Privacy Policy

How CareerStudioMax collects, uses, and protects your data.

1. Who we are

CareerStudioMax is operated by Owolabi Kumuyi, trading as CareerStudioMax ("we", "us"), a sole trader based in Lagos, Nigeria. Contact for privacy questions: career@careerstudiomax.com. Nigeria's Data Protection Act 2023 (NDPA), enforced by the Nigeria Data Protection Commission (NDPC), is our home data protection law. If you're located in the European Economic Area (EEA) or UK, the EU GDPR / UK GDPR also applies to our processing of your personal data — not because we're established there, but because we offer the service to you (extraterritorial scope). As a matter of policy, we apply the same core protections described in this policy to every user, regardless of location, rather than only where strictly required. [EU/UK REPRESENTATIVE — pending: if we continue actively serving EEA/UK users, GDPR Art. 27 likely requires appointing a low-cost EU representative service; not yet done.]

2. What we collect

Account information

• Name, email address, and password (stored as a bcrypt hash — we never see or store your plaintext password)
• If you sign in via Google or LinkedIn: the basic profile info you consent to share on their sign-in screen (name, email, avatar)

Career data you provide

• Resume/CV content, work history, skills, career goals, portfolio content
• Interview practice: text transcripts and AI evaluation logs (auto-deleted after 90 minutes); a single webcam frame may be analyzed for body-language feedback by our own self-hosted vision model and is never stored or sent to a third party; audio is transcribed via our self-hosted engine or, as a fallback, Groq's cloud transcription API
• Voice cloning (Elite plan only): if you use this optional feature, a recording of your voice is sent to ElevenLabs to create a synthetic voice profile. We store only the resulting profile reference, not the raw recording. A voice profile is a biometric-adjacent identifier — we treat it accordingly and delete it from ElevenLabs' platform (not just our own records) when you remove it or delete your account.
• Content you create with AI tools (cover letters, generated apps, portfolio sites, etc.)
• If you use visa/relocation planning tools: the countries, employer, salary, and immigration-purpose details you enter, which are processed by an AI provider to generate guidance

Usage data

• Pages visited, features used, and general activity logs, used to operate and improve the product

Payment information

• Subscription billing is handled by Stripe (and, where enabled, regional processors). We never receive or store your full card number — see Third-Party Data Sharing for the full breakdown.

Cookies

• Session cookies to keep you signed in, and (where you consent) analytics/preference cookies. See the cookie banner shown on first visit, or the full Cookie Policy for a complete, named list.

3. How we use it

• To provide the service: power your AI recommendations, resume analysis, interview coaching, and every feature that reads your career data
• To process payments and manage your subscription
• To send transactional emails (verification, receipts, account notices) and, if you opt in, job alerts and product updates
• To detect abuse, enforce rate limits, and keep the platform secure

We do not sell your personal data.

4. Who we share it with

Certain features send data to external providers to work — AI inference engines, the payment processor, email/SMS providers, and similar. A full technical breakdown of exactly which service receives what, and why, is maintained at /data-sharing — treat that page as the authoritative, code-level source of truth for third-party data flows, and this policy as the plain-language summary.

5. AI processing

Career Studio uses third-party AI providers to generate advice, feedback, and content. Your resume text, career details, and questions are sent to whichever provider is handling that specific request. AI outputs can be inaccurate — review anything AI-generated before relying on it, especially before submitting a job application or making a career decision based on it.

6. Data retention & deletion

• Before deleting, you can view a live summary of everything stored about you, and export it as a downloadable file, from Account Settings.
• Deleting your account requires typing a confirmation and (if applicable) your password. It then enters a 14-day grace period before permanent erasure — signing back in and cancelling during that window fully reverses it.
• If you have an active subscription, deleting your account cancels it immediately, before the grace period even starts.
• Once the grace period ends, we hard-delete your data — resumes, applications, portfolios, interview sessions, calendar data, and every other collection tied to your account — not a soft-delete flag.
• One retention exception: we keep a minimal audit-log entry (account identifier, action type, timestamp) of security- and compliance-relevant actions for up to 2 years, even after account deletion, as permitted under GDPR Art. 17(3)(b)'s legal-obligation exemption. This trail does not include your resume, career data, or other content.

7. Your rights

As a matter of policy, everyone using CareerStudioMax — not only EEA/UK residents entitled to them under GDPR, or Nigerian residents entitled to them under the NDPA — has the following rights:

• Access — see what personal data we hold about you (Account Settings → data summary)
• Rectification — correct inaccurate data (edit your profile directly)
• Erasure ("right to be forgotten") — delete your account and data (subject to the audit-log exception in §6)
• Portability — export your data in a structured, machine-readable format (Account Settings → export)
• Object / restrict — object to or ask us to limit certain processing
• Withdraw consent — where processing is based on consent (e.g. optional cookies), withdraw it at any time via the cookie banner or Account Settings

You can exercise most of these yourself from Account Settings; for anything else, contact career@careerstudiomax.com. If you believe we haven't resolved your request properly: Nigerian users can lodge a complaint with the Nigeria Data Protection Commission (NDPC); EEA/UK users can lodge a complaint with their own country's data protection regulator (as a non-EU-established controller, we don't have a single "lead supervisory authority" the way an EU-established company would).

8. Security

Data is encrypted in transit and at rest. Passwords are hashed with bcrypt and never stored in plaintext. Sessions expire after 7 days. No system is perfectly secure, and we can't guarantee absolute security of information transmitted over the internet.

9. International data transfers

We're based in Nigeria, so all storage and processing of your data outside Nigeria is an international transfer from our perspective. Your account and application data is stored in MongoDB Atlas, hosted in the eu-west-1 (Ireland) region; our application server is hosted on Render in Oregon, United States; and several sub-processors we rely on (Stripe, Groq, Anthropic, ElevenLabs, HeyGen, Twilio, AWS, and others) are also US- or EU-based. For EEA/UK users, we rely on the European Commission's Standard Contractual Clauses (SCCs) or an equivalent adequacy mechanism with these providers where required. [Confirm and document the specific SCC/adequacy status with each individual processor, and the correct NDPA cross-border transfer mechanism under Nigerian law, before finalizing this section.]

10. Children

CareerStudioMax is not directed at children under 16, and we don't knowingly collect data from anyone younger. Registration requires a date of birth and is blocked if it indicates an age under 16.

11. Changes to this policy

We'll post updates here and, for material changes, notify you by email or an in-app notice.

12. Governing law

This policy is governed by the laws of the Federal Republic of Nigeria, without regard to conflict-of-law principles. This doesn't limit any mandatory consumer-protection or data-protection rights you have under the law of your own country of residence.

CareerStudioMax · Last updated 2026 · This is a starter document — see the notice above before relying on it.