Privacy Policy

1. Who we are

Skillarq (“we”, “us”, or “our”) operates the website at skillarq.com. We build tools that help individuals manage their career history and generate tailored job application materials.

Questions about this policy can be directed to [email protected].

2. Browser extension

We publish a browser extension (“Skillarq Job Matcher”) for Google Chrome and compatible browsers. When you click Match this job, the extension reads the visible text of your currently active browser tab using the browser’s built-in scripting API. That text is appended as a URL parameter and you are navigated to skillarq.com/dashboard/match where it is processed by the web application under the same terms as any other job description you paste manually.

The extension does not make independent network requests, does not collect data in the background, does not read tabs you have not explicitly asked it to process, and does not store anything locally beyond what the browser caches for normal page loads. Job description text captured by the extension is handled under the same privacy terms as Section 3 below.

3. What we collect

• Account information: your name, email address, and a hashed password when you register.
• Resume content: text extracted from resume files you upload, including work experience, job titles, employers, dates, skills, and accomplishments.
• Job descriptions: text from job postings you paste into the match tool.
• Usage data: standard server logs including IP address, browser type, pages visited, and timestamps. We do not build advertising profiles from this data.
• Analytics: we use Vercel Analytics to collect anonymous, aggregate page-view data (no cookies, no cross-site tracking, no personally identifiable information).
• Session data: a secure, HttpOnly cookie is set when you log in to maintain your session. No third-party tracking cookies are set.

We do not collect or store payment card numbers. If you purchase a credit pack, payment is processed by Stripe. We receive a customer identifier and transaction status only; your card details go directly to Stripe and never touch our servers.

4. How we use your data

• To operate the service: store your career history, run job-fit matching, and generate resume drafts.
• To send transactional emails: account verification, password resets, billing receipts, and important service notices. We do not send marketing or promotional emails.
• To improve the product: aggregate, anonymised usage patterns only. Individual resume content is never used for model training by us.
• To enforce our Terms of Service and prevent abuse.

5. Third-party services

We rely on the following third parties to provide the service. By using Skillarq you acknowledge that your data passes through these processors under their respective privacy agreements.

• OpenAI- Resume text and job descriptions are sent to OpenAI’s API to extract skills, generate match scores, and draft resume content. OpenAI’s API usage policy states that API inputs and outputs are not used to train OpenAI models by default.
• Neon - Encrypted PostgreSQL database hosting where your account and career data is stored.
• Upstash - Redis used for rate limiting. Only anonymised request counts are stored; no personal content is held there.
• Stripe - Payment processing for credit pack purchases. Card data is handled entirely by Stripe and is subject to Stripe’s Privacy Policy. We store only your Stripe customer ID and transaction history.
• Resend - Transactional email delivery for verification, password reset, and billing emails.
• Vercel - Web hosting and serverless infrastructure. Standard access logs apply. We also use Vercel Analytics for anonymous, cookieless page-view statistics.

We do not sell, rent, or share your personal data with advertisers or data brokers.

6. Data retention

Your data is retained for as long as your account is active. If you delete your account, your profile, work history, skills, and uploaded content are permanently deleted within 30 days. Server logs may be retained for up to 90 days for security purposes.

7. Your rights

Depending on where you are located you may have rights to access, correct, export, or delete your personal data. To exercise any of these rights, email [email protected] and we will respond within 30 days.

As a Canadian business, we operate under PIPEDA (the Personal Information Protection and Electronic Documents Act). If you are in the European Economic Area, you have additional rights under GDPR. If you are a California resident, you have rights under CCPA. We honour these rights regardless of where you live.

8. Security

Passwords are hashed using bcrypt and never stored in plain text. Data in transit is encrypted via TLS. Database connections require SSL. Despite these measures, no system is perfectly secure. Use a strong, unique password and enable email verification.

9. Children

Skillarq is not directed at children under 16. We do not knowingly collect data from anyone under 16. If you believe a minor has registered, contact us and we will delete the account promptly.

10. Changes to this policy

We may update this policy from time to time. Material changes will be notified via email or a banner on the site before they take effect. Continued use after the effective date constitutes acceptance.