Privacy Policy

BuhoPilot ("we", "us", or "our") operates an online platform that assists users with resume optimisation, job search management, and related career services (the "Service"). This Privacy Policy explains how we process personal data in connection with the Service and describes your rights under applicable data protection law, including Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR").

By accessing or using the Service, you acknowledge that you have read this Privacy Policy. Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

The data controller responsible for your personal data is BuhoPilot. For any enquiry relating to this Privacy Policy or to the exercise of your data protection rights, you may contact us at privacy@buhopilot.com.

Depending on how you interact with the Service, we may process the following categories of personal data:

• Identity and contact data, such as name, email address, and account credentials.
• Profile and professional data, including career preferences, job search objectives, and information you choose to provide during onboarding.
• Job search query data, such as role, location, and employment-type filters you submit when searching for openings, and profile-derived role preferences used to suggest relevant listings.
• Content data, including resumes, cover letters, job descriptions, application notes, and other materials you upload or generate through the Service.
• Interview audio and related data when you use Interview Debrief: microphone recordings you capture or upload (video is not recorded), transcripts, speaker labels, and AI-generated review notes.
• Third-party contact details you choose to store in the Service, such as names, job titles, emails, phone numbers, or profile URLs of recruiters or interviewers.
• Usage and technical data, such as log records, device and browser information, approximate location derived from IP address, and interaction data relating to your use of the Service.
• Transaction data, including subscription status, billing records, and payment-related identifiers processed by our payment partners.
• Communications data, comprising messages you send to us and records of support interactions.

We do not intentionally collect special categories of personal data as defined in Article 9 GDPR. You should refrain from including such information in materials uploaded to the Service unless strictly necessary and you have a lawful basis to do so.

We process personal data only where permitted by law. The principal purposes and corresponding legal bases are set out below.

Performance of a contract

We process account, profile, content, and transaction data as necessary to provide the Service, manage your subscription, authenticate your access, and fulfil our contractual obligations to you (Article 6(1)(b) GDPR).

Legitimate interests

We process usage data, security logs, and certain account information to maintain the security and integrity of the Service, prevent fraud and abuse, improve functionality, and understand aggregate usage patterns, where such interests are not overridden by your rights (Article 6(1)(f) GDPR).

Consent

Where required by law, we rely on your consent for non-essential cookies and analytics, certain marketing communications, Interview Debrief audio capture (you must agree in-product before recording starts), and any other optional processing for which consent is the appropriate legal basis (Article 6(1)(a) GDPR).

Legal obligation

We may process and retain data where necessary to comply with applicable legal, tax, accounting, or regulatory obligations (Article 6(1)(c) GDPR).

We use cookies and comparable technologies to operate the Service, maintain secure sessions, remember preferences, and, if you choose Accept all, analyse how the platform is used and (where deployed) measure marketing. Essential cookies are necessary for core functionality and do not require consent. Analytics cookies and our analytics SDK (including session replay), and marketing cookies when we use them, are loaded only after you choose Accept all. If you choose Essentials only, we keep session and security cookies — no PostHog and no marketing — and any leftover analytics cookies are cleared. Further detail is provided in our Cookie Policy.

You may configure your browser to refuse cookies or alert you when cookies are sent. Disabling certain cookies may impair your ability to use some features of the Service.

We do not sell your personal data. We share personal data only with trusted third parties that assist us in operating the Service, subject to appropriate contractual safeguards, including:

• Infrastructure and hosting: Vercel (application hosting and private file storage for interview audio) and Neon (PostgreSQL database).
• Payments: Stripe, which processes subscription billing. Card details are entered on Stripe-hosted pages, not on our forms.
• Analytics: PostHog (EU instance), used only if you choose Accept all. This may include pageviews, product events, error reports, account identifiers such as email, and session replay of on-screen activity (form fields are masked).
• Communications: Resend and/or Amazon SES for transactional email (verification, password reset, billing, and data-rights messages).
• Account sign-in: Google, when you choose Google sign-in (name, email, and profile image).
• Bot protection: Cloudflare Turnstile on signup and selected public forms.
• AI providers: Google Gemini for AI-assisted features (resume analysis, tailoring, outreach drafts, interview prep, mock interviews, and interview-debrief review). Anthropic Claude when you select that analysis option.
• Speech-to-text: AssemblyAI, which receives interview audio you submit via Interview Debrief in order to produce a transcript.
• Third-party job listing providers that return open roles matching your search or profile-derived preferences; search filters and related query parameters may be transmitted to these providers solely to retrieve listings.
• Professional advisers, auditors, or authorities where disclosure is required or permitted by law.

These providers process personal data on our instructions under contractual terms intended to protect your information.

Your personal data may be processed in the European Economic Area and, where necessary to deliver the Service, in countries outside the EEA that may not provide an equivalent level of data protection. In such cases, we implement appropriate safeguards as required by Chapter V GDPR, including Standard Contractual Clauses approved by the European Commission and supplementary measures where appropriate.

You may request further information regarding applicable transfer mechanisms by contacting us at the address set out in Section 2.

We retain personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Account and profile data are retained for the duration of your account and for a reasonable period thereafter to resolve disputes and comply with legal obligations.
• Content you upload or generate is retained until you delete it or close your account, subject to backup cycles and legal holds.
• Interview audio files are retained for a limited period (typically up to 48 hours) for transcription and then deleted. Transcripts and interview review notes remain with your account until you delete them or close the account.
• Transaction and billing records are retained in accordance with applicable tax and commercial law requirements.
• Usage and security logs are retained for limited periods proportionate to security and diagnostic needs.

When personal data is no longer required, we securely delete or anonymise it in accordance with our retention procedures.

We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include access controls, encryption in transit, monitoring, and staff confidentiality obligations. No method of transmission or storage is entirely secure; we cannot guarantee absolute security.

Subject to applicable law, you have the following rights in relation to your personal data:

• Right of access to obtain confirmation as to whether we process your data and to receive a copy.
• Right to rectification of inaccurate or incomplete personal data.
• Right to erasure ("right to be forgotten") in certain circumstances.
• Right to restriction of processing in certain circumstances.
• Right to data portability in respect of data you provided, where processing is based on consent or contract and carried out by automated means.
• Right to object to processing based on legitimate interests, including profiling, and to object at any time to processing for direct marketing.
• Right to withdraw consent where processing is based on consent, without affecting prior lawful processing.
• Right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement.

To exercise any of these rights, please contact us at privacy@buhopilot.com. We may need to verify your identity before responding. We will respond within the time limits prescribed by applicable law, generally one month under the GDPR.

Certain features of the Service use automated processing, including AI-assisted analysis and content generation, to provide recommendations and outputs based on information you supply. These processes do not produce legal or similarly significant effects solely by automated means. Outputs are intended as assistive tools; you remain responsible for reviewing and deciding how to use them.

The Service is not directed to individuals under sixteen (16) years of age, and we do not knowingly collect personal data from children. If you believe that a child has provided personal data to us, please contact us promptly so that we may take appropriate steps to delete such information.

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. The "Last updated" date at the top of this page indicates when the policy was last revised. Material changes will be communicated through the Service or by other appropriate means where required by law.

For questions regarding this Privacy Policy or our data protection practices, please contact privacy@buhopilot.com. For general legal enquiries relating to the Service, you may contact legal@buhopilot.com.