1. Who we are
fuzzyHR (“we”, “us”) is a personal job-search assistant run by Nicola Delnero, based in Montreal, Quebec, Canada. This policy covers fuzzyhr.vercel.app and the fuzzyHR workspace.
The person in charge of protecting personal information at fuzzyHR is Nicola Delnero. You can reach them at our contact email (coming soon; it will be posted here) with any question, request or complaint about your personal information.
This policy is written to meet Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25), and the privacy laws of U.S. states that apply to us.
2. What we collect
| What | Where it comes from | Why |
|---|---|---|
| Your name, email address and sign-in details | You, when you sign up, through our sign-in provider Clerk (including Google sign-in, if you use it) | To create and secure your account |
| Your CV, in full | You, when you upload or paste it | To suggest your brief, match jobs to you, and write tailored CVs and cover letters |
| Your brief: roles you want, strengths, cities, remote preference, things to avoid | You, or suggested by the AI from your CV for you to edit | To decide which jobs to show you |
| Your shortlist, passed jobs, tracker, notes, interview dates, followed companies and job links you add | You, and our daily hunt | To run your job search and remind you to follow up |
| CVs, cover letters, AI reviews and fit scores we generate | Our AI providers, working from your information | So you can review, edit and use them |
| Billing details, if you subscribe: your plan, currency, subscription status, renewal date, and any pause. If you tell us you got a job, the company and role you choose | You, through Stripe's checkout. Your card details go straight to Stripe; we never see or store your card number | To provide and bill the Personal plan |
| Your own AI key, if you add one | You | To run the AI on your account. It is encrypted (AES-256-GCM) and never shown again; we display only its last 4 characters |
| An activity log: what you did in the app and when (for example “uploaded a CV”, “approved a job”), which workspace screens and documents you opened, plus counts of AI requests and tokens | Recorded automatically as you use the app | To enforce free-week limits, support you, prevent abuse, and understand how the product is used |
| Technical data: IP address, browser and device type, and request logs | Recorded automatically by our hosting and sign-in providers | Security, fraud prevention and keeping the service running |
| Your country and province or state, from your IP address | Our hosting provider, on each visit | To show the site in French in Quebec, show the Personal plan's price in your currency and check it's available where you are. We don't store them, except the country recorded when you start a checkout |
| Your language choice | You, with the EN/FR switch, kept in a cookie on your device and saved with your account | To show the site in your language and have the AI write its reviews in it |
| Anonymous visit statistics: pages visited, the site that referred you, country, browser and device type | Vercel Web Analytics, on every page except the admin area | To see how many people visit and which pages are useful. These statistics aren't linked to your account |
We don't ask for, and you shouldn't include in your CV, sensitive details that employers don't need: government ID or social insurance numbers, date of birth, health information, photos, or banking details. If your CV contains them, they're processed like the rest of your CV.
The demo at /app, used without signing in, keeps everything in your own browser and sends nothing to us.
3. Cookies and similar technology
We use only the cookies needed to keep you signed in, set by Clerk, and one that remembers your language choice. We don't use advertising cookies or any technology that profiles you for marketing.
We count visits with Vercel Web Analytics, which uses no cookies and doesn't identify you. It recognizes repeat requests within a day from a temporary code made from your request, which is discarded after 24 hours. It sees only aggregate numbers, never your CV or account details. Inside your workspace, we also record which screens you open, as part of the activity log described in section 2. The site loads its fonts from Google Fonts, so Google receives your IP address when the page loads.
4. How the AI uses your information
fuzzyHR uses artificial intelligence in four ways. Each one sends your CV, your brief, and the text of the job posting to the AI provider:
- Suggesting your brief from your CV, for you to edit.
- Reviewing matches. Our system first scores postings by keywords from your brief: job titles, strengths, cities, remote and things to avoid. The AI then reads the best matches against your CV and labels each one Recommended, Worth a look or Skip, with a fit score from 0 to 100 and its reasons.
- Writing a tailored CV and cover letter for a job, using only facts in your CV. It lists gaps instead of inventing experience.
- Reading a job page you paste, when the page has no structured job data.
These are recommendations to you, not decisions about you. You choose what to approve, and nothing is ever sent to an employer by us. If you switch on Autopilot, we approve roles the AI recommends above the fit score and daily limit you set, and write their documents, on your instruction. You can switch it off at any time. You can ask us what information and which factors led to any recommendation, and correct the information in your CV or brief whenever you like.
