PRIVACY POLICY

Last updated: July 16, 2026

This Privacy Notice for Worqai ("we," "us," or "our") describes how and why we access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

Visit our website at worqai.io (and www.worqai.io) or any website of ours that links to this Privacy Notice;
Use Worqai, a résumé/CV platform that (a) scores your résumé, (b) produces an improved version of it, and (c) tailors it to a specific job description. We use Google Gemini to process your résumé text and Supabase to store it;
Engage with us in other related ways, including any marketing or events.

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are the controller responsible for deciding how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have questions, contact us at support@worqai.io.

SUMMARY OF KEY POINTS

What personal information do we process? Your account details (name, email), and most importantly, the full contents of any résumé/CV and job description you submit. A résumé can contain a wide range of personal information about you. See §1.

Do we process sensitive personal information? Potentially yes. A résumé you upload may contain information that is "sensitive" or "special category" in some jurisdictions (e.g., a photo, nationality, age/date of birth, gender, health/disability, religious or political affiliations, or trade-union membership). We do not ask for this information, but we cannot prevent it from appearing in a document you choose to upload, and we process the document as a whole. See §1 and §9.

Do we collect information from third parties? Yes, limited to authentication: if you sign in with Google, we receive basic profile information (name, email, profile picture) from Google. See §5.

How do we process your information? To provide and operate the Services, authenticate you, process payments, communicate with you, ensure security and prevent fraud, comply with law, and only with a valid legal basis. See §2.

With whom do we share personal information? With the service providers that run our platform (Supabase, Google, Polar, Inngest, Vercel) and, where required, with legal authorities. See §3.

International transfers. Our processors are located primarily in the United States. If you are in Latin America or elsewhere, your personal information is transferred to and processed in the U.S. See §3.

How do we keep your information safe? We use reasonable organizational and technical measures, but no system is 100% secure. See §7.

What are your rights? Depending on where you live, you may have rights to access, correct, delete, port, and object to the processing of your personal information, and to withdraw consent. See §9.

How do you exercise your rights? Signed-in users can manage and delete their data at https://www.worqai.io/es/cuenta, or contact us at support@worqai.io.

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In short: We collect the personal information you provide when you create an account and when you submit a résumé or job description.

Account information. When you register, we collect:

your name (if provided, or as received from Google sign-in);
your email address;
a password (stored only in hashed form by our authentication provider; we never see it in plain text).

We do not collect phone numbers, postal addresses, or job titles as account fields.

Résumé / CV and job-description content. This is the core of the Service. When you use Worqai you upload or paste:

the full text and structure of your résumé/CV, and
(for the "Tailor" feature) a job description.

A résumé you choose to upload may contain a broad range of personal information, for example your work history, education, skills, contact details, and potentially sensitive information such as a photograph, nationality, date of birth, gender, or health/disability details. We do not request sensitive information, but we process whatever the document contains. By submitting a résumé you instruct us to process its full contents (including any sensitive information in it) for the purposes described in this notice. See your rights in §9.

Payment data. If you purchase a subscription or bundle, payment is processed by Polar (our merchant of record). We do not receive or store your full card number or security code; we receive only limited billing metadata (e.g., a customer/subscription identifier and subscription status). Polar's privacy notice: https://polar.sh/legal/privacy-policy.

Social-login data. If you choose to sign in with Google, we receive basic profile information from Google as described in §5.

Feedback and experience reports. If you use our feedback form, we collect the type of submission, outcome category, message, language, contact and publication choices, and, if you provide them, your display name and email address. If you are signed in, we may link the submission to your account. We also retain a privacy-limited source path and referring-site origin when safely available; URL queries, fragments, credentials, and external page paths are discarded. Submissions are private by default. We do not publicly attribute or publish them as testimonials without your separate, affirmative permission. Please do not include confidential employer, recruiter, client, or third-party information in a submission.

All personal information you provide must be true, complete, and accurate, and you must notify us of any changes.

Information automatically collected

In short: Some technical information is collected automatically when you use the Services.

