Privacy Policy

Last updated: 16 October 2026

This Privacy Policy explains how Antonio Alves Neto, Ehrhartstrasse 47, 67141 Neuhofen, Germany ("we", "us") collects and uses your personal data when you use HireReady24 (the "Service"), with or without an account. We are the data controller for this processing. Contact: hello@hireready24.com.

1. What we collect

Account data (via our auth provider, Clerk): your name, email address, and phone number, and authentication metadata.
Content you provide: the information you enter or upload to use the Service — your CV, job descriptions, and the documents the Service generates for you.
The free fit check, without an account: the job posting you paste, or that we read from a link you give us, and the report we build from it. The demo compares the posting with a fictional sample candidate, not with you. If you check your own CV, we also collect the CV text you paste, or that we read from a file you upload, and how our AI read it. We do not ask for your name, your email address or an account, although the CV you paste or upload may contain them. Please leave health details, religion and other sensitive information out of the CV you paste or upload; the check does not need them.
Request counters: to limit how often the free check can be run, and how often a CV file or a job link can be read, we count requests per IP address. We do not store the address itself, only a hashed form of it combined with the date.
Payment data: when you buy credits, payment is processed by Polar as Merchant of Record. Polar collects your payment details and billing information; we do not receive or store your card data. We receive confirmation of a purchase (e.g. transaction reference, pack, amount).
Usage and technical data: basic logs and product-usage information needed to operate and secure the Service.

2. Why we use it (legal bases)

To provide the Service you request — creating and tailoring your documents (performance of a contract). This includes sending your content to our AI provider to generate outputs.
To process payments and provide credits (performance of a contract).
To show you a free fit check of a job posting without an account. For the demo, which compares the posting with a fictional sample candidate, we rely on our legitimate interest in letting visitors try the Service (legitimate interests). If you check your own CV, we read it, write your report and keep them for a short time so that you can save the report to a new account (steps taken at your request before entering into a contract).
To secure and improve the Service and prevent abuse, including limiting free-trial farming and how often the free check can be run (legitimate interests).
To comply with legal and tax obligations (legal obligation).

We do not sell your personal data.

3. AI processing

To generate and tailor your documents, and to produce the free fit check, the content you submit is sent to our AI provider, Anthropic (the provider of the Claude models), for processing. If you check your own CV in the free fit check, Anthropic first reads the CV text you paste, or that we read from your file, and puts it into a structured form, and then compares it with the job posting and writes your report. Anthropic receives only that text, never your file or your link. Anthropic does not use inputs or outputs submitted through its API to train its models.

When we match your CV against a job description in your account, we also send the same material to a second AI provider, Typesafe, whose model gives us an independent opinion on the requirements our AI found not met or only partly met. Typesafe receives the job's requirements, your CV without its contact details (your name, headline and location) and your saved stories, limited to those our matching uses. We use its opinion to check and improve the quality of our matching (legitimate interests, see section 2). Its opinion never decides anything by itself: where it disagrees, our own AI may check that requirement again, and we may suggest clearer wording for a line of your CV. Your score and your documents change only through our own AI's checks and the choices you make. Typesafe deletes this content as soon as it has answered (zero data retention) and does not use it to train its models. We do not send a free fit check made without an account to Typesafe.

We also keep a separate copy of some raw inputs and outputs of this processing so that we can check and improve its quality: the text of the CV you paste or upload and how our AI read it, the input to and the result of matching your CV against a job description (including the job's requirements and your saved stories), and the answers you write in the story step together with the drafts written from them. We do this to improve the Service (legitimate interests, see section 2), and you can object to it as described in section 7. These copies are deleted automatically after 90 days, or together with your account if it is deleted first. We use them only for this quality analysis, and we do not use them to train AI models.

We keep no such copy of a free check made without an account.

4. Who we share it with (processors)

We share data only with service providers who process it on our behalf under appropriate agreements:

Clerk — authentication and account management.
Polar — payments, tax, and receipts (as Merchant of Record).
Anthropic — generating and tailoring your documents and the free fit check (AI processing).
Typesafe (TypeSafe AI, Inc.) — a second opinion on how your CV matches a job's requirements (AI processing), with zero data retention. Typesafe and its sub-processors are based in the United States.
Render — cloud hosting and infrastructure, including the application, database (PostgreSQL) and cache (Redis), located in the EU (Frankfurt, Germany).
Better Stack — application logs, used to operate, monitor and secure the Service. The logs contain technical data such as account and request identifiers and, occasionally, an IP address. We do not write the text of your CV, your job descriptions or your documents to our logs, although an error message can occasionally include a fragment of the content being processed.
PostHog — privacy-friendly product analytics, used only with your consent (see Cookies and browser storage below). We use PostHog Cloud EU, hosted in the EU (Frankfurt, Germany), under a Data Processing Agreement, with IP addresses anonymized. Analytics are not loaded and no analytics cookies are set unless you opt in.
Reddit — advertising measurement, used only with your consent (see Cookies and browser storage below). If you accept, the Reddit advertising pixel loads and reports that you visited one of our advertising landing pages and, where applicable, that you created an account, so that we can measure which advertisements work. It does not receive your name, email address, or any content you submit to us. If you decline, the pixel is never loaded and Reddit is not contacted at all. Reddit Inc. is based in the United States.

