Privacy Policy

This policy covers the ecareer.ai website and application (the “Service”), operated by ecareer Co., Ltd. ((주)이커리어, Seoul, Republic of Korea) (“we”, “us”). It applies to everyone who visits the site or creates an account. Questions about this policy go to privacy@ecareer.ai.

We collect only what the Service needs to work. In concrete terms:

• Account information — email address, name (optional), password (stored only as a hash by our authentication provider), and UI language.
• Profile information — education, work experience, skills, research background, nationality, visa / work-permit status, residence country, and target job markets. You choose how much of this to provide; more detail improves matching accuracy.
• Uploaded documents — CV / resume, academic papers, portfolios, and similar files you upload for analysis. These are stored in private storage that is not publicly accessible and is scoped to your account.
• AI analysis results — structured profiles, match scores, gap analyses, and document feedback that our systems derive from your profile and documents.
• Job interaction data — jobs you save, hide, apply to (including your confirmation of whether you applied), and clicks on job postings, together with timestamps.
• Consent records — when you agree to the Terms of Service and this policy at signup, we record the consent choices, the policy version, the date and time, your IP address, and your browser user agent. This is a legal audit trail required to prove consent.
• Technical data — standard server logs (IP address, request metadata) used for security and operations.

We do not collect data from your device beyond what is described here, and we do not buy data about you from data brokers.

• Job matching and analysis — your profile and documents are analyzed to compute match scores, gap analyses, and document feedback. This is the core of the Service.
• Operating the Service — authentication, saving your tracker and filters, remembering your language, and showing you your own history.
• Service communications — emails you request or that the Service requires (e.g., email verification, password reset). Marketing email is sent only if you opted in, and every message includes an unsubscribe link.
• Security and abuse prevention — detecting multiple-account abuse, unauthorized access, and scraping.
• Improving the Service — aggregate, de-identified usage statistics (e.g., how many users saved a job). We do not use the content of your uploaded documents to train our own or third-party AI models.

We do not sell your personal information, and we do not share it with advertisers.

• Consent — you agree to this policy at signup, and separately opt in (or not) to marketing email. You can withdraw consent at any time; withdrawal does not affect processing that already happened.
• Contract — processing needed to provide the Service you signed up for (matching, analysis, storage of your documents).
• Legal obligation — retaining consent records and responding to lawful requests.
• Legitimate interests — service security, abuse prevention, and operational logging, balanced against your rights.

We use a small number of infrastructure providers to run the Service. They process data only on our instructions, under their own contractual and security commitments:

If we add or replace a processor that handles personal data, we will update this table before the change takes effect.

The Service is available worldwide, and our infrastructure is operated from a small number of specific locations. Our primary database, authentication, and file storage (Supabase) are hosted in Seoul, South Korea. Cloudflare serves and secures traffic through its global edge network, which routes requests through data centers near you. AI analysis (OpenAI) and OCR (Google Cloud Vision) requests are processed on those providers' servers, primarily in the United States. Wherever you live, using the Service therefore means your data may be transferred to and processed in a country other than your own. We apply the protections described in this policy regardless of where processing happens, and we rely on our processors' standard data-protection commitments for cross-border transfers. Where the law of your country imposes additional cross-border transfer requirements, we honor the rights described in Section 8 for you in the same way.

• Account, profile, documents, and analysis results — kept while your account exists. When you delete your account, these are deleted, including your uploaded files in storage.
• Consent records — retained after account deletion for as long as applicable law requires us to be able to prove that consent was given.
• Server and security logs — kept for a short operational window, then deleted or de-identified.

You can delete your account yourself at any time from your profile page (Profile → Delete account). Deletion is not reversible.

Wherever you live, you can: access the data we hold about you, correct it, delete it (via in-app account deletion or by contacting us), export your data, and withdraw marketing consent. We do not discriminate against you for exercising these rights. Region-specific notes:

• South Korea (PIPA) — you may request access, correction, deletion, and suspension of processing of your personal information. Consent records are kept as required by the Personal Information Protection Act.
• United States / California (CCPA/CPRA) — you have the rights to know, delete, correct, and opt out of “sale” or “sharing” of personal information. We do not sell or share personal information as defined by the CCPA.
• India (DPDP Act) — you have the rights to access, correction, erasure, and grievance redressal. Privacy inquiries and grievances: privacy@ecareer.ai.
• Canada (PIPEDA) — you may request access to and correction of your personal information, and challenge our compliance with the fair information principles.
• Australia (Privacy Act / APPs) — you may request access to and correction of your personal information, and complain to us (and then to the OAIC) about a privacy breach.
• Vietnam (PDPL) — you may request access, correction, deletion, restriction of processing, and withdrawal of consent for your personal data, and we respond within the timelines Vietnamese law prescribes.
• EEA / United Kingdom (GDPR / UK GDPR) — you have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with your supervisory authority.
• Other regions — the baseline rights listed above (access, correction, deletion, export, and marketing opt-out) are available to every user, wherever you live.

To exercise any of these rights, email privacy@ecareer.ai from the address on your account. We respond within the timeline required by the applicable law, and in any case within 10 days of a verified request.

The Service is a professional career platform and is not directed at children under 18. We do not knowingly collect personal information from children under 18; if you believe a child has created an account, contact us at privacy@ecareer.ai and we will delete it.

Measures we actually have in place today:

• Encryption in transit (TLS) for all connections, and encryption at rest for the database and file storage.
• Row-level security in the database — each user's records are isolated so one account cannot read another's data.
• Uploaded documents live in private storage buckets. Access requires your authenticated session; downloads use short-lived signed links (valid for 60 seconds) issued only to your session.
• Least-privilege access controls: administrative credentials are separated from application credentials and are not exposed to the client.
• Consent and security events are logged for auditability.

No internet service can guarantee absolute security, and we will not claim otherwise. If you find a vulnerability, please report it to security@ecareer.ai — we read every report.

If a data breach affects your personal information, we will notify you and the relevant supervisory authorities without undue delay, as required by the applicable law of your region, and we will tell you plainly what happened, what data was involved, and what we are doing about it.

The Service currently has no paid checkout. When paid plans launch, payments will be handled by a dedicated payment processor (such as Stripe); your full card number will be processed by that provider and will not be stored on our servers. This policy will be updated with specifics before any payment goes live.

The Service uses only functional cookies — the ones it needs to work:

• Authentication — session cookies set by our authentication provider (Supabase) that keep you securely signed in.
• Language — an i18n_locale cookie that remembers your interface language.
• Interface preferences — your browser's local storage may hold small display settings (for example, desktop mode on a mobile device). These stay on your device.

We do not use advertising cookies or cross-site tracking cookies, and we do not embed third-party advertising or social-media tracking scripts. Usage measurement comes only from our own server logs and the aggregate statistics described in Section 3. Because every cookie we set is strictly necessary for the Service to function, there is no separate cookie banner — this section is the complete list.

When we change this policy materially, we will update the version and effective date at the top of this page and notify you in the Service (or by email for significant changes) before the new version takes effect. Where a change requires fresh consent under your local law, we will ask for it rather than assume it.

• Privacy requests and data rights: privacy@ecareer.ai
• General support: support@ecareer.ai
• Security reports: security@ecareer.ai