Log, device, and usage data. Our hosting and backend providers automatically record service-related, diagnostic, and security information such as your IP address, browser type, device and operating-system characteristics, referring URLs, and timestamps of your activity. This is used to operate and secure the Services.
Anonymous ATS scans. If you use the free résumé scan without an account, we store the résumé content you submit together with an anonymous token and a one-way cryptographic hash of your IP address (we do not store the raw IP for this feature). This is used solely to enforce usage limits and prevent abuse. See retention in §6.
Feedback anti-abuse protection. When you submit the feedback form, we use a salted, one-way IP identifier in temporary server memory to limit rapid repeated submissions. Neither the raw IP nor this identifier is stored in the feedback record, and the in-memory identifier disappears when the server instance resets. Hosting providers may still process IP addresses in their security logs as described above.
Analytics. We use Vercel Web Analytics to understand aggregate usage of our Services (e.g., page views and general traffic patterns). Vercel Web Analytics is privacy-friendly and cookieless: it does not set cookies, does not use cross-site tracking, and does not build a persistent profile of you. We do not use advertising trackers or marketing pixels.

Information from Google APIs

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google sign-in only to authenticate you; we do not use Google profile data for advertising or sell it.

2. HOW DO WE PROCESS YOUR INFORMATION?

In short: We process your information to provide and improve the Services, authenticate you, take payment, communicate with you, maintain security, and comply with law, always with a valid legal basis.

We process your personal information to:

Create and manage your account and authenticate you.
Deliver the Services: i.e., score, improve, and tailor the résumé you submit. This requires transmitting your résumé content to our AI provider (see §4).
Process payments and manage subscriptions and bundles.
Communicate with you: service, account, and transactional messages.
Review feedback and experience reports: respond when you permit contact, improve the Service, and consider a submission for publication only when you separately permit publication.
Maintain security and prevent fraud, including enforcing usage limits.
Comply with legal obligations and establish, exercise, or defend legal claims.

Legal bases for processing (for users in jurisdictions that require one, such as Brazil, Costa Rica, and the EU/EEA):

Performance of a contract: to provide the Services you request.
Consent: for processing the contents of any résumé you submit (including any sensitive data it contains) and for any optional communications. You may withdraw consent at any time (see §9).
Legitimate interests: securing the Services, preventing abuse, and improving our product, where not overridden by your rights.
Legal obligation: to comply with applicable law (e.g., tax/accounting).

We do not use your résumé content to train our own models, and we do not sell or "share" (as defined under California law) your personal information for cross-context behavioral advertising.

In short: We share information only with the service providers that operate our platform, and where legally required. We do not sell your personal information.

We share personal information with the following categories of processors, each under a contract that limits them to providing services to us:

Purpose	Provider	What is shared
Database, authentication & storage	Supabase	Account data, stored résumé/session content, and feedback submissions
AI résumé processing	Google (Gemini API)	The résumé and job-description text you submit
Background job processing	Inngest	Session/job data needed to run parse/improve/tailor jobs
Hosting, infrastructure & analytics	Vercel	Technical/log data; aggregate, cookieless analytics; data in transit
Transactional & authentication email	Resend	Your email address and message content (e.g., account/auth emails)
Payments & billing	Polar	Billing identifiers and subscription status
Authentication (optional sign-in)	Google OAuth	Authentication tokens / basic profile

International transfers. These providers process data in the United States; our primary database (Supabase) is hosted in the U.S. East (Ohio) region. If you are located in Latin America or elsewhere, using the Services involves transferring your personal information to the United States. We rely on the contractual and security commitments of these providers as the safeguard for such transfers.

We may also disclose personal information:

To comply with law: in response to a lawful request by public authorities, or to protect our rights, your safety, or the safety of others.
Business transfers: in connection with a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honor this notice.

4. DO WE OFFER ARTIFICIAL-INTELLIGENCE-BASED PRODUCTS?

In short: Yes. Worqai's core features are powered by a third-party AI provider, Google's Gemini API.

To score, improve, and tailor your résumé, we transmit the résumé and job-description text you submit to Google's Gemini API. Your input and the AI's output are processed by Google to provide these features.

