# RakitCV — Privacy Policy

> **Summary**: RakitCV is built privacy-first. By default, your resume data stays entirely on your local device. We never sell your personal data, never use your resume to train public AI models, and you can delete your account and all associated data permanently at any time.

---

## 1. Introduction

RakitCV ("we", "our", or "the platform") is designed with a fundamental commitment to user privacy and data sovereignty. This Privacy Policy details the data we collect, how it is processed, and our strict boundaries regarding what we will never do with your information.

---

## 2. Local-First Architecture (Without an Account)

If you use RakitCV without creating an account:
- **Local Storage**: Your CV data, draft content, and configuration preferences are stored solely inside your browser's local storage (`IndexedDB` / `localStorage`).
- **Zero Transmission**: Your personal data is never transmitted to or stored on our servers.
- **Complete Privacy**: We cannot view, inspect, or analyze your resume contents.
- **Offline Capability**: You can create, edit, and export resumes even when offline.

---

## 3. Optional Cloud Sync (With an Account)

If you choose to create an account to sync resumes across devices:
- **Secure Storage**: Your resumes and job application tracking entries are encrypted and stored in secure cloud databases.
- **Multi-Device Access**: You can access and edit your resumes seamlessly across mobile and desktop.
- **Granular Control**: You choose which resumes are synced to the cloud and which remain strictly local.
- **Security Standards**: We employ modern industry security protocols, encrypted connections (TLS 1.3), and token-based authentication.

---

## 4. Artificial Intelligence & Privacy Safeguards

When you opt to use AI features (such as AI CV Roasting, tailoring suggestions, or interview preparation):
- **Data Anonymization**: Personal identifiers (e.g., telephone numbers, home addresses, personal email addresses) are sanitized or tokenized before processing.
- **Zero Model Training**: Your resume content is **never used to train** public foundation models. We utilize enterprise API agreements with zero-data-retention guarantees.
- **Ephemeral Processing**: Data submitted for AI feedback is processed in memory to generate immediate responses and is not retained for AI training.

---

## 5. Payment Information

Payments for AI credits and optional Pro subscriptions are handled exclusively by regulated, licensed payment gateways (such as Duitku, Midtrans, or Stripe).
- RakitCV **never sees, stores, or processes** your credit card numbers, CVV codes, or banking PINs.
- All payment transactions comply with PCI-DSS standards.

---

## 6. Account Deletion & Right to Be Forgotten

You have complete ownership and control over your data:
- You may permanently delete your account at any time via **Settings > Profile > Danger Zone**.
- Upon confirmation, all your cloud-stored CVs, job application tracker data, AI conversation histories, and API access keys are permanently and irreversibly purged from our databases.
- Active login sessions are immediately invalidated across all devices.

---

## 7. What We Will Never Do

To protect your trust, we maintain absolute commitments:
1. **No Selling Data**: We never sell, rent, or lease your personal information or resume contents to third parties, advertisers, or data brokers.
2. **No AI Training**: We never use candidate data to train machine learning models without explicit consent.
3. **No Invasive Tracking**: We do not share personal resumes with advertising networks.
4. **No Unauthorized Access**: We do not inspect or read resumes stored locally on your device.

---

## 8. Contact & Data Protection Inquiries

For questions, clarifications, or requests regarding this Privacy Policy:
- **Email**: support@rakitcv.com
- **Website**: https://rakitcv.com/privacy

*Last Updated: March 2026*