Which AI provider. If you haven't added your own key, we use Anthropic's Claude on our account. If you add a Claude key, Anthropic processes your requests on your account. If you add an OpenAI key, OpenAI does. We use their business API services, not their consumer chat apps. According to their published business terms, Anthropic and OpenAI don't use API data to train their models by default, and they keep it for a limited period for safety and abuse monitoring. See the Anthropic commercial terms and OpenAI business terms. We don't train any AI models on your information.
AI output can be wrong. Always read your CV and cover letter before you send them.
5. Who we share it with
We don't sell or rent personal information, and we don't “share” it for cross-context behavioural advertising. We share it only with the service providers that run fuzzyHR, each bound by contract to protect it and use it only to provide their service to us:
| Provider | What they do | Location |
|---|---|---|
| Vercel | Hosts the website and app, and counts anonymous visits (Web Analytics) | United States |
| Neon | Stores your account data (database) | United States |
| Clerk | Sign-up, sign-in and account security | United States |
| Anthropic | AI reviewing and writing (Claude) | United States |
| OpenAI | AI reviewing and writing, only if you add an OpenAI key | United States |
| Stripe | Payments and subscriptions for the Personal plan (receives your email, payment details and billing address) | United States |
| Google Fonts | Website fonts (receives your IP address only) | United States |
Job sources. To find jobs we read public job boards (Greenhouse, Lever, Ashby, Recruitee) and, when enabled, search Adzuna and Jooble. Those searches send only job titles and city names from your brief, never your name, email or CV. When you paste a link, our server visits that page to read it.
We may also disclose information if the law requires it, to protect someone's safety, or as part of a sale or reorganization of fuzzyHR. In a sale, the buyer would have to keep honouring this policy.
6. Storage outside Quebec and Canada
Your information is stored and processed in the United States by the providers above. As Quebec law requires, before sending personal information outside Quebec we assess whether it will be adequately protected, taking into account each provider's contract terms and security practices, and we review that assessment when our providers change. While it's in the U.S., it may be accessible to authorities there under U.S. law.
7. How long we keep it
We keep your information while your account is open. When you delete your account, your profile, CV, brief, applications, documents, saved key, briefings, usage records and activity log are deleted right away. Deleting your account also cancels any subscription. Stripe keeps payment and invoice records for as long as tax and accounting laws require. Backups held by our database provider expire on their normal cycle, within 30 days. We keep one record that an account was deleted, with no personal details. Request logs at our hosting and sign-in providers expire on their own schedules.
8. How we protect it
All traffic uses encrypted HTTPS connections. Saved AI keys are encrypted with a key held separately from the database. Only the site owner can see account data, through an admin area protected by sign-in, and only to run and support the service. We use reputable providers with their own security programs. If a breach puts you at risk of serious harm, we will notify you and the relevant regulators as the law requires. That means Quebec's Commission d'accès à l'information, the Office of the Privacy Commissioner of Canada, and U.S. state authorities where applicable.
9. Your rights
Wherever you live, you can:
- See and download your information: Plan → Download my data gives you a structured file (JSON) of everything we store about you.
- Correct it: edit your CV and brief at any time under Your brief, or ask us.
- Delete it: Plan → Delete my account deletes your account and data immediately.
- Withdraw consent to any use, for example by switching off Autopilot or removing your AI key, or by deleting your account.
- Ask about automated recommendations: what information and factors produced them (see section 4).
- Complain: write to our contact email (coming soon; it will be posted here) first, and we'll answer within 30 days. You can also contact Quebec's Commission d'accès à l'information, the Office of the Privacy Commissioner of Canada, or, in the U.S., your state attorney general or privacy agency.
U.S. residents. Depending on your state (for example California, Colorado, Connecticut, Virginia, Texas, Oregon and others), you may have the right to know what we collect, access, correct, delete and port your data, and to opt out of the sale of data, targeted advertising and profiling that produces legal or similarly significant effects. We don't sell data, do targeted advertising, or make such decisions about you. California residents: the categories we collect are listed in section 2, the sources in section 2, the purposes in sections 2 and 4, and the recipients in section 5. We will not treat you differently for using your rights. You can use an authorized agent; we may ask you to confirm your identity from your account email.
10. Age
fuzzyHR is for people 16 and older. We don't knowingly collect information from anyone younger. If you believe a child has signed up, write to our contact email (coming soon; it will be posted here) and we'll delete the account.
11. Changes
If we change this policy, we'll update the date at the top. For significant changes, we'll tell you in the app or by email before they take effect.
12. Contact
Nicola Delnero, Person in charge of the protection of personal information, fuzzyHR, Montreal, Quebec, Canada. Email: our contact email (coming soon; it will be posted here).