Privacy Notice
Last updated September 20, 2026
The short version
- Your resumes are yours. We do not sell data, we do not share it for advertising, and we do not use your writing to train AI models.
- There is no analytics, no advertising technology and no third-party script anywhere on this site. We do not know which pages you visited.
- We do not log IP addresses or browser user agents.
- The only cookies are the ones that sign you in. That is why there is no cookie banner - there is nothing to ask you about.
- When you use an AI feature, the text needed for it goes to OpenAI, who process it for us and may not train on it.
- You can download everything we hold, or delete your account outright, from Settings. Both are free and neither needs you to ask us.
Who is responsible
Kivire is run by [operator’s legal name], at [street address], [city], California, [ZIP], United States. For data protection law, that person is the controller of the personal data described here. Write to [email protected] about anything on this page.
What we hold
| What | Specifically | Where it comes from |
|---|---|---|
| Your account | Name, email address, profile picture if you signed in with Google, your plan, and the date you joined. | You, or Google if you sign in that way. |
| Your resumes | Everything in them: name, email, phone, city, links, employers, job titles, dates, education, grades, skills and every bullet you write. Earlier versions are kept so you can go back, up to twenty per resume. If you import a resume, we keep the resume we made from your file, and not the file. | You. |
| Cover letters and assistant conversations | The letters you write, and what you typed to the editor assistant along with the edits it made. | You. |
| Job postings you paste or bring in | The text of the posting and what we read from it, whether you pasted it, gave us a link to it, or sent a screenshot of it. Postings are stored once and shared between accounts that use the same one, so a posting is not tied to your identity. The screenshot itself is not stored. | You. |
| Billing | Your plan, the status of a subscription, and what you have bought. Your card details are handled by Stripe and never reach our servers. | You, through Stripe. |
| Usage | One row for each AI request: the feature, the model, how many tokens it used, what it cost and whether it worked. Not what you asked for - the text is not kept. Plus a record of when you downloaded a resume. | Generated as you use Kivire. |
| Sign-in records | Your active sessions and, if you use Google, the tokens that let us verify it is you. | Generated when you sign in. |
What we deliberately do not collect
We do not record your IP address, your browser user agent, your location, or which pages you looked at. There is no analytics product, no heatmap, no session recorder and no advertising pixel. Server error logs record what broke and on which route, and are written so that they cannot contain your resume or your session cookie.
Why, and on what legal basis
If you are in the UK or the EU, the GDPR requires us to name a lawful basis for each use. These are ours.
| Why | Basis |
|---|---|
| To give you the account, store your resumes and run the features you ask for. | Performance of a contract |
| To take payment, apply your plan’s limits and meter AI usage against them. | Performance of a contract |
| To keep records of what was paid, for tax and accounting. | Legal obligation |
| To keep the service up and safe: rate limits, abuse prevention, aggregate performance measurements, and a log of what administrators did to accounts. | Legitimate interests — running a service that works and can account for itself. Nothing in this row identifies you to anyone outside Kivire. |
| To email you about your account, a payment problem, or a change to these documents. | Performance of a contract |
We do not currently rely on consent for anything, because we do not do any of the things that would need it: no marketing email, no analytics, no advertising, no profiling. If that ever changes we will ask first, and you will be able to say no.
What the AI receives
AI features are run by OpenAI on our behalf, under terms that bar them from training on what we send and require them to delete it after a short abuse-monitoring window.
Be aware: your contact details go with the resume
Most AI features work from your resume as a whole, and that includes the header - your name, email address, phone number and city - because the model is given the resume the way it reads on the page. If you would rather that did not leave, take those fields out before using them. The features that work from a single bullet, or from a job posting alone, send only that.
Importing a resume you already have
When you upload a resume, or paste the text of one, it is sent to OpenAI to be read and sorted into sections. For a PDF or a photograph that means the file itself, so whatever is on the page goes with it, including a photo of you if your resume has one and your full contact details. We do not keep the file: it is read, turned into a resume in your account, and dropped. If you would rather none of that left our servers, start from a blank resume and type it in, which involves nobody but us.
Bringing in a job posting
If you give us a link to a posting, our server fetches that page. The site sees a request from Kivire, which says so by name, and not one from you or your browser. If you send a screenshot instead, the image goes to OpenAI to be read into text. We do not store it: it is passed through and dropped, and only the text you then approve is kept. A screenshot is sent as it is, so crop out anything in it that is not the posting.
