Privacy Policy

—1. Information We Collect

We collect only what we need to run the service. Nothing more.

1.1 Account Data

When you register, we collect your email address and, optionally, a display name. This is used only for login, account management, and service emails.

1.2 Professional Documents

When you upload a CV (PDF or DOCX), we extract the text in memory. When you paste a job description, we keep that text for the life of your project. These documents may contain professional details like employment history, qualifications, and career information relevant to Life Sciences roles — Pharmacovigilance, Regulatory Affairs, Clinical Operations, Medical Affairs, Quality Assurance, and related fields.

1.3 Payment Information

Payments are handled entirely by Stripe, Inc. We never see, receive, or store your card number or bank details. We only keep a Stripe customer ID and your subscription status. See Stripe's Privacy Policy for details.

1.4 Usage Data

We collect basic usage metrics (features used, number of tailorings) and technical data (browser type, session timestamps) to keep the service running smoothly. We use analytics, performance, and error-monitoring tools to understand product usage, diagnose issues, and improve reliability.

—2. How We Use Your Data

Your data is used for these purposes only:

• →Delivering the service — generating tailored CVs, cover letters, and ATS scores based on the job description and CV you provide.
• →Role classification — detecting the relevant Life Sciences role family from the job description to improve output quality. We use local validation and security checks first, then AI processing where needed for job-description extraction and analysis.
• →Account management — logging you in, managing your subscription, enforcing usage limits.
• →Service emails — password resets, subscription confirmations. We don't send marketing emails without your explicit opt-in.
• →Improving the service — reviewing product analytics, performance signals, and error reports to improve features and reliability. We do not review individual CVs for marketing or advertising.

—3. File Handling and Stored CV Data

When you upload a CV or resume, we process the file on our servers to extract and structure the text needed for the service. For project-scoped uploads, the original PDF or DOCX is not saved as your default CV; the extracted/structured CV data, filename, job description, and generated documents may be stored with the relevant project. If you choose to save or replace your default CV, the structured CV data and filename are stored on your profile for reuse.

—4. Data Retention

Your project data — extracted CV text, job description, and generated documents — is kept so you can review, reuse, and download your results while using the service. Your account may show a retention period for application results, and we use retention settings to guide how long project data should remain available.

Account data such as email, subscription status, and service records is kept while your account is active. When you delete your account or request deletion, we delete or de-identify associated service data where technically possible and keep limited records only where needed for security, billing, legal, or operational reasons.

You can request deletion of any or all of your data at any time — see Section 15.

—5. Third-Party AI Processing

To generate tailored CVs and analyses, your extracted text is sent to third-party AI providers via encrypted API connections. We currently use:

• →Groq, Inc. — fast LLM inference. See Groq Privacy Policy.
• →Anthropic, PBC — advanced language model processing. See Anthropic Privacy Policy.

We use these providers to process only the text needed for the requested task:

• →NoxPharm model training — we do not use your CV, job descriptions, or generated documents to train NoxPharm models.
• →Provider processing — AI providers process submitted text under their own API and data-processing terms.
• →Encrypted in transit — TLS 1.2 or higher on all API calls.
• →Minimal exposure — we send only the text needed for the task. Your email, payment info, and account details are never sent to AI providers.

We may switch AI providers to improve quality or reliability. Any new provider will be held to the same standards above, and this page will be updated.

—6. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data or CV content to advertisers, data brokers, or recruitment agencies.

Limited data is shared with service providers where needed to operate, secure, monitor, and improve the platform:

• →Groq / Anthropic — AI processing (see Section 5).
• →Stripe, Inc. — payment processing (see Section 1.3).
• →Supabase — authentication, database, and storage infrastructure.
• →Resend — transactional service emails such as verification, password reset, and subscription emails.
• →Cloudflare Turnstile — bot protection on signup and other protected forms where enabled.
• →Vercel — hosting, performance measurement, and web analytics.
• →PostHog, Google Analytics, Microsoft Clarity, and Sentry — product analytics, page views, session insights where enabled, and error monitoring.

