Privacy Policy

BuhoPilot ("we", "us", or "our") operates an online platform that assists users with resume optimisation, job search management, and related career services (the "Service"). This Privacy Policy explains how we process personal data in connection with the Service and describes your rights under applicable data protection law, including Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR").

By accessing or using the Service, you acknowledge that you have read this Privacy Policy. Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

The data controller responsible for your personal data is BuhoPilot. For any enquiry relating to this Privacy Policy or to the exercise of your data protection rights, you may contact us at privacy@buhopilot.com.

Depending on how you interact with the Service, we may process the following categories of personal data:

• Identity and contact data, such as name, email address, and account credentials.
• Profile and professional data, including career preferences, job search objectives, and information you choose to provide during onboarding.
• Job search query data, such as role, location, and employment-type filters you submit when searching for openings, and profile-derived role preferences used to suggest relevant listings.
• Content data, including resumes, cover letters, job descriptions, application notes, and other materials you upload or generate through the Service.
• Usage and technical data, such as log records, device and browser information, approximate location derived from IP address, and interaction data relating to your use of the Service.
• Transaction data, including subscription status, billing records, and payment-related identifiers processed by our payment partners.
• Communications data, comprising messages you send to us and records of support interactions.

We do not intentionally collect special categories of personal data as defined in Article 9 GDPR. You should refrain from including such information in materials uploaded to the Service unless strictly necessary and you have a lawful basis to do so.

We process personal data only where permitted by law. The principal purposes and corresponding legal bases are set out below.

Performance of a contract

We process account, profile, content, and transaction data as necessary to provide the Service, manage your subscription, authenticate your access, and fulfil our contractual obligations to you (Article 6(1)(b) GDPR).

Legitimate interests

We process usage data, security logs, and certain account information to maintain the security and integrity of the Service, prevent fraud and abuse, improve functionality, and understand aggregate usage patterns, where such interests are not overridden by your rights (Article 6(1)(f) GDPR).

Consent

Where required by law, we rely on your consent for non-essential cookies, certain marketing communications, and any optional processing for which consent is the appropriate legal basis (Article 6(1)(a) GDPR).

Legal obligation

We may process and retain data where necessary to comply with applicable legal, tax, accounting, or regulatory obligations (Article 6(1)(c) GDPR).

We use cookies and comparable technologies to operate the Service, maintain secure sessions, remember preferences, and analyse how the platform is used. Essential cookies are necessary for core functionality and do not require consent. Analytics and similar cookies may be presented through our cookie notice; further detail is provided in our Cookie Policy.

You may configure your browser to refuse cookies or alert you when cookies are sent. Disabling certain cookies may impair your ability to use some features of the Service.

We do not sell your personal data. We share personal data only with trusted third parties that assist us in operating the Service, subject to appropriate contractual safeguards, including:

• Infrastructure and hosting providers that store and transmit data on our behalf.
• Payment processors that handle subscription billing and related transactions.
• Analytics and product improvement partners that help us understand Service usage.
• Communication providers used to deliver transactional and support messages.
• Third-party job listing providers that return open roles matching your search or profile-derived preferences; search filters and related query parameters may be transmitted to these providers solely to retrieve listings.
• Professional advisers, auditors, or authorities where disclosure is required or permitted by law.

Where content is processed to deliver AI-assisted features, such processing occurs under our instructions and applicable data processing terms designed to protect your information.

Your personal data may be processed in the European Economic Area and, where necessary to deliver the Service, in countries outside the EEA that may not provide an equivalent level of data protection. In such cases, we implement appropriate safeguards as required by Chapter V GDPR, including Standard Contractual Clauses approved by the European Commission and supplementary measures where appropriate.

You may request further information regarding applicable transfer mechanisms by contacting us at the address set out in Section 2.

We retain personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Account and profile data are retained for the duration of your account and for a reasonable period thereafter to resolve disputes and comply with legal obligations.
• Content you upload or generate is retained until you delete it or close your account, subject to backup cycles and legal holds.
• Transaction and billing records are retained in accordance with applicable tax and commercial law requirements.
• Usage and security logs are retained for limited periods proportionate to security and diagnostic needs.

When personal data is no longer required, we securely delete or anonymise it in accordance with our retention procedures.

We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include access controls, encryption in transit, monitoring, and staff confidentiality obligations. No method of transmission or storage is entirely secure; we cannot guarantee absolute security.

Subject to applicable law, you have the following rights in relation to your personal data:

• Right of access to obtain confirmation as to whether we process your data and to receive a copy.
• Right to rectification of inaccurate or incomplete personal data.
• Right to erasure ("right to be forgotten") in certain circumstances.
• Right to restriction of processing in certain circumstances.
• Right to data portability in respect of data you provided, where processing is based on consent or contract and carried out by automated means.
• Right to object to processing based on legitimate interests, including profiling, and to object at any time to processing for direct marketing.
• Right to withdraw consent where processing is based on consent, without affecting prior lawful processing.
• Right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement.

To exercise any of these rights, please contact us at privacy@buhopilot.com. We may need to verify your identity before responding. We will respond within the time limits prescribed by applicable law, generally one month under the GDPR.

Certain features of the Service use automated processing, including AI-assisted analysis and content generation, to provide recommendations and outputs based on information you supply. These processes do not produce legal or similarly significant effects solely by automated means. Outputs are intended as assistive tools; you remain responsible for reviewing and deciding how to use them.

The Service is not directed to individuals under sixteen (16) years of age, and we do not knowingly collect personal data from children. If you believe that a child has provided personal data to us, please contact us promptly so that we may take appropriate steps to delete such information.

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. The "Last updated" date at the top of this page indicates when the policy was last revised. Material changes will be communicated through the Service or by other appropriate means where required by law.

For questions regarding this Privacy Policy or our data protection practices, please contact privacy@buhopilot.com. For general legal enquiries relating to the Service, you may contact legal@buhopilot.com.