Privacy Policy

1. Who We Are

This Privacy Policy applies to Crescendo Social: AI Job Hunter(the “Service”), a mobile, browser-extension, and web application that helps you track job applications, analyze resumes with AI, and prepare for interviews. The Service is owned and operated by Crescendo Social(“Crescendo Social”, “we”, “our”, or “us”). This Privacy Policy explains how we collect, use, and protect your personal data when you use the Service.

Crescendo Social: AI Job Hunter is an independent product of Crescendo Social and is not affiliated with, endorsed by, or associated with any other business, brand, or product that shares the word “Crescendo” in its name.

Crescendo Social, based in Sri Lanka, is the controller of the personal data described in this policy. Questions? Contact us at hello@crescendosocial.com.

2. Data We Collect

We collect the following categories of data:

Account Data

• Full name and email address (provided when you register)
• Profile photo (optional, if you upload one)
• Target role / profession and preferred job-search location (optional)
• Encrypted password (plaintext passwords are never stored)

Application & Career Data

• Job applications you create, including company, role, status, notes, contacts, and related company context used to personalize your in-app feed
• Resume files you upload (PDF/DOCX) and their parsed text content
• Job descriptions you paste for AI analysis
• AI-generated analysis results, match scores, recommendations, and personalized feed content
• Interview prep quiz results and session history
• Career goals you set within the app

Usage & Technical Data

• Basic, aggregate website analytics collected through Umami, such as pages visited, referrers, device/browser type, country-level location, and visit timestamps. We do not use web session replay or record the contents of resumes, applications, notes, or other in-app screens for analytics.
• Infrastructure and application logs used for security, reliability, and troubleshooting, which may include technical context such as request timestamps, app version, browser, operating system, and device details
• First-party product events stored in Supabase, such as a user identifier, pseudonymous browser identifier, session identifier, route, event name, and limited event properties. These events do not contain resume text, application notes, or generated AI content
• Limited technical signup context such as platform, app version, operating system, locale, timezone, device model, and web user agent when available. We use this for operational signup notifications and troubleshooting and do not store it in our public application tables solely for that notification purpose
• Push notification preferences
• AI credit balance and transaction history
• Device Permissions: Camera and Photo Library access only if you explicitly choose to upload an avatar
• Biometric Data: Face ID/Touch ID is processed entirely on your device by the OS. We never receive or store biometric data
• Payment Information: We do not store credit card numbers. Payments are processed by Google Play or our payment providers

Data We Do NOT Collect

• Your precise device GPS location
• Your device contacts or address book
• Data from other apps on your device
• Advertising identifiers

3. How We Use Your Data

We use your data to:

• Provide and operate Crescendo Social: AI Job Hunter and its features
• Process AI requests. Your resume, job descriptions, profile preferences, application metadata, and relevant public content may be processed to generate match scores, recommendations, interview content, and personalized feed items
• Parse and import job details from third-party URLs you provide
• Process payments and manage subscriptions
• Personalize your Daily Pulse feed using your target role, preferred location, application activity, and relevant company context
• Schedule on-device notifications for reminders and follow-ups (only if you grant permission)
• Improve app stability, prevent abuse, and fix bugs using operational logs
• Understand aggregate website usage through Umami so we can improve the product without web session replay
• Generate anonymous, aggregated peer benchmarks and community insights without exposing another user's personal data
• Respond to support requests
• Enforce our Terms of Service

We do not use your data for advertising, profiling, or sell it to third parties.

Legal Bases

Where applicable law requires a legal basis, we process account, career, AI-request, and subscription data to perform our contract with you; security, fraud-prevention, service improvement, and limited product analytics for our legitimate interests; optional device permissions or non-essential processing with your consent; and transaction or compliance records where required by law. You may withdraw consent for consent-based processing at any time without affecting earlier lawful processing.

4. AI Processing

When you use AI features (resume analysis, optimization, interview prep, cover letter generation, and Daily Pulse generation), your resume content, job description text, profile preferences, application metadata, and selected public third-party content may be sent to our AI processing infrastructure to generate results. This data is processed solely to produce your requested output and personalized in-app experiences, and is not used to train AI models or shared with other users.

Our backend uses Supabase for database and storage services and Google Gemini for AI inference. Gemini processes your data under Google's applicable terms and privacy commitments for the specific inference request.

We do not use your resumes, applications, prompts, or generated outputs to train our own AI models. We send only the information needed to complete the feature you requested.