Interview practice records your voice
If you answer out loud, the recording is sent to OpenAI to be transcribed and the interviewer’s reply is sent back to be spoken. We do not store the audio: it is passed through and dropped. The transcript of the practice session is kept only for the length of that session.
What we keep about it
For each AI request we record the feature, the model, token counts, cost, whether it succeeded and how long it took. We do not keep the prompt or the response, except where you save the result yourself - an assistant conversation or a cover letter you keep is kept because you kept it.
How long we keep it
| What | How long |
|---|---|
| Your account and everything in it | Until you delete it. Deleting is immediate and permanent. |
| Earlier versions of a resume | The last twenty per resume; older ones are dropped as new ones are made. |
| Sign-in sessions | 30 days, or until you sign out. |
| AI usage records | 24 months, then deleted automatically. |
| Payment records | As long as tax law requires, which is typically seven years. Held by Stripe as well as by us. |
| Server performance measurements | 14 days. They contain no personal data. |
| Administrator actions on your account | Kept after deletion as a record of what was done, with your email address and the free-text reason removed. What remains is the action and the date. |
Your rights
Two of these you can exercise yourself, right now, without asking anyone:
- Get a copy. Settings → Your data → Download everything. It is a JSON file containing every row we hold about you, with a note saying what each part is.
- Delete it. Settings → Your data → Delete account. It removes your resumes, letters, conversations and history, cancels any subscription, and cannot be undone.
The rest, and the same two if you would rather ask, by writing to [email protected]:
- Correct anything that is wrong. Most of it you can edit yourself.
- Object to, or ask us to restrict, a use that rests on our legitimate interests.
- Ask for your data in a portable form, which is what the download already is.
- Withdraw consent, where we ever rely on it.
We answer within one month, as the GDPR requires, and within 45 days for requests under California law. It is free. We will ask you to confirm you are who you say you are, which for an account holder usually means writing from the address on the account.
If your account has been suspended you cannot sign in to use the buttons above. The right does not go away with the access: write to [email protected] and we will deal with it within the same deadlines.
If you are in California
The CCPA, as amended by the CPRA, gives you the right to know what is collected and why, to get a copy, to have it deleted, to correct it, and not to be treated differently for asking. Everything above applies to you, and the same two buttons in Settings do the work.
We do not sell personal information and we do not share it for cross-context behavioural advertising. We never have. There is no “Do Not Sell or Share” link because there is nothing for it to turn off.
We do not use or disclose sensitive personal information for any purpose beyond providing the service you asked for.
Where your data is
Kivire is operated from the United States and its providers are largely United States companies, so if you are outside the US your data is transferred there and to wherever those providers operate.
For transfers out of the UK or the European Economic Area we rely on the European Commission’s standard contractual clauses, and the UK addendum where the UK GDPR applies, entered into with each provider. You can ask us for the details.
How it is protected
- Everything travels over HTTPS, and the site asks browsers to refuse anything else.
- We never see your card number. Payment details are collected by Stripe on their own pages.
- Sign-in is by Google or by a one-time link sent to your email. There is no password to steal, and we store none.
- Sign-in cookies cannot be read by JavaScript, and the site cannot be framed by another.
- Administrator access is limited to named accounts, and every administrative action on an account is recorded with a reason.
No service is perfectly secure. If we ever find that personal data has been exposed, we will tell the relevant supervisory authority within 72 hours where the law requires it, and tell you directly if the risk to you is significant.
Children
Kivire is not for children. You must be at least 16 to have an account. We do not knowingly collect data from children, and if we find out we have, we delete it. If you believe a child has an account here, write to [email protected].
Changes
If this notice changes in a way that matters - a new recipient of your data, a new purpose, anything that narrows your rights - we will email account holders before it takes effect. Smaller corrections take effect when published, and the date at the top of this page moves with them.
Contact and complaints
[operator’s legal name]
[street address], [city], California, [ZIP], United States
[email protected]
If you are in the EEA or the UK and you think we have handled your data badly, please tell us first - but you are entitled to complain to your national data protection authority without doing so. In the UK that is the Information Commissioner’s Office.