What we collect and why
We use the CV text, job descriptions and enhancement preferences you submit to generate CVs and assess the evidence in them. Uploaded PDF and Word files are read to extract text; the app does not provide a permanent library of your original upload files. You choose when to submit extracted text for processing.
We also handle your email address and authentication records, saved results, membership and usage records, payment references, requested email deliveries, and technical information needed for security and support. We use first-party session cookies to keep accounts and guest results private. Keyed, network-derived identifiers help enforce free limits and reduce abuse. The free-tool allowance ledger stores a protected identifier rather than the raw IP address. People sharing an IP address or IPv6 network share the free allowance.
Remove information you do not need in a CV, such as identity documents, bank details, health information and other sensitive details. When uploading someone else’s CV, obtain their permission and make this policy available to them.
AI processing and service providers
OpenAI processes your submitted CV text, job context and preferences to provide the requested AI output. Requests disable optional response storage. This is not a promise of zero retention: provider security and abuse monitoring may retain data separately. OpenAI states that API data is not used for model training by default unless the customer opts in, and that standard abuse-monitoring records may be retained for up to 30 days, with exceptions. Read OpenAI’s data controls.
Vercel hosts application processing, Supabase provides accounts and private workspace storage, Resend delivers requested emails, Stripe handles payments and billing, and Cloudflare supports domain and network services. Providers receive the information needed for their service. For example, Stripe receives payment details; the app stores payment references rather than full card numbers. A requested report email may include your report and Word CV.
Providers and their subprocessors may handle information outside Australia, including in the United States. Processing is not guaranteed to remain in your country. Their infrastructure, security and legal retention requirements may differ from the app’s saved-result expiry periods.
How long information stays
- Guest results expire with their guest session, normally within 24 hours of that session being created. Account results expire 30 days after creation. Scheduled cleanup removes expired saved results and clears associated source input; access ends at expiry.
- You can delete a saved result from the workspace before expiry. Unfinished processing inputs are cleared by scheduled cleanup after 30 days.
- Report content held for delivery is normally cleared after one day once delivery reaches a final state. Delivery metadata and completed webhook records are normally cleaned after 30 days. Pending recovery jobs may remain until resolved.
- Operator audit records and quality-benchmark records are normally cleaned after 90 days. Free-report request and usage records have shorter scheduled retention limits.
- Free-tool network identifiers enforce one use of each tool per verified account and network per rolling seven days. They remain after a guest session, account or result is deleted and are removed in scheduled batches after the allowance window ends.
- Account, membership, usage, payment and security records may remain longer where needed to maintain access, prevent abuse, resolve disputes or meet record-keeping obligations. They are not all deleted when a CV expires.
Cleanup runs in scheduled batches; expiry is not a promise of immediate erasure from every provider or backup. Downloaded documents and emails already delivered to your inbox are outside the workspace’s deletion process. Keep a copy of results you want to retain.
Email, cookies and marketing
Sign-in codes, purchase and service messages, and reports you request are transactional emails. Requesting a free report or creating an account does not by itself subscribe you to marketing. The optional, initially unticked marketing checkbox covers product news and offers from upwards.cv and Upwards Enterprise. We save this choice only after your email is verified. Choosing not to subscribe does not change free access, membership or requested service emails. You can opt in or withdraw permission for both brands in My account.
We keep your current email preference and a private consent history recording the verified email, wording and version, brands and purpose, timestamp and whether you opted in or out. These records support your choices and are deleted when your Auth account is deleted; deleting a CV does not delete them. Permission does not automatically transfer to a changed email address. The app uses necessary account, security, selected-currency and legacy guest-session cookies. It does not currently install advertising pixels or a third-party behavioural analytics tracker. If optional tracking is introduced, we will update this policy and provide the relevant controls.
Your choices and access
Verify your email to use the free tools. Free access does not require payment. You can correct source text before submitting, delete saved results, choose whether to request an email, and manage renewal in My account. To request access, correction or deletion of account information, contact us. We may need to verify your identity and retain records where required for legitimate security, billing or legal purposes.
We limit workspace access through account ownership checks and restrict operational access. No internet service can guarantee absolute security. Do not submit information you are not authorised to share.
Contact and privacy concerns
For support, a privacy request or a complaint: james@ucubed.au Please describe the issue without sending passwords, verification codes, payment card details or unnecessary CV content.
We will assess your request and explain the response or any reason a request cannot be fully met. You can also contact the applicable privacy regulator, including the Office of the Australian Information Commissioner, where relevant.
Changes
The date above identifies this version. Material changes to how the service handles personal information will be explained before they take effect where required. The membership terms explain subscriptions and use of the tools.