SteadyCV

Privacy Policy

Last updated: July 1, 2026

This Privacy Policy explains how Daniil Iashin, an individual entrepreneur registered in Georgia ("we", "us") collects, uses and shares personal data when you use SteadyCV (the "Service"). We keep it plain: a resume is personal data by definition, so we treat everything you put into the Service as sensitive and use it only to run the product.

1. Data we collect

Data you provide

  • Account data — email address, name (optional), password (stored as a salted hash).
  • Resume and cover-letter content — everything you enter or import: work history, education, contact details, photo (if you add one), job descriptions you paste, application notes.
  • Feedback — messages you send us through the in-app feedback form or by email.

Data collected automatically

  • Usage events — first-party analytics (pages viewed, features used, A/B test assignments) recorded by our own backend. We do not use third-party advertising trackers.
  • Technical data — IP address, browser type and device information from server logs, kept for security and debugging.
  • Local storage — we store your session token, language preference and an anonymous identifier in your browser's local storage. We do not use advertising cookies.

Chrome extension data

When you open the SteadyCV Chrome extension, it reads only the active tab that you chose to open it on. On a job posting, the extension extracts the page URL, job title, company, location and job description. The URL is sent to SteadyCV to check whether you already saved the posting, and the job description and selected resume identifier are sent to calculate the resume-match preview. We also record limited first-party usage events such as the site domain, whether a posting was detected, and which extension action was used.

On your own open LinkedIn profile, detected profile fields are processed locally in the extension popup and are sent to SteadyCV only after you choose a destination resume and confirm the import. Autofill retrieves contact details from your SteadyCV account and inserts them into supported fields on the active application page only after you click the Autofill action. The extension does not read your browser history or inactive tabs.

The extension stores its SteadyCV access token, selected resume identifier and the status of an in-progress tailoring request in chrome.storage.local. Chrome may show a completion or error notification after a tailoring request you started.

Payment data

Payments are processed by Freemius.com as Merchant of Record. Your card details go directly to Freemius and never touch our servers. We receive from Freemius only your subscription status, plan and transaction identifiers.

2. How we use your data

  • To provide the Service: store and render your resumes, generate exports, track your applications.
  • To provide AI features: when you explicitly trigger an AI action, the relevant resume content and job description are sent to our AI provider (see section 4) and the result is returned to you.
  • To operate billing, quotas and plan limits.
  • To send transactional email (account, billing, product notifications). Marketing email is sent only with your consent and always has an unsubscribe link.
  • To improve the product using aggregated, first-party usage analytics.
  • To keep the Service secure and prevent abuse.

We do not sell your personal data, share it with advertisers, or use your resume content to train AI models.

SteadyCV's use and transfer of information received through the Chrome extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Extension data is used only to provide, secure, measure and improve the user-facing job-search features described above. It is not used for personalized advertising, credit decisions or sale to data brokers, and is not made available for humans to read except with your explicit support consent, for security, or where required by law.

3. Legal bases (GDPR)

Where the GDPR applies, we process your data on the basis of: performance of a contract (providing the Service you signed up for), legitimate interests (security, first-party analytics, product improvement), consent (marketing email), and legal obligations (tax and accounting records held by Freemius).

4. Processors we share data with

  • Freemius Inc. — payment processing and tax handling (Merchant of Record).
  • Anthropic PBC — AI processing. When you use an AI action, resume text and the job description are sent to the Anthropic API. Per Anthropic's commercial API terms, this data is not used to train models.
  • Resend — transactional and (with consent) product email delivery.
  • Hosting providers — Railway (application hosting) and Vercel (frontend hosting) run our servers; Neon (PostgreSQL, London, UK) hosts our database.

Each processor receives only the data needed for its function and is bound by a data processing agreement.

5. Retention and deletion

  • Your Content is kept while your account is active.
  • If you delete your account, we delete your account data and Your Content within 30 days, except records we must keep for legal reasons (billing records are retained by Freemius).
  • Server logs are retained for up to 90 days.
  • Inactive free accounts may be deleted after prolonged inactivity; we will email you first.

6. Your rights

Depending on your location, you have the right to access, correct, export, restrict or delete your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time. You can exercise most of these directly in the app (edit or delete your resumes, delete your account in Settings) or by emailing us. You also have the right to lodge a complaint with your local data protection authority.

7. International transfers

Our processors may store data outside your country, including in the United States. Where required, transfers are protected by Standard Contractual Clauses or an equivalent safeguard.

8. Security

We use encryption in transit (TLS), hashed passwords, access controls and isolation between users' data. No online service is perfectly secure; if a breach affects your personal data we will notify you and the relevant authority as required by law.

9. Children

The Service is not directed at children under 16 and we do not knowingly collect their data.

10. Changes and contact

We may update this Policy; material changes are announced by email or in-app notice before they take effect. Data controller: Daniil Iashin (Individual Entrepreneur), Georgia.

Privacy questions and requests: [email protected].