Privacy Policy

Curriculy takes care of the personal data used to provide the service. You can discuss privacy and exercise your rights at privacidade@curriculy.com.br, including without an account or when you cannot sign in.

This Policy covers the website, analysis without an account, private history, prepared materials and support. Documents may contain personal data even when they do not include your name.

We process the data needed for the features you request. Passwords are handled by the authentication service and are not sent to AI to analyze your resume.

• Registration and access: name, email, account identifier and authentication, confirmation and recovery information.
• Profile: name, role, field, preferences and photo, when supplied, for your account and materials.
• Resume and job: extracted or pasted text, file name, professional data, job description and link, for analysis and material preparation.
• Results: revised resume, assessment, letter, interview suggestions, translations and adjustment requests, to deliver features and keep your requested history.
• Support: message, contact email, linked analysis and attachments you choose to provide, to investigate and respond.
• Operations and security: sessions, timestamps, pseudonymous identifiers, technical and network data, resource usage and failures, to operate the service and prevent abuse.

Avoid unnecessary CPF numbers, identity documents, full home addresses and third-party data. Before sending text to AI, we apply a local filter to explicitly labeled, unnecessary personal fields while preserving relevant experience and qualifications.

This filter does not identify all sensitive data in free text. Work in healthcare, accessibility or religious institutions may be part of professional experience and is not removed just because of keywords. Originals and manual edits are preserved; a new AI action reapplies the filter.

Analysis, adjustments, translations and audits involve processing outside your browser through Lovable’s AI gateway. Sensitive data requires its own safeguards and grounds. General acceptance of these documents is not blanket authorization for every processing activity.

Ordinary personal data strictly needed for the features you request is processed to perform the service or related steps you request. Security and abuse-prevention logs may rely on legitimate interest where necessity, proportionality and safeguards support it; this is not blanket authorization for other purposes. Legal obligations and the exercise of rights justify retention only where applicable grounds exist.

Providers include Lovable Cloud for infrastructure, authentication, databases and files; Lovable’s gateway and its AI model providers; Brevo for service emails; and ImprovMX and the Google email inbox used for support. Job sources are contacted to import opportunities you request. Your resume is not sent to job platforms for this import.

This project’s database is hosted in the United States, in the US East (N. Virginia) region. The database location does not determine where all AI models or other providers process data.

Curriculy does not sell resumes, share them with recruiters or use them for advertising or training its own AI. Providers’ processing terms are separate from these purposes of Curriculy. Services and subprocessors may process data outside Brazil, subject to the rules and safeguards applicable to international transfers.

We use session technologies, browser storage and visitor identification for authentication, continuity and security. A technical identifier or hash does not automatically make data anonymous.

Audience measurement uses Google Analytics on public pages only after your specific consent, to understand visits, traffic sources, language, device and general site use, without advertising, remarketing or commercial profiles. Measurement stays off before you choose or if you reject it. Account, results and support pages do not send these events.

Measurement identifiers are configured to last up to 24 hours, without automatic renewal on new visits. Retention of Analytics data associated with events and users is configured to 2 months, without activity-based renewal; aggregate reports follow separate Google rules. Measurement does not receive resume text, custom titles, URL parameters or fragments. These controls do not make all data anonymous or eliminate processing by Google.

In the cookie notice, Accept all allows optional measurement cookies; Reject non-essential keeps only necessary technologies. You can review or withdraw consent using Manage preferences in the footer or at the end of this page, without losing access to your account or analysis. We also respect compatible browser privacy signals. This choice does not automatically erase previous statistics and may need to be repeated on other browsers or after clearing local data.

Accepting the Terms and acknowledging this Policy does not mean consenting to every purpose. Where processing depends on consent, the choice must be specific and freely revocable. You can request information and exercise applicable rights through the privacy contact.

The periods below are Curriculy’s operational commitments. They are not universal deadlines imposed by Brazil’s LGPD.

• Preview without an account: available for up to 24 hours from creation. After expiry, it becomes unavailable and its content and temporary copies enter scheduled cleanup.
• Saved history: kept in your account so you can return to materials, until you delete the analysis or request account deletion, subject to continued need for that purpose.
• Deletion: commitment to remove covered data from active systems within up to 30 days, after necessary identification and clarification of the request scope, without using these steps to improperly delay the request.
• Support conversations: up to 6 months after closure, for follow-up and possible reopening. Attachments: up to 30 days after closure. Account deletion brings these periods forward, within the commitment of up to 30 days for active systems.
• Technical and security records: retained proportionately to their purpose with restricted access. Resume content should not be stored indefinitely as logs.
• Backups: follow a separate cycle from active systems and may remain for a limited period. Restoration must respect deletion requests. Information about the applicable cycle can be requested through the privacy contact.
• Exceptions: only where a concrete retention ground exists, for the minimum necessary, with a documented purpose, restricted access and duration. Deletion does not instantly remove every copy held by providers.

You can request confirmation of processing, access and a copy of your data, correction and information about sharing. Where applicable, you can also request deletion, anonymization, blocking, portability, objection, withdrawal of consent and review of automated results as provided by law.

Send requests to privacidade@curriculy.com.br. Assistance is free and does not require login. We may request minimal, proportionate information to verify ownership, preferring an existing account or known email. Do not send a password or identity document without necessity and specific guidance.

Rights follow their own legal requirements and deadlines; the operational deletion period does not automatically apply to access requests. If we cannot fulfill a measure, we will explain why and what alternatives are available. You can also contact Brazil’s ANPD and competent authorities.

An automatic export button is not required to request a data copy. Material downloads follow the features available in the service. Before deleting an account, keep any documents you want to retain.

We apply access controls and protections for our operations. No system is completely immune to failures. Incidents will be assessed and reported to authorities and affected people when required, within applicable deadlines, with measures to reduce their effects.

At this stage, Curriculy is intended for people aged 18 or older. The declaration requested is not proof of age. Reports of use by minors should be sent to the privacy contact for appropriate handling without secondary use.

Material changes will be communicated with a version and effective date. New choices will be requested where required. Contact: privacidade@curriculy.com.br.

Curriculy is operated by Ricardo dos Santos Morais, an individual acting as data controller. Privacy and rights contact: privacidade@curriculy.com.br.