Privacy & Data Protection Policy

1. Introduction and who we are

10xCV is operated by Deepstack ("we", "us", "our"). We are committed to protecting your privacy. This Privacy & Data Protection Policy describes how we collect, use, store, and disclose your personal data when you use our service (the "Service"), and the choices you have.

For applicable data protection laws, Deepstack acts as the data controller (GDPR/LGPD), business (CCPA/CPRA), and data fiduciary (DPDPA) for personal data processed through the Service, except where a third party processes data as an independent controller (for example, your payment provider for card data they collect directly).

2. Data we collect

We collect the following categories of data:

• Account data: your name, email address, and authentication credentials.
• Profile and CV content: your professional experience, skills, education, and any documents or text you upload.
• Job application data: the job postings you submit and the tailored outputs generated for you.
• Payment data: billing details processed securely by our third-party payment provider; we do not store full card numbers.
• Usage and device data: log data, IP address, browser type, and interactions with the Service, collected automatically.
• Cookie and consent data: records of your cookie preferences and similar technical identifiers needed to operate the Service.

3. How we use your data

We process your personal data to:

• Provide, operate, and maintain the Service, including generating tailored CVs.
• Create and manage your account and process your subscription payments.
• Improve and develop our features, models, and user experience (using aggregated or de-identified data where practicable).
• Communicate with you about updates, security alerts, and support requests.
• Detect, prevent, and address fraud, abuse, and security incidents.
• Measure site usage with analytics cookies em only if you consent | (see Cookies below).
• Comply with our legal obligations.

4. Purposes, legal bases, and retention

Where GDPR, UK GDPR, or similar laws apply, we rely on the legal bases below. Retention periods start from account closure or the end of the relevant activity unless a longer period is required by law.

5. AI processing

To deliver tailored outputs, your profile and job content are processed by automated systems. Before transmission to trusted third-party AI providers acting as our processors under appropriate contractual safeguards (including data-processing terms), we remove direct identifiers such as your name, email address, phone number, and similar contact details from the AI payload. Account credentials and payment data are not sent to AI providers.

We describe this as de-identification / pseudonymisation: residual profile content (for example employment history) may still be personal data in context. We do not sell your personal data. We do not use the content of your CV to train publicly shared models without your explicit consent.

AI features assist you in editing and tailoring CVs. They are not intended to produce solely automated decisions that produce legal or similarly significant effects about you without meaningful human involvement. You remain in control of whether to use, edit, or submit any output.

6. Sharing and disclosure

We share personal data only with service providers who help us operate the Service (for example hosting, payment processing, and AI inference), all bound by confidentiality and data-protection obligations, and only as needed for their services. We may also disclose data where required by law, to enforce our terms, or in connection with a merger, acquisition, or sale of assets.

We do not sell personal information. We do not “share” personal information for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA.

7. International transfers

10xCV infrastructure and primary storage are located in the United States. If you access the Service from the EEA, UK, Brazil, India, or elsewhere, your data may be processed in the US and other countries where our processors operate. Where we transfer personal data across borders, we implement appropriate safeguards such as standard contractual clauses (or equivalent lawful transfer mechanisms) and processor contracts so your data remains protected in accordance with this policy and applicable law.

8. Data security

We implement technical and organizational measures designed to protect your data, including encryption in transit, access controls, and regular security reviews. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Sensitive and special-category data

The Service is designed for professional CV content. Please do not upload special-category or sensitive data that is not needed for job applications (for example health data, biometric templates, or information revealing racial or ethnic origin, political opinions, religious beliefs, or trade-union membership), unless you choose to include it and a lawful basis applies. If you voluntarily include such information in materials you upload, we process it only to provide the Service you request.

10. Cookies

We use cookies and similar technologies for:

• Essential: sign-in, security, load balancing, and storing your cookie preference — required for the Service to function.
• Analytics: understanding how the public site is used (for example Google Analytics) — only after you choose “Accept all” on our cookie banner.

You can choose “Essential only” to use the Service without analytics cookies, or control cookies through your browser. Disabling essential cookies may prevent sign-in and core features from working.