AI outputs provide recommendations and drafts for your review. They do not make decisions that produce legal or similarly significant effects about you. Employers and other third parties make their own decisions independently of Crescendo Social.

5. Data Storage & Security

• All data is stored on Supabase (PostgreSQL), hosted on secure cloud infrastructure
• Data in transit is encrypted via TLS/HTTPS
• Data at rest is encrypted by the storage provider
• Access to your data is controlled by Row Level Security (RLS). Only you can access your own data
• Resume files are stored in private, access-controlled cloud storage buckets
• We perform regular security reviews and follow industry best practices

6. Data Retention

We retain your data while your account is active. Before deletion, any active Dodo Payments, Google Play, or other app-store subscription must be cancelled and its current paid period must end. We block deletion while paid access remains so that your billing link is not destroyed while a provider could still renew or charge the subscription.

After a successful in-app deletion, login credentials and live product data are removed immediately. This includes your profile, applications, resumes, cover letters, interview data, AI history, product analytics, uploaded files, and public CV media. If you request deletion by email, we process the verified request within 7 business days.

De-identified billing transaction records may be retained for the applicable accounting, tax, fraud-prevention, refund, dispute, and legal period. Backup copies, infrastructure logs, email-delivery records, and processor caches may take up to 30 days to age out. Files you intentionally downloaded or exported remain on your device and are not remotely deleted. Support correspondence may be retained where reasonably needed to resolve your request, document consent or instructions, prevent abuse, or establish or defend legal claims.

First-party Supabase product events are retained for up to 90 days. A one-way hash recording that an inactivity deletion completed is retained for up to 30 days for operational verification; it does not contain the account email or original user identifier.

Inactive Accounts: Our inactivity-retention program begins on August 1, 2026. Inactivity is measured from the latest recorded successful sign-in or covered product activity, but never from a date earlier than August 1, 2026. The earliest automatic deletion is November 1, 2026. We send at least 14 days' advance notice to the account email, and signing in or using a covered account feature restarts the inactivity period. Accounts with active paid access are excluded. If notice delivery or mandatory cleanup fails, deletion is deferred rather than performed incompletely.

Limited signup notification metadata that we send in operational emails is not intentionally stored in our public product tables for that purpose, but may still appear temporarily in processor logs, email delivery systems, or platform infrastructure needed to deliver the notification.

7. Your Rights

Depending on your location, you may have the right to:

• Access - request a copy of the data we hold about you
• Correction - correct inaccurate data via the app's profile settings
• Deletion - delete your account and all associated data
• Portability - request your data in a machine-readable format
• Objection - object to certain processing activities
• Restriction or consent withdrawal - where provided by applicable law

To exercise any of these rights, email hello@crescendosocial.com. You may also lodge a complaint with the Data Protection Authority of Sri Lanka or the competent supervisory authority in your country.

8. Third-Party Services

Crescendo Social: AI Job Hunter uses the following third-party services:

• Supabase - database, authentication, and file storage
• Cloudflare - web application hosting, content delivery, security, and infrastructure logs
• Umami - privacy-focused website analytics used to understand aggregate site usage; no web session replay is enabled
• Resend - transactional email delivery for operational emails such as signup notifications
• Google Gemini - AI inference for analysis features and personalized feed generation
• Google - optional Google Sign-In and related authentication services
• Google News and other public web sources - public content used to generate market signals, company updates, and career tips
• Google Play - payment processing and subscription management
• Dodo Payments - web payment processing and subscription management
• Expo and Google Play services - mobile application and Android notification infrastructure. Current reminders are scheduled locally on your device; remote push delivery is not currently used

Each third party is bound by their own privacy policies and data processing agreements.

These providers may process data in countries outside Sri Lanka or your country of residence. Where required, we rely on provider contractual safeguards, adequacy mechanisms, or other lawful transfer measures. You can contact us for further information about the safeguards relevant to your data.

We do not currently use web session replay or heatmap recording. If we add non-essential analytics features that require consent, we will ask for consent where required by applicable law.

9. Children's Privacy

Crescendo Social: AI Job Hunter is not directed at children under 13 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with data, please contact us immediately at hello@crescendosocial.com and we will delete it promptly.

10. Changes to This Policy

We may update this policy from time to time. When we make significant changes, we will notify you within the app or by email. Continued use of the Service after changes are posted constitutes acceptance of the updated policy.

11. Contact

Questions or concerns about your privacy? Reach us at hello@crescendosocial.com