We do not use your résumé content to train our own models, and Google does not use it to train its models or improve its products. Worqai uses Google's Gemini API on a paid tier linked to a Google Cloud billing account. Under Google's Paid Services terms, Google does not use the content you submit (prompts) or the content Gemini returns (responses) to train or improve its products, and such content is not subject to human review for product-improvement purposes. Google processes this content solely to provide the service to us and retains it only transiently for abuse detection and legal-compliance purposes, in accordance with its terms.

You must not use the AI features in any way that violates Google's terms or policies. The AI features are designed for natural-language processing of résumé and job-description text only. AI output may contain inaccuracies; you are responsible for reviewing any document before relying on it.

In short: If you sign in with Google, we receive basic profile information from Google.

Our Services let you register and log in using your Google account. When you do, Google provides us with basic profile information, typically your name, email address, and profile picture. We use this information only for the purposes described in this notice (creating and authenticating your account).

We do not control, and are not responsible for, other uses of your information by Google. We recommend you review Google's privacy notice and adjust your privacy settings there.

6. HOW LONG DO WE KEEP YOUR INFORMATION?

In short: We keep account data while your account is active, and we delete it when you delete your account. Anonymous scan data is kept only as long as needed to enforce usage limits.

Account and résumé data (signed-in users): retained for as long as your account exists. When you delete your account (see §15), we delete your profile and all associated résumé/session content, and we anonymize or delete your billing customer record.
Anonymous scan data (no account): the résumé content, anonymous token, and hashed IP submitted without an account (the free ATS scan and any anonymous session) are retained for at most 30 days, after which they are automatically and permanently deleted by a scheduled daily purge.
Feedback submissions: retained for up to 24 months for review, support, and product improvement, then deleted automatically unless the submission has been approved for publication or a longer period is required by law. You may request earlier deletion, or withdraw publication permission for future use, by emailing support@worqai.io. We may need information that reasonably identifies the submission before acting on the request.
Backups: residual copies may persist in encrypted backups for a limited period before being overwritten.
Legal retention: we may retain limited information longer where required for tax, accounting, fraud-prevention, or to establish/defend legal claims.

7. HOW DO WE KEEP YOUR INFORMATION SAFE?

In short: We use reasonable technical and organizational measures, but no method is 100% secure.

We implement appropriate technical and organizational measures designed to protect your personal information, including encryption in transit, access controls, and reliance on infrastructure providers (Supabase, Vercel) that maintain industry-standard security. Database access is restricted by row-level security so that you can access only your own data. However, no transmission or storage technology is completely secure, and we cannot guarantee absolute security. You access the Services at your own risk and should use a secure environment.

8. DO WE COLLECT INFORMATION FROM MINORS?

In short: We do not knowingly collect data from anyone under 18.

The Services are not directed to, and we do not knowingly collect personal information from, anyone under 18 years of age. By using the Services you represent that you are at least 18 (or the parent/guardian consenting on behalf of a minor). If we learn that we have collected information from a person under 18, we will deactivate the account and delete the data. If you believe we may have such data, contact support@worqai.io.

9. WHAT ARE YOUR PRIVACY RIGHTS?

In short: Depending on where you live, you have rights over your personal information, including to access, correct, delete, port, and object, and to withdraw consent.

Regardless of location, all users may:

Access, correct, or update account information in account settings.
Delete your account and associated data at any time (see §15).
Withdraw consent: where we rely on consent (including consent to process your résumé content), you may withdraw it at any time by contacting us or deleting your account. Withdrawal does not affect processing already carried out lawfully.

To exercise any right, visit https://www.worqai.io/es/cuenta or email support@worqai.io. We will respond within the timeframe required by applicable law and may need to verify your identity first.

If you believe we have processed your information unlawfully, you have the right to lodge a complaint with your local data-protection authority, for example, PRODHAB (Costa Rica), the ANPD (Brazil), the INAI (Mexico), or your U.S. state attorney general.

10. CONTROLS FOR DO-NOT-TRACK FEATURES

Most browsers offer a Do-Not-Track ("DNT") setting. Because there is no finalized standard for DNT, we do not currently respond to DNT signals.

