Privacy Policy

Pivot (“we”, “us”, “our”) operates the website located at pivot-cv.com and the associated web application (collectively, the “Service”). This Privacy Policy explains what personal information we collect, how we use and share it, how we protect it, and what rights you have in relation to it.

This policy applies to all users of the Service, regardless of location. By accessing or using Pivot, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service.

We are committed to protecting your privacy and handling your data in an open, transparent manner. If you have any questions about this policy, you can reach us at [email protected].

We collect the following categories of information when you use our Service:

Account Data

When you create an account, we collect your email address, name, and password. Your password is securely hashed using industry-standard algorithms before storage and is never stored in plain text. If you sign up using a third-party authentication provider (such as Google), we receive your name and email address from that provider.

CV Content

To provide our resume-building service, we collect the content you provide for your CVs, including but not limited to: work history, job titles, employers, education history, qualifications, skills, certifications, professional summary, and any other information you choose to include in your resume. This data is stored in your account and is used to generate and refine your CVs.

Usage Data

We automatically collect information about how you interact with the Service through PostHog, our analytics platform. This includes pages visited, features used, buttons clicked, time spent on pages, browser type, device type, operating system, screen resolution, and referring URLs. This data helps us understand how our Service is used and how we can improve it.

Payment Data

When you subscribe to a paid plan, your payment is processed by Stripe, our third-party payment processor. We do not directly collect, store, or have access to your full credit card number, debit card number, or bank account details. Stripe provides us with limited information such as the last four digits of your card, the card brand, the expiration date, and your billing address for record-keeping and support purposes.

Bot Protection Data

We use Cloudflare Turnstile to protect our Service from automated abuse. Turnstile may collect device and browser data, including browser type and version, screen resolution, and interaction patterns, to distinguish human users from bots. This data is processed by Cloudflare and is subject to their privacy policy.

Session Recordings

We use PostHog to record user sessions for the purpose of improving the user experience and diagnosing issues. These recordings capture mouse movements, clicks, scrolls, and page interactions. Sensitive fields such as passwords are automatically masked and are never captured in recordings. You can opt out of session recording by contacting us.

We use the information we collect for the following purposes:

• Service Delivery: To create and manage your account, store your CVs, and provide the core functionality of the Service, including generating, editing, and exporting resumes.
• AI-Powered CV Generation: To process your CV content through the Anthropic Claude API in order to provide AI-assisted resume writing, suggestions, market research, and optimisation features.
• Analytics & Improvement: To analyse usage patterns, diagnose technical issues, and improve the performance, functionality, and user experience of the Service.
• Billing: To process payments, manage subscriptions, and provide transaction records through our payment processor, Stripe.
• Support: To respond to your inquiries, troubleshoot problems, and provide customer support.
• Communication: To send you important notices about the Service, such as changes to our terms, security alerts, or billing confirmations. We will not send you marketing emails without your explicit consent.
• Security & Fraud Prevention: To protect the Service and our users from unauthorised access, abuse, and fraudulent activity.

Pivot uses the Anthropic Claude API to power its AI-assisted resume features, including content generation, rewriting, suggestions, and market research. When you use these features, the relevant portions of your CV content are sent to Anthropic's servers for processing.

Under Anthropic's commercial API terms of service, data submitted through their API is not used to train their AI models. Anthropic retains API inputs and outputs for a limited period solely for the purpose of providing the service and detecting abuse, after which it is deleted.

We want to be clear: Pivot does not use your CV data or any other personal information to train any AI models. Your data is used exclusively to provide you with the Service.

We recommend that you do not include highly sensitive personal information in your CV content beyond what is necessary for a professional resume (for example, government-issued identification numbers, financial account details, or medical information).

We use the following third-party services to operate and improve Pivot. Each service has its own privacy policy governing the data it processes:

• Anthropic (Claude API) — Provides AI-powered resume generation and content assistance. CV content is sent to Anthropic's API for processing. Anthropic Privacy Policy
• Stripe (Payments) — Handles all payment processing for subscriptions. We do not store your full payment card details. Stripe Privacy Policy
• Supabase (Database & Authentication) — Provides database hosting, user authentication, and file storage. Your account data and CV content are stored in Supabase. Supabase Privacy Policy
• PostHog (Analytics & Session Recording) — Provides product analytics, event tracking, and session recording to help us understand usage patterns and improve the Service. PostHog Privacy Policy
• Cloudflare (CDN & Security) — Provides content delivery, DDoS protection, and bot protection (Turnstile) for the Service. Cloudflare Privacy Policy

We only share your personal information with these third parties to the extent necessary to provide the Service. We do not sell your personal information to any third party.

