Practical privacy summary

How your data works in Career DNA

Career DNA by HM-Exec is built without user accounts or a server-side CV database. Below is an exact, plain-English summary of what stays on your device, what passes through the server to generate AI results, and what lightweight records exist during the beta.

1. Your CV, profile and generated results stay in your browser

Where your profile lives: Your extracted or questionnaire-built career profile, Career DNA, personal brand (including your generated cover letter), career paths and no-CV questionnaire drafts are saved in your browser's localStorage. If you upload a PDF CV, the original PDF file is stored locally in your browser's IndexedDB so you can preview it side-by-side.
How to remove it: Clicking Start over in the dashboard sidebar or Clear profile on the Profile page (or clearing site data in your browser) immediately deletes your saved profile, generated results, no-CV questionnaire draft and stored PDF from that browser. It does not erase short-lived server rate-limit counters, aggregate daily totals or any feedback note you have already submitted.
Switching devices or website addresses: Browser storage belongs to one browser on one device and is tied to the exact web address (domain) you used. If Career DNA moves from a preview address to a custom HM-Exec domain (such as app.hm-exec.com) or if you open the link on another computer or in an incognito window, your saved profile will not follow automatically. Use My report → Save as PDF or Profile → Export CV / Cover letter (.docx / PDF) to save a permanent copy.

2. How AI analysis works (server pass-through & Anthropic)

No server CV database: When you upload a file, paste LinkedIn text, or generate an analysis section, your browser sends the relevant text to our Next.js server route so it can call the Anthropic Claude API using our server API key. Our application does not save your CV file, profile JSON or generated career reports in a server database.
AI provider processing: Prompts are processed by Anthropic's commercial API. Under Anthropic's standard commercial API terms, API inputs and outputs are not used to train foundation models by default. API inputs and outputs are normally deleted within 30 days, with exceptions for legal and safety requirements or separately agreed arrangements. See Anthropic's data-retention policy.
Salary research: If you choose Check market pay, the role title and selected search area are sent to Anthropic's web search to find published pay information. Your CV, name, contact details and current pay are not included in that research request. The cited summary is saved with your local browser session and can be included in My report. The public role/location research is also cached on the server for up to 24 hours to avoid repeating paid searches (in Redis when configured, otherwise temporary local memory). It contains the role, location, source links and summary, with no CV, contact details or current pay.
Standard hosting logs: Like any web application, the hosting platform (such as Vercel) records short-lived operational request metadata (timestamps, route paths, status codes and error diagnostics), without logging CV contents.

3. Fair-use browser allowances & aggregate beta metrics

Anonymous browser identifier cookie: When you visit Career DNA, the server sets an HTTP-only signed cookie (career_dna_vid, valid for up to 30 days) containing a random identifier—not your name, email or CV. When a shared beta passcode is enabled, unlocking the gate also sets a signed access cookie (career_dna_gate, valid for up to 14 days).
Rate-limit counters: To keep the free beta fair and protect shared office or university Wi-Fi networks, our server stores short-lived request counters in Upstash Redis keyed by SHA-256 hashes of that browser cookie and network IP address, alongside a daily overall safety cap. Rate-limit windows expire automatically after 1 minute to 24 hours (60-second burst, 1-hour and 24-hour allowances).
Aggregate activity, session duration & coarse demographics: We record privacy-safe daily totals (completed section runs, onboarding mode split, token usage, active dashboard tab seconds, approximate HyperLogLog counts of distinct and returning hashed browser cookies via a last-active UTC date keyed by that hashed browser identifier, and coarse NZ/AU regional and career-stage counters), expiring after 90 days. Raw IP addresses and personal CV text are never stored in these metrics, and browser-cookie counts are never treated as verified unique individuals.
Local development difference: When Upstash Redis is not configured on a developer's local machine, rate-limit counters and daily metrics stay only in temporary server process memory and reset whenever the local server restarts.

4. Optional beta feedback & Career DNA Pro waitlist

What is collected: If you choose to submit the Feedback form, we record only what you enter there: your usefulness rating, the relevant section name, your optional comment, whether you ticked interest in Career DNA Pro, and any contact email address you voluntarily provide. Your CV, extracted profile and generated career reports are never attached to feedback submissions.
Per-submission 90-day retention in Redis: In hosted production, feedback requires configured durable storage (otherwise submission fails with an error rather than saving only in temporary memory). In Upstash Redis, each individual feedback submission is stored under its own key with a 90-day expiry measured from that submission's creation time—newer submissions never extend the retention of older ones.
Local development storage: During local development without Upstash Redis configured, test feedback is held only in temporary server process memory (also bounded to 90 days) and is cleared as soon as the local development server stops or restarts.
Optional external forwarding & weekly digests: If a deployment configures an optional feedback webhook (FEEDBACK_WEBHOOK_URL) or weekly digest email/webhook (FEEDBACK_DIGEST_TO / FEEDBACK_DIGEST_WEBHOOK_URL) to forward voluntary submissions or Career DNA Pro waitlist sign-ups to HM-Exec, any copy received in that external inbox or system is governed by HM-Exec's own retention practices rather than the 90-day Redis expiry.