Privacy Policy.

1. Who we are

Track & Crack ("we", "us", "our") operates an AI-powered job application platform that helps candidates build structured profiles from their CVs. This policy explains how we handle your data when you use our service at trackandcrack.co.

2. What data we collect

We collect the following categories of personal data:

• Account information -- name, email address, and phone number provided during sign-up or onboarding.
• CV and career data -- uploaded CV files, work history, education, skills, and location preferences you share with us.
• Chat conversations -- messages exchanged during our AI-assisted onboarding chat, used to build your candidate profile.
• Usage data -- pages visited, features used, browser type, device information, and IP address, collected automatically.
• Authentication data -- login credentials and authentication tokens managed through Firebase Authentication.
• Billing data -- if you subscribe to Pro or Unlimited, Stripe processes your payment details. We receive and store your Stripe customer ID, subscription status, plan, and billing period. We never see or store your card number.

3. How we use your data

We use your data to:

• Build your candidate profile -- we structure your CV data, work history, and chat responses into a structured profile that represents you to potential employers.
• AI processing -- we use AI (Anthropic Claude) to analyse your CV, extract relevant information, generate fit scores, and produce profile summaries.
• Power your applications -- when you apply to a job posted on Track & Crack, the employer who posted that role sees your profile so they can review your fit. Employers only see candidates who explicitly applied to their role. Section 5 lists exactly what they see.
• Improve the service -- we use aggregated, anonymised usage data to improve our platform's features and user experience.
• Communicate with you -- to send service-related notifications, application updates, fit score reports, and support responses.

4. Third-party services

We rely on the following third-party services to operate our platform:

• Google Firebase -- for authentication (Firebase Auth), database (Firestore), and file storage (Firebase Storage). Google's privacy policy applies to data processed through Firebase. Data is stored in EU regions where available.
• Anthropic (Claude API) -- for AI-powered CV analysis, chat processing, fit scoring, CV and cover letter generation, and profile enrichment. Your CV content and chat messages are sent to Anthropic's API for processing. Anthropic does not use API inputs to train their models.
• Mistral AI (Document AI) -- for parsing and extracting text from uploaded CV files. Your CV file is sent to Mistral for text extraction. Mistral does not use API inputs to train their models.
• Stripe -- for payment processing on Pro and Unlimited subscriptions. Your card details go directly to Stripe and never touch our servers. We receive a customer ID, subscription status, and plan details. Stripe's privacy policy applies to payment data.
• Resend -- for transactional and service-related emails (account notifications, application updates, subscription receipts). Your email address and first name are shared with Resend for email delivery.

We do not sell your personal data. Ever. We do not share it with advertisers or data brokers. The only time your profile is shared with another party is when you explicitly apply to a job posted on Track & Crack, in which case the employer who posted that role sees your profile as described in section 5.

5. What employers see when you apply

Employers using Track & Crack cannot browse or search candidates. They only see profiles of candidates who explicitly apply to one of their posted jobs. You control which roles you apply to.

When you apply to a job, the employer who posted it can see:

• Your name, email address, and location
• Your fit score and fit summary for their specific role
• Your skill clusters, work history, and experience bullets (your profile)
• The tailored CV and cover letter you submit with the application

Employers cannot see:

• Your original uploaded CV file
• Your chat history or onboarding conversations
• Other jobs you have applied to or your activity outside their role
• Your profile if you did not apply to their job

You can withdraw an application or request removal from a specific employer's applicant list at any time by emailing hello@trackandcrack.co.

6. Automatic account creation

When you apply to a role through Track & Crack or upload your CV, we automatically create a candidate profile on our platform. This profile is built from the information in your CV and is used to generate fit scores and provide you with career tools. You can access and manage your profile by signing in with the email address from your CV. You can request deletion of your profile at any time through the platform settings or by emailing hello@trackandcrack.co.

7. Data storage and security

Your data is stored in Firebase (Google Cloud) infrastructure. We use industry-standard security measures including encrypted connections (TLS), secure authentication tokens, and access controls. CV files are stored in Firebase Storage with restricted access rules.

While we take reasonable steps to protect your data, no method of electronic storage is 100% secure. We cannot guarantee absolute security but we take it seriously and respond quickly to any incidents.

8. Your rights under GDPR

If you're in the European Economic Area, you have the following rights:

• Access -- request a copy of the personal data we hold about you.
• Correction -- ask us to correct inaccurate or incomplete data.
• Deletion -- ask us to delete your personal data. We will remove your account and associated data, subject to any legal retention obligations.
• Portability -- request your data in a structured, machine-readable format.
• Restriction -- ask us to restrict processing of your data in certain circumstances.
• Objection -- object to processing based on legitimate interests.

To exercise any of these rights, email us at hello@trackandcrack.co. We will respond within 30 days.

9. Cookies and local storage

We use essential cookies and browser local storage to keep you signed in and remember your preferences. We do not use third-party tracking cookies or advertising cookies. Firebase Authentication uses cookies to manage your session.

10. Data retention

We keep your data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where we are required by law to retain it. Anonymised, aggregated data may be retained indefinitely for analytics purposes.

11. Children's privacy

Our service is not intended for anyone under the age of 16. We do not knowingly collect data from children. If you believe we have collected data from a minor, please contact us and we will delete it promptly.

12. Changes to this policy

We may update this policy from time to time. When we make significant changes, we will notify you through the platform or by email. The "effective date" at the top of this page indicates when the policy was last updated.

13. Contact us

If you have questions about this privacy policy or how we handle your data, reach out to us at hello@trackandcrack.co.