We take the security of your personal information seriously and implement appropriate technical and organisational measures to protect it.

• Database: Your data is stored in Supabase, which provides encryption at rest using AES-256 and is SOC 2 Type II compliant.
• Payments: Payment data is handled exclusively by Stripe, which is PCI DSS Level 1 compliant, the highest level of certification in the payment card industry.
• Encryption in Transit: All connections between your browser and our Service, and between our Service and third-party providers, are encrypted using TLS (Transport Layer Security).
• Password Security: User passwords are hashed using industry-standard algorithms and are never stored or transmitted in plain text.
• Access Controls: Access to user data is restricted to authorised personnel and systems on a need-to-know basis.

While we implement robust security measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we are committed to promptly addressing any security incidents and notifying affected users as required by applicable law.

Depending on your location, you may have certain rights regarding your personal information. We respect these rights for all users regardless of jurisdiction, including rights under the General Data Protection Regulation (GDPR) and the New Zealand Privacy Act 2020.

• Right of Access: You have the right to request a copy of the personal information we hold about you. You can access most of your data directly through your Pivot account.
• Right to Rectification: You have the right to request that we correct any inaccurate or incomplete personal information. You can update your profile and CV content directly within the Service.
• Right to Erasure: You have the right to request the deletion of your personal information. You can delete your account and all associated data through your account settings, or by contacting us.
• Right to Data Portability: You have the right to receive your personal information in a structured, commonly used, and machine-readable format. You can export your CVs at any time through the Service.
• Right to Withdraw Consent: Where we process your data based on consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority. For users in the EU/EEA, this is your local data protection authority. For users in New Zealand, this is the Office of the Privacy Commissioner (OPC).

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days. We may ask you to verify your identity before processing your request.

We use a limited number of cookies and similar technologies to operate and improve the Service. We do not use any third-party advertising or marketing cookies.

Essential Cookies

We use essential cookies provided by Supabase to manage your authentication session. These cookies are strictly necessary for the Service to function and cannot be disabled. They include session tokens that keep you logged in as you navigate the application.

Analytics Cookies

We use PostHog analytics cookies to collect anonymous usage data about how visitors interact with the Service. This data helps us understand which features are most popular, identify usability issues, and make informed decisions about product development.

Session Recording

PostHog session recordings capture user interactions such as mouse movements, clicks, and scrolls. Sensitive form fields including passwords are automatically masked so that their contents are never recorded or transmitted. Session recordings are used solely for improving the user experience and diagnosing issues.

We do not use any third-party advertising cookies, retargeting pixels, or social media tracking scripts.

Pivot is operated from New Zealand. However, to provide the Service, your personal information may be transferred to and processed in countries outside of your country of residence, including the United States. Our third-party service providers — Supabase, Anthropic, Stripe, PostHog, and Cloudflare — may store and process data in the United States and other jurisdictions.

Where personal information is transferred outside of the European Economic Area (EEA) or other jurisdictions with data transfer restrictions, we ensure that appropriate safeguards are in place. These safeguards may include:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions by relevant data protection authorities
• Binding corporate rules or other legally recognised transfer mechanisms
• Contractual commitments by our service providers to protect your data in accordance with applicable privacy laws

By using the Service, you acknowledge that your data may be processed in these jurisdictions. If you have questions about international data transfers, please contact us.

The Service is not intended for or directed at individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us at [email protected] and we will take steps to delete such information from our systems promptly.

If we become aware that we have inadvertently collected personal information from a child under 16, we will take immediate steps to delete that information and, if applicable, terminate the associated account.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes to this policy, we will notify you by:

• Sending a notification to the email address associated with your account
• Displaying a prominent notice within the Service (such as an in-app banner)
• Updating the “Last updated” date at the top of this page

We encourage you to review this policy periodically. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. If you do not agree with the revised policy, you should discontinue your use of the Service and delete your account.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: [email protected]
• Company: Pivot
• Location: New Zealand

We aim to respond to all privacy-related inquiries within 30 days of receipt. For urgent matters related to data security or breaches, please include “URGENT” in your email subject line.