capture your professional achievements, generate tailored CVs, and discover relevant job opportunities. This policy explains what data we collect, why we use it, and the rights you have.

Contact: info@stashxp.com

2. What data we hold

• Account data: email address, name, authentication identifiers from our auth provider.
• Profile data: headline, location, bio, contact preferences, and your public-vault settings.
• Career ledger: roles, achievements, metrics, skills, dates, uploaded files, and visibility settings for each item.
• Job-match data: saved job posts, your career ambitions, search criteria, and any notes you add.
• Generated content: tailored CVs created from your ledger and a job post.
• Usage data: beta quota counters and AI-credit estimates used for cost control.
• Consent records: whether you have opted in to newsletters, plus the time and source of each choice.

3. Why we process it (legal bases)

• Contract / service provision: account, career ledger, CV tailoring, job matching, and beta seat management.
• Consent: newsletters, product updates, and marketing emails. You can withdraw consent in Settings at any time.
• Legitimate interest: service emails, security, cost control, and preventing abuse.
• Legal obligation: keeping records required by tax or accounting law, and responding to lawful requests.

4. AI processing

When you tailor a CV, parse a job post, or import a resume, the relevant text is sent to an AI provider. We use the output only to produce the feature you requested. Your data is not used to train public AI models.

CV tailoring, job scoring, and import suggestions are decision-support features, not legally significant automated decisions. You are always in control of what you send to employers or publish.

5. Sharing and visibility

Nothing in your ledger is visible to others unless you explicitly mark items as Shared and enable your public vault. Shared vault links are link-only: they are not indexed by search engines and are marked for AI crawlers not to use.

We do not sell your data. Third parties involved are limited to hosting/database, authentication, AI services, and email delivery providers.

6. Subprocessors and international transfers

We use the following categories of subprocessors to run StashXP:

• Cloud hosting and database services.
• Authentication provider.
• AI / large language model providers.
• Email delivery services.

Some of these providers process data outside the country where you live. Where this is a transfer under GDPR, we rely on appropriate safeguards such as the EU Commission Standard Contractual Clauses or equivalent transfer mechanisms.

7. Cookies and storage

We use only essential browser storage to keep you signed in and remember small UI state such as the sidebar. No analytics or advertising trackers are active today. If we add them, we will ask for your consent first.

You can review or change your cookie choices any time via the Cookie settings panel.

8. Retention and deletion

We keep your data while your account is active. You can delete individual ledger entries, roles, saved jobs, and tailored CVs at any time. You can also download your data and delete your entire account from Settings.

• Active account data: kept for as long as you have an account.
• Deleted account data: erased within 30 days of deletion, except where a longer period is required by law.
• Marketing consent records: kept for up to 2 years after you withdraw consent to demonstrate compliance.
• Usage and billing records: kept for up to 7 years where required for tax or accounting purposes.

9. Your rights

Under GDPR and similar laws, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate information.
• Delete your data and account.
• Export or receive a copy of your data.
• Object to or restrict certain processing.
• Withdraw marketing consent at any time in Settings.
• Lodge a complaint with your local supervisory authority.

To exercise any right, use the in-app controls in Settings or email info@stashxp.com. We will respond within 30 days and may ask you to verify your identity.

If you are in the EU/EEA and believe we are not handling your data lawfully, you can complain to your local data-protection authority or, if you prefer, to the supervisory authority in [country of establishment to be filled in].

10. Changes to this policy

We may update this policy as the service evolves. If the changes are material, we will notify you by email or through the app.

11. Contact us

Questions or requests about your data? Email info@stashxp.com.