NDPA 2023 Compliant

Privacy Policy

Effective Date: August 2026 • Applicable Law: Nigeria Data Protection Act (NDPA) 2023

CoreCV Privacy Commitment (At a Glance)

We never sell your data: Your career history and personal info are never sold to advertisers or third-party brokers.
Zero AI model training: We do not use your private resume, vault records, or applications to train public AI models.
You own your content: You maintain 100% full ownership over every bullet point, project, and document in your Vault.
Right to Erasure: You can export or permanently delete your account and all associated data at any time.

1. Information We Collect

To provide the CoreCV Career Intelligence Platform and Master Vault services, we collect the following categories of information:

  • Account Identifiers: Name, email address, and OAuth authentication tokens (when signing in via Google OAuth or LinkedIn OAuth).
  • Master Vault Data: Work history, job titles, responsibilities, project descriptions, education, certifications, and uploaded resume files (PDF/DOCX).
  • Application Telemetry: Job descriptions pasted for fit assessments, generated resume drafts, interview notes, and match score metrics.
  • Technical & Device Data: IP addresses, browser type, operating system, and essential authentication cookies required to keep your session secure.

2. Lawful Basis for Processing (NDPA 2023)

In accordance with Section 25 of the Nigeria Data Protection Act 2023, CoreCV processes personal data under the following lawful bases:

Contractual Necessity

Processing your career records to build your Vault, run role-fit scoring, and generate ATS-ready applications upon your request.

Explicit Consent

When you voluntarily join the Founding User waitlist, connect OAuth accounts, or request AI coaching assistance.

3. Artificial Intelligence & Third-Party Processing

CoreCV integrates advanced AI APIs (such as Google Gemini via the Vercel AI SDK) and search grounding engines (Tavily):

Strict Enterprise Isolation: When you request an AI assessment or resume draft, data is transmitted over encrypted TLS 1.3 tunnels to the model endpoint.

Under our API enterprise agreements, user personal career records are NOT stored by LLM providers, NOT visible to other users, and NOT used to train public foundational AI models.

4. Infrastructure & Data Processors

We partner with industry-leading, SOC-2 and ISO-27001 certified cloud infrastructure providers to store and secure your records:

  • Database & Authentication: Supabase (PostgreSQL with AES-256 encryption at rest and Row-Level Security).
  • Hosting & Edge Compute: Vercel Inc.
  • Payment Processing: Dodo Payments / Stripe (CoreCV never stores raw debit/credit card numbers).

5. Your Data Rights & Deletion

Under the Nigeria Data Protection Act 2023 and global data protection regulations, you hold the following rights:

  • Right of Access: Request a complete copy of all career records stored in your Vault.
  • Right to Rectification: Edit, update, or correct any personal or career history entry at any time.
  • Right to Erasure (Right to be Forgotten): Permanently delete your account and all associated vault records from our database.
  • Right to Object: Withdraw consent for non-essential communications or specific processing activities.

To exercise any of these rights, email us directly at privacy@corecv.app. We process all data deletion requests within 7 business days.

6. Cookies & Tracking

CoreCV uses strictly necessary cookies to maintain authenticated sessions and protect against cross-site request forgery (CSRF). We do not use third-party behavioral advertising cookies.

7. Contact the Data Protection Team

If you have any questions, concerns, or requests regarding this Privacy Policy or our compliance with the Nigeria Data Protection Commission (NDPC), please contact our Data Protection Officer:

CoreCV Data Protection Office

CoreCV Technologies, Ibadan, Oyo State, Nigeria

Email: privacy@corecv.app