We may disclose data if required by a court order or binding legal process. We'll inform you if we're legally able to do so.

—7. Data Security

We use appropriate technical and organisational measures to protect your data, including:

• →Encryption in transit (TLS 1.2+) and at rest.
• →Row-level security so you can only access your own data.
• →Hashed credentials and secure session management.
• →Regular review of access controls and security settings.

No system is completely immune to threats. If a breach affects your personal data, we'll notify you and the relevant authority — typically within 72 hours under GDPR.

—8. Your Rights Under GDPR

If you're in the EEA, UK, or a jurisdiction with equivalent data protection law, you have these rights:

• →Access — request a copy of all personal data we hold about you.
• →Rectification — request correction of inaccurate or incomplete data.
• →Erasure — request deletion of your personal data, including your CV text, generated documents, and account.
• →Restriction — ask us to limit how we process your data in certain situations.
• →Portability — receive your data in a structured, machine-readable format.
• →Objection — object to processing based on legitimate interests.
• →Withdraw consent — where processing is consent-based, you can withdraw at any time without affecting anything done before that point.

Email us at Section 15 to exercise any of these rights. We'll respond within 30 days. If you're unsatisfied, you can complain to your local data protection authority.

—9. Lawful Basis for Processing

We process your data under the following legal bases:

• →Contract (Article 6(1)(b)) — processing is necessary to deliver the CV tailoring service you signed up for.
• →Consent (Article 6(1)(a)) — you give consent when creating your account and uploading documents for processing.
• →Legitimate interests (Article 6(1)(f)) — maintaining service security, preventing fraud, and improving reliability — balanced against your rights.

—10. Cookies and Tracking

We use session cookies to keep you logged in and run the service. These are essential for authenticated product access.

We also use analytics, performance, and error-monitoring technologies, including PostHog, Vercel Analytics, Vercel Speed Insights, Google Analytics, Microsoft Clarity where enabled, and Sentry where enabled. These tools may use cookies, local storage, session storage, or similar browser identifiers to measure page views, product events, performance, session behavior, and errors. We do not use these tools to sell your CV data or share it with advertisers.

You can accept, reject, or change optional analytics preferences from the privacy choices control.

—11. International Data Transfers

Some of our service providers (AI providers, infrastructure) are based outside the EEA. Where transfers occur, we use provider contractual safeguards and review published data-processing terms where available.

—12. Children's Privacy

NoxPharm is built for working professionals and is not intended for anyone under 16. We don't knowingly collect data from children. If we discover we have, we'll delete it immediately.

—13. Chrome Extension

The NoxPharm Chrome extension reads publicly visible job listing content — title, company, location, and description — from pages you actively visit on supported job sites: LinkedIn, Indeed, Glassdoor, TotalJobs, BioSpace, Jobs.ie, and IrishJobs.

How it handles data:

• →Local only — job data is stored in your browser via chrome.storage.local. It's never sent to our servers unless you click "Tailor CV".
• →No background collection — the extension only reads content when you're on a supported job page. It doesn't monitor your browsing history or run in the background.
• →Saved jobs stay local — jobs you save are stored in your browser only, never synced to our servers.
• →Session check — when you visit a NoxPharm page, the extension makes a same-origin request to check if you're signed in. No data is sent; only your login status and plan tier are returned.
• →No cross-site access — the extension only reads from the declared job sites and noxpharm.com.
• →Minimal permissions — the extension requests only storage and tabs — the bare minimum needed.

Installing the extension means you agree to this Privacy Policy. You can uninstall at any time from your browser's extension manager, which removes all locally stored data.

—14. Changes to This Policy

We may update this policy when our practices, technology, or legal requirements change. If we make material changes, we'll email registered users at least 14 days before they take effect. The "Last updated" date at the top of this page always reflects the most recent version.

—15. Contact Us

Questions about this policy, data rights requests, or data protection concerns — reach us at:

This policy is governed by the laws of France. Disputes are subject to the jurisdiction of the courts of Paris, France. This does not limit your rights under mandatory data protection law in your country of residence.