Global Privacy Control (GPC). Where applicable law requires it, we honor GPC signals as a valid request to opt out of the sale or sharing of personal information. We do not sell or share personal information for targeted advertising, so in practice there is no such processing to opt out of. Learn more at globalprivacycontrol.org.

11. DO RESIDENTS OF LATIN AMERICA HAVE SPECIFIC PRIVACY RIGHTS?

In short: Yes. If you are in Brazil, Mexico, Costa Rica, Colombia, Argentina, or another LATAM country with a data-protection law, you have rights over your personal information.

Depending on your country, you may have the rights to: confirm whether we process your data; access it; correct inaccurate or incomplete data; delete or anonymize it; obtain a portable copy; object to or restrict certain processing; withdraw consent; and be informed about the entities with which we share data. These rights are subject to the limits and exceptions in your country's law (e.g., Brazil's LGPD, Mexico's LFPDPPP and its "derechos ARCO," Costa Rica's Law No. 8968, Colombia's Law 1581, Argentina's Law 25.326).

Worqai is domiciled in Costa Rica. To exercise any of these rights, visit https://www.worqai.io/es/cuenta or email support@worqai.io. You may also complain to your national data-protection authority.

12. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have specific rights.

Categories of personal information we collect

Over the past twelve (12) months we have collected the following categories (corrected to reflect what the Services actually process):

Category	Examples	Collected
A. Identifiers	Name, email, account name, IP address, online identifier	YES
B. California Customer Records info	Name, contact info, education, employment history (within résumés)	YES
C. Protected classification characteristics	Age, gender, nationality, etc., only if present in a résumé you upload	YES (incidentally, via résumé content)
D. Commercial information	Subscription/purchase records, billing identifiers	YES
E. Biometric information	Fingerprints, voiceprints	NO
F. Internet/network activity	Usage and log data on our Services	YES
G. Geolocation data	Coarse location inferred from IP	YES (coarse, from IP)
H. Audio/visual	A photo may appear in an uploaded résumé	YES (incidentally, via résumé content)
I. Professional/employment information	Work history, qualifications (within résumés)	YES
J. Education information	Education history (within résumés)	YES
K. Inferences	A résumé "score" / profile derived from your résumé	YES
L. Sensitive personal information	May appear in an uploaded résumé (see §1)	YES (incidentally, via résumé content)

Sources and uses are described in §1 to §3. We disclose personal information to the processors listed in §3 for business purposes under contract. We have not sold, and do not sell, personal information, and we do not "share" it for cross-context behavioral advertising.

Your rights

Subject to legal limits, you may: confirm whether we process your data; access it; correct inaccuracies; delete it; obtain a portable copy; opt out of sale/sharing/targeted-advertising profiling (not applicable, as we do none); and not be discriminated against for exercising these rights. Depending on your state you may also request a list of the categories/third parties to whom we disclosed data, and appeal a denied request.

How to exercise your rights

Visit https://www.worqai.io/es/cuenta, email support@worqai.io, or use the contact details in §14. We will verify your identity before acting. You may use an authorized agent with valid written authorization. If we deny a request, you may appeal by emailing support@worqai.io; if the appeal is denied, you may contact your state attorney general.

California "Shine the Light"

California residents may request, once per year and free of charge, information about personal information we disclosed to third parties for their direct-marketing purposes. We do not disclose personal information for third-party direct marketing.

13. DO WE MAKE UPDATES TO THIS NOTICE?

In short: Yes. We will update this notice as needed and revise the "Last updated" date. For material changes we will provide a prominent notice or notify you directly.

14. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments, email support@worqai.io or write to us at:

Worqai 50 mts norte y 50 oeste, Plaza Freses, iFreses Curridabat, San José, 11801 Costa Rica

15. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

You may review, update, or delete your personal information at any time:

Signed-in users: manage your account and permanently delete your account and all associated data at https://www.worqai.io/es/cuenta.
Anonymous scan users (no account): because these scans are not linked to an identity, email support@worqai.io with the anonymous reference if you wish to request deletion.
Any user: email support@worqai.io to make a data request. We will respond as required by applicable law and may verify your identity first.