Privacy Policy

Octany Labs ("we", "our", or "us") operates the website at lumicv.com, the web application at app.lumicv.com, and the LumiCV browser extension (collectively, the "Service"). LumiCV is a product of Octany Labs. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our Service. By using LumiCV, you agree to the practices described in this policy.

Data Controller

The data controller responsible for your personal data is:

Octany Labs, a company based in the Netherlands, operator of the LumiCV product.
Dutch Chamber of Commerce (KvK) number: 42069241.
Privacy contact: [email protected]
General contact: [email protected]

If you are located in the EEA or UK and would like to exercise your data protection rights, please contact us at the address above. Because the controller is established in the European Union (Netherlands), no separate Article 27 representative is required.

This Privacy Policy is provided in English. Translations may be provided for convenience; in case of conflict, the English version prevails.

1. Information We Collect

1.1 Information You Provide

When you create an account or use the Service, you may provide:

Account information - name, email address, and password.
Resume and career content - work experience, education, skills, contact details, and any other information you add to your resume or job tracker.
Payment information - billing details processed by our payment provider, Stripe. We do not store your full card number on our servers.
Communications - messages you send to our support team.
Job descriptions and job board data - when you use the LumiCV browser extension or paste job descriptions into the Service, we collect job titles, company names, locations, and job description text to power AI features such as resume tailoring and cover letter generation.

1.2 Information Collected Automatically

When you use the Service, we automatically collect:

Usage data - pages visited, features used, clicks, and session duration.
Device information - browser type, operating system, and IP address.
Cookies and similar technologies - see Section 6 for details.

1.3 Information Collected via the Browser Extension

The LumiCV browser extension is an optional tool that helps you extract job descriptions and autofill application forms on supported job boards. When you use the extension:

Job description data - job title, company name, location, posting date, and full job description text are extracted from the page you are viewing on LinkedIn, Indeed, Glassdoor, Greenhouse, Lever, Workday, and SmartRecruiters.
LinkedIn profile data - if you use the LinkedIn Profile Optimizer feature, the extension reads your public LinkedIn profile information (name, headline, experience, education, skills, certifications) to provide optimization suggestions. This data is sent to LumiCV for AI analysis.
Autofill data - your name, email, phone number, and location (from your LumiCV profile) may be used to autofill fields on job application forms. This data is retrieved from your LumiCV account, not scraped from the job board.
Authentication - the extension stores an authentication token in your browser's local storage to connect to your LumiCV account. No job board passwords or credentials are stored or transmitted to LumiCV.

The extension does not track your general browsing history, monitor pages outside of supported job boards, or collect data when you are not actively using it.

2. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve the Service.
Process AI-powered features - resume tailoring, cover letter generation, interview prep, and content enhancement - using the resume and job data you supply.
Manage your account and subscription, including billing through Stripe.
Send transactional emails (account verification, password reset, billing receipts) via our email provider, Resend.
Send product updates and marketing communications (you can opt out at any time).
Monitor for abuse, fraud, and security threats.
Comply with legal obligations.

We do not use your resume content to train AI models. Your career data is used solely to generate outputs on your behalf within the Service.

We do not sell your personal data. We share data only in the following limited circumstances:

Service Providers

We use trusted third-party providers to operate the Service. These providers process data on our behalf under strict data processing agreements:

Stripe - payment processing and subscription management. Stripe processes your billing information under their own privacy policy.
Microsoft (Azure OpenAI Service) - primary AI text generation (GPT models) for resume tailoring, cover letters, interview prep, and content features. Requests are processed in the EU (Sweden Central) under Microsoft's EU Data Boundary commitment and the Microsoft Online Services DPA. Microsoft does not use customer prompts or completions to train any model.
OpenAI (disaster-recovery fallback only) - if our Azure OpenAI capacity is unavailable, AI requests may temporarily fall back to OpenAI's direct API in the United States, governed by Standard Contractual Clauses (SCC Module 2) and OpenAI's Data Processing Addendum. OpenAI does not use API data to train models.
PostHog - product analytics (EU-hosted at eu.i.posthog.com). Collects anonymized usage data across both the marketing site (lumicv.com) and the application (app.lumicv.com), only with your consent. Session recordings are disabled on blog pages and mask all input fields elsewhere.
Sentry - error monitoring and performance tracking. Collects technical error data to help us fix bugs. Personal data is not sent to Sentry by default.
Microsoft Azure - cloud hosting infrastructure (EU region). All application data, databases, and file storage are hosted on Azure.
Resend - transactional email delivery (account verification, password reset, billing receipts, product notifications). Resend receives your email address and the content of the transactional message.
Google and LinkedIn - OAuth authentication providers if you choose to sign in with Google or LinkedIn. We receive only your name, email, and profile photo.