11. Your rights (summary)

Depending on your jurisdiction, you may have rights to access, correct, delete, or export your personal data; to object to or restrict certain processing; to withdraw consent; and to lodge a complaint with a supervisory authority. Regional details follow. To exercise any right, contact us using the details in section 17. We will verify requests as required by law and will not discriminate against you for exercising privacy rights.

12. Europe and UK (GDPR / UK GDPR)

If you are in the EEA, Switzerland, or UK, you have the right to:

• Access your personal data and receive a copy.
• Rectify inaccurate data and request erasure in certain cases.
• Restrict or object to processing, including where we rely on legitimate interests.
• Data portability for data you provided to us, where processing is based on contract or consent and is automated.
• Withdraw consent at any time where processing is consent-based (without affecting prior lawful processing).
• Lodge a complaint with your local supervisory authority.

International transfers to the US are safeguarded as described in section 7. For privacy requests, email privacy@10xcv.online. We aim to respond within one month.

13. California (CCPA / CPRA)

If you are a California resident, this section is your Notice at Collection and describes your rights under the CCPA/CPRA.

Categories collected: identifiers (name, email); commercial information (subscription status); internet / electronic activity (usage logs, IP); professional information (CV and profile content); and inferences drawn to provide match insights. We collect these categories for the purposes in sections 3–4.

We do not sell personal information and we do not share it for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes that require a “Limit the Use” right beyond providing the Service.

California residents may request to:

• Know / access the personal information we collect, use, and disclose.
• Correct inaccurate personal information.
• Delete personal information, subject to legal exceptions.
• Opt out of sale or sharing (not applicable while we do not sell or share as defined by CCPA).
• Receive equal service and price (non-discrimination).

Submit requests to privacy@10xcv.online. You may use an authorized agent as permitted by law. We will verify your identity (for example via your account email) and respond within 45 days, or longer where the law allows. If our practices change so that we sell or share personal information, we will update this policy and provide a “Do Not Sell or Share My Personal Information” mechanism.

14. India (DPDPA)

If you are in India, Deepstack acts as a data fiduciary for personal data processed for the Service. We process personal data for the clear purposes described in this policy (providing CV tailoring, account management, payments, security, and — with consent — analytics).

You may have rights to:

• Access a summary of personal data and processing activities.
• Correct and erase personal data, subject to applicable exceptions.
• Withdraw consent where processing is consent-based.
• Nominate another individual in case of death or incapacity, where required by law.
• Seek grievance redressal through our privacy contact below.

Personal data may be processed in the United States as described in section 7. For grievances and rights requests, contact privacy@10xcv.online. We will acknowledge and address grievances within applicable timelines.

15. Brazil (LGPD)

If you are in Brazil, we process personal data under LGPD legal bases including performance of a contract, compliance with legal obligations, legitimate interests (for security and service improvement, balanced against your rights), and consent where required (for example non-essential cookies).

You may request, among other LGPD rights:

• Confirmation of processing and access to data.
• Correction of incomplete or outdated data.
• Anonymization, blocking, or deletion of unnecessary or non-compliant data.
• Portability and information about public and private entities with which we share data.
• Withdrawal of consent and review of decisions affecting your interests where applicable.
• Lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD).

Our privacy contact for LGPD requests (encarregado / data-protection contact) is privacy@10xcv.online.

16. Children's privacy

The Service is not directed to individuals under 18, and we do not knowingly collect personal data from children. If we become aware that we have collected such data, we will delete it promptly.

17. Contact and privacy requests

For questions or requests regarding this policy or your personal data (including GDPR, CCPA, DPDPA, and LGPD requests), contact:

• Email: privacy@10xcv.online
• Controller / business / data fiduciary: Deepstack, operating 10xCV (primary processing location: United States).

Please include enough detail for us to verify your identity and locate your data (for example the email on your account).

18. Changes to this policy

We may update this policy from time to time. When we make material changes, we will notify you by posting the updated policy and revising the "Last updated" date above, and where required, by additional notice.