DRAFT, needs legal review. Do not publish this as a finished policy.

Privacy notice

This draft describes how Yuk Wah Chu (trading as Nexa) handles personal data for the Nexa service at getnexacareer.com. It is written for people in the UK.

Who is responsible

The data controller is Yuk Wah Chu (trading as Nexa). Address: [Registered address to be added]. Email: hello@getnexacareer.com.

What we collect

• The email address you enter when you pay or sign in.
• Payment status from Stripe. We do not store your card number.
• The CV you upload, the job description or job link, and the tailored CV we generate.
• A sign-in cookie so you can return without a password.

Why

We use this data to sell you credits, tailor a CV, email a sign-in link or receipt, and keep the service secure. The legal basis we expect to rely on is contract, and legitimate interests for security and fraud prevention. A lawyer needs to confirm that.

How long

Uploaded CVs, job descriptions and generated CVs are deleted automatically after 30 days. You can delete them sooner with “Delete my data now” after you sign in via the magic link. Credit records and the email address stay until you delete the account or ask us to erase them, because they show what you paid for.

Where it is stored

The database and file store are intended to run in the UK or EU. The assumed host is Supabase in London. Email is sent with Resend. Payments are handled by Stripe. The CV text is sent to Anthropic so the model can draft the tailored CV. Anthropic may process that text outside the UK. A transfer safeguard still needs to be chosen and written up.

Hosting on Vercel may also process technical logs. Confirm the regions before launch.

Cookies

Nexa uses one essential cookie, nexa_session, to keep you signed in. It is HTTP-only. There are no analytics or advertising cookies in this version. If analytics are added later, they should be cookieless.

Your rights

You can ask for access, correction, deletion, restriction, or a copy of your data, and you can complain to the Information Commissioner’s Office. Use the contact email above. Deleting CVs from the signed-in page is the fastest way to remove the documents.

What we do not do

We do not sell your CV. We do not add a photograph, date of birth, or invented work history.