Legal Requirements

We may disclose your information if required by law, court order, or governmental authority, or if we believe disclosure is necessary to protect the rights, property, or safety of LumiCV, our users, or the public.

Business Transfers

If LumiCV is involved in a merger, acquisition, or asset sale, your data may be transferred as part of that transaction. We will notify you before your data is subject to a different privacy policy.

4. Data Retention

We retain your personal data for as long as your account is active. If you delete your account from the account settings (or email [email protected] to request deletion), we will permanently delete your personal data within 30 days, except where we are required by law to retain specific records for a longer period (see below). Deletion is a full erasure, not anonymization or soft-delete.

Inactive accounts (no login for 24 months) may be flagged for deletion; we will notify you by email at least 30 days before deletion.

Billing and tax records are retained for 7 years after the end of the calendar year in which the transaction occurred, as required by Dutch tax law (Art. 52 AWR). These records contain limited billing metadata, not your resume or job data.

Job descriptions extracted via the browser extension are stored as part of your job applications for as long as your account is active. LinkedIn profile data processed for optimization suggestions is not permanently stored - it is analyzed and discarded after generating results.

Browser extension data (authentication token, cached preferences) is stored locally in your browser and can be cleared by removing the extension or clearing browser data.

Failed resume uploads (parser debugging)

When a CV file you upload fails to parse, we ask whether we may keep the file to debug the issue. Lawful basis: your explicit consent (Art. 6(1)(a) GDPR). Purpose: to reproduce and fix the specific parsing error your file triggered — never for AI training, analytics, or any other purpose. Retention: automatically deleted within 24 hours of us fixing the underlying issue, or after 14 days, whichever is sooner. Withdrawal: you can delete the file immediately at any time from your account settings under "Stored failed uploads". If you decline: the file is deleted from our systems immediately. If you do not respond, the file is automatically deleted within 1 hour under our legitimate-interest hold (Art. 6(1)(f)) for the brief moment between upload and your decision.

5. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

Access - request a copy of the personal data we hold about you.
Correction - request that we correct inaccurate or incomplete data.
Deletion - request that we delete your data ("right to be forgotten").
Portability - request your data in a structured, machine-readable format.
Objection - object to processing based on legitimate interests or for marketing purposes.
Restriction - request that we restrict processing of your data in certain circumstances.
Human review of AI-generated content - request that a human at LumiCV reviews any AI-generated suggestion you believe is inaccurate, misleading, or treats you unfairly. See Section 6 for details.

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

If you are in the European Economic Area (EEA) and believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with your local data protection authority.

6. AI & Automated Decision-Making

LumiCV uses AI to generate suggestions - resume bullet points, tailored summaries, cover letter drafts, interview questions, ATS feedback. These suggestions are designed to help you, not to make decisions about you. We disclose how this works because the EU AI Act (Article 50) and GDPR (Article 22) require us to.

Plain-language version: our dedicated AI Transparency page covers the same material with a clearer feature-by-feature breakdown, including which features don't use AI, what data we never send to AI providers, and how to opt out.

What the AI does, and what it doesn't

The AI generates content for your review. Every AI-generated bullet, summary, cover letter, or score appears in your editor. You can accept, edit, or reject it before anything is shared with a recruiter.
The AI does not make hiring or eligibility decisions. LumiCV does not screen, score, or rank you against other candidates for any role. ATS scores shown in the app reflect how well your resume matches the keywords in a job description you provided - they are a signal for you, not a decision by us.
No solely-automated decisions with legal or significant effect. Because every output is reviewable and editable by you before it reaches anyone else, GDPR Article 22's "solely automated decision" trigger does not apply. If you ever feel an AI suggestion has produced a decision about you that affects you significantly, contact us at [email protected] and we will provide human review within 14 days.