5. International transfers

Our hosting infrastructure (Render) is located in the EU (Frankfurt, Germany). Some other providers are based in the United States and may process limited data outside the EEA — in particular Clerk (authentication), Polar (payments), Anthropic (AI processing), Typesafe (AI processing, a second opinion on matching) and, only if you accept advertising cookies, Reddit (advertising measurement). Where data is transferred outside the EEA, those transfers are protected by appropriate safeguards, principally the European Commission's Standard Contractual Clauses together with supplementary measures where required.

6. Retention

We keep your account and content for as long as your account is active, and delete or anonymise them within 30 days after you close your account. The copies of AI inputs and outputs described in section 3 are deleted after 90 days, even while your account is active. We retain certain records for longer where the law requires it — in particular, invoice and tax records, which under German law must be kept for up to 10 years.

The free fit check, without an account:

A job posting you paste into the demo, and the report built from it, are kept so that the same posting gets the same report. They can no longer be opened after at most 30 days, and are then deleted automatically. Each demo report also has its own web address, made of a random reference that contains nothing from the posting. Anyone who has that address can open the report until it can no longer be opened as described above: its score, the requirements read from the posting, the lines of the sample candidate's CV that support them and, once they have been written, the angle, the draft and the suggested changes to the sample CV. The report at that address never shows the posting's full text. The demo needs no account and no CV.
If you check your own CV, we keep the CV text you paste, or that we read from your file, only until our AI has read it, and never longer than 24 hours. We then keep how our AI read it (your CV's content, in a structured form), the posting and the report, so that you can save the report to an account. They can no longer be opened after at most 24 hours from the first time you check that CV, and are then deleted automatically. If you save it, they are removed from the free check at once and become part of your account, kept as described above. A technical record of how our AI read the job posting (which holds no part of your CV) can remain for up to 24 hours from the check before it is deleted automatically. If saving is interrupted, what had already reached your account (usually your CV in its structured form) stays there as part of your account, and you can ask us to delete it (see section 7); the free check itself is still deleted as described above.
If you upload a CV file, our server reads it and deletes it as soon as it has been read. Its name stays in your browser. Nothing from the file is kept unless you then run the check; the CV text we read from it is then kept exactly like a CV you paste, as described above.
If you give us a link to a job posting, our server opens that page once, only to read the posting, and nothing else. We do not keep the link, and a read on its own stores nothing. The posting text we read is kept only if you then run the check, exactly like a posting you paste. We do not record the link or the file name in our logs or in our analytics.
The hashed request counters described in section 1 are deleted within a day.

7. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability, or object to certain processing, and withdraw consent where processing is based on it. To exercise these rights, contact hello@hireready24.com. You also have the right to complain to your local data protection authority.

A free check made without an account is not filed under an account, a name or an email address, so to find a check of your own CV we will ask you for the claim code your browser keeps (see section 8) or for details from the CV you pasted or uploaded. It can no longer be opened after at most 24 hours (a demo check: 30 days), and is then deleted automatically.

8. Cookies and browser storage

We use essential cookies required to sign you in and keep your session secure (via Clerk). We also use analytics and advertising cookies (via PostHog and the Reddit advertising pixel) only after you consent through our cookie banner — until then, no analytics or advertising script loads and no such cookie is set. The same single choice covers both. You can decline without losing any functionality, and we store your choice in a first-party cookie so we don't ask again. Our product analytics are configured with IP anonymization and are hosted in the EU (Frankfurt, Germany).

We also store the language you read our site in, in a first-party cookie called NEXT_LOCALE, so that pages and your account open in that language. It is set when you open our German or Portuguese pages, choose a language with the language switcher or in your settings, or sign in to an account with a saved language, and it is kept for up to 1 year, sometimes with a copy in your browser's local storage. This cookie is strictly necessary to show the site in the language you chose. It is never used for analytics or advertising and contains nothing but the language code.

Your browser's storage also keeps a few small settings and progress markers, such as your light or dark theme and references to work that is still running in your account, so that a page reload doesn't lose your place. While we read a CV you have pasted or uploaded, its text is kept there too, so that a reload doesn't make you paste it again; it is removed when the reading finishes, or once it is out of date the next time our site checks for it. Apart from that, these never contain your CV or a job posting, and clearing your browser's site data removes them.

If you check your own CV without an account, your browser keeps a random claim code that works for up to 24 hours, so that you can open your report and save it to an account. It is kept in your browser's local storage, not in a cookie, together with the check's reference, its expiry time and the job title from the posting — never your CV or the posting itself. It is used only for that: your browser sends it only to us, inside a request and never in a web address, and we keep only a hashed form of it. Our site removes it when you save the report or when it finds that the code has expired, and clearing your browser's site data removes it too. On a shared device, anyone who signs in on this browser before the code expires could save the report, so clear your browser's site data if you won't save it.

If you reach us from an advertisement, we store the campaign identifiers from the link you clicked (such as the campaign name) in a first-party cookie for up to 30 days, so that we can tell which advertisement brought you here. The advertising network's own click identifier is stored only if you accept advertising cookies, and then for up to 30 days after your most recent visit from an advertisement. These identifiers do not identify you by name, and are not shared with the advertising network unless you have accepted advertising cookies.

9. Security

We use reasonable technical and organisational measures to protect your data, including delegating card handling to Polar and authentication to Clerk. No method of transmission or storage is completely secure.

10. Children

The Service is not intended for anyone under 18, and we do not knowingly collect data from children.

11. Changes

We may update this Policy; material changes will be notified in-product or by email. The "last updated" date reflects the current version.

12. Contact

Antonio Alves Neto, Ehrhartstrasse 47, 67141 Neuhofen, Germany. Privacy enquiries: hello@hireready24.com.