How AI suggestions are produced

Inputs. Your resume content, job descriptions you paste, and the writing-tone preferences in your account.
AI provider. Microsoft Azure OpenAI Service (GPT models, deployed inside our Azure tenant in Sweden Central). We operate under the Microsoft Online Services DPA; Microsoft does not use customer prompts or completions to train any model. If Azure OpenAI is unavailable, requests may fall back to OpenAI's direct API in the United States under SCC Module 2 + OpenAI DPA.
Where processing happens. Azure OpenAI processes requests on EU-resident Microsoft infrastructure (Sweden Central) — no transfer outside the EU in normal operation. The DR fallback to OpenAI direct, when activated, processes on US infrastructure under SCCs; OpenAI's standard 30-day abuse-monitoring window applies to that path only.
Determinism. AI outputs are probabilistic. The same input may produce different suggestions on different days. We do not promise specific outcomes (e.g. "this resume will get an interview").

Transparency requirements (EU AI Act Article 50)

Every AI-generated suggestion in the app is labelled as such. You always know whether content was written by you, by AI, or by AI based on your input.
You are responsible for reviewing AI-generated content before submitting it to employers (see Section 5 of our Terms of Service). LumiCV does not warrant the accuracy or appropriateness of any specific AI output.

Opting out of AI features

You can use LumiCV without AI features. The Free plan provides resume building, templates, PDF download, and job-application tracking with no AI processing of your content. AI features (tailoring, cover letters, interview prep, ATS scoring) are opt-in by clicking the relevant button in the app; if you never click them, no resume content is sent to any AI provider.

7. Cookies

We use cookies and similar tracking technologies to operate and improve the Service. See our Cookie Policy for full details on the types of cookies we use and how to manage them.

8. Security

We implement industry-standard technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include encryption in transit (TLS/HTTPS), encrypted storage for sensitive data, and access controls.

However, no method of transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately at [email protected].

9. Children's Privacy

LumiCV is not directed at children under the age of 16 (see also Section 2 of our Terms of Service). We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a prominent notice in the Service at least 14 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

11. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data under the following lawful bases:

Contract performance - processing necessary to provide the Service you subscribed to (e.g. account management, billing, AI features).
Legitimate interests - processing for fraud prevention, security monitoring, and service improvement, where our interests do not override your rights.
Legal obligation - processing required to comply with applicable law (e.g. retaining billing records).
Consent - where we rely on your consent (e.g. marketing emails and non-essential analytics cookies), you may withdraw it at any time without affecting the lawfulness of prior processing.

12. International Data Transfers

LumiCV operates globally. Your data may be processed by our service providers in countries outside your own, including the United States. Where we transfer personal data from the EEA or UK to third countries, we ensure appropriate safeguards are in place, such as:

Standard Contractual Clauses (SCCs) approved by the European Commission.
Transfers to providers certified under applicable adequacy frameworks.

Specifically, the following transfers occur:

Microsoft (Azure OpenAI) - European Union (Sweden Central), under Microsoft's EU Data Boundary commitment and the Microsoft Online Services DPA. Primary AI processor; no transfer outside the EU in normal operation.
OpenAI - United States, under Standard Contractual Clauses (SCC Module 2) and OpenAI's Data Processing Addendum. Disaster-recovery fallback only; activated only when Azure OpenAI is unavailable.
Stripe - United States, under Standard Contractual Clauses.
PostHog - European Union (eu.i.posthog.com).
Microsoft Azure - European Union (primary hosting region).
Resend - United States, under Standard Contractual Clauses.

For more information about our transfer mechanisms, contact [email protected].

13. Contact Us

If you have questions or concerns about this Privacy Policy or your data, please contact us:

Privacy & data requests: [email protected]
Security concerns: [email protected]
Billing & subscriptions: [email protected]
General & support: [email protected]
Website: lumicv.com/contact