Privacy Policy

Draft: lawyer review required. The owner must have a qualified lawyer review this text before launch. It is not a claim of legal compliance.

Last updated: 11 November 2026.

This policy explains how JobCraft handles information when you create an account, build a CV or cover letter, pay for a package or download your documents.

What we collect

We collect your account email and, where provided, display name; your career target and job description; and the contact details, education, work, other experience, skills and certifications you enter for your CV. Passwords are handled by the authentication service, not included in CV documents or analytics. Google sign-in supplies account information through the sign-in service.

We do not ask for a photo, age, marital status, religion or state of origin. Avoid putting unnecessary sensitive information into free-text answers or job descriptions.

How we use it

We use your information to save and edit your CV, generate wording, manage your account, verify purchases and provide downloads. We do not sell your data or share your CV with employers.

AI processing and service providers

When you request AI generation or regeneration, your CV text and background information, including contact details in your answers and any pasted job description, are sent through Lovable's AI service to an AI provider to generate the result. Premium cover letters also use your CV and job description. AI can make mistakes: review the output before using it.

Lovable Cloud provides account and data hosting. Bachs (bachs.io) processes payments. Authentication and optional purchase emails use email services when configured. Providers may process information outside Nigeria under their own terms and retention arrangements; deleting your JobCraft account does not by itself establish that every provider has deleted its records.

Payments

Payments are handled by Bachs (bachs.io). JobCraft stores order amounts, currency, payment status, payment references and dates, but not card numbers or card security codes.

To start checkout, we send Bachs your account email, the package price and currency, and an order reference with purchase identifiers. Payment details you enter on Bachs's hosted page are handled by Bachs and its payment partners under their own policies.

Browser storage and downloads

JobCraft uses local browser storage for guest drafts, sign-in sessions and a random guest analytics ID. Temporary session storage helps you return to the right page after sign-in and complete password recovery. Browser storage is separate from cookies. On a shared phone or computer, sign out and clear JobCraft's site data when finished.

After purchase verification, PDFs are generated in your browser from your document data. Downloaded or shared copies remain wherever you save or send them; deleting your account does not remove those copies.

The site loads its Inter typeface from Google Fonts. Your browser contacts Google to fetch the font, which exposes normal connection information such as your IP address and browser request details to Google. If you choose Google sign-in, Google processes the sign-in and supplies account information to our authentication service. We do not receive your Google password.

Storage and retention

Your saved CVs and answers are kept until you delete the document or your account. Guest drafts are saved in your browser; signed-in drafts are saved to your account. Signing out clears the app's account cache but may leave a guest draft in browser storage. You can clear browser site data on a shared device.

Minimal anonymised order records are retained for legal and financial purposes after account deletion. These records contain amounts, currency, status, payment reference and dates, not your email, user ID, CV ID or CV contents. The owner must finalise and legally review financial retention periods before launch.

Analytics and diagnostics

Journey analytics record allowlisted actions, dates and counts, linked to an account ID or a random anonymous browser ID. They do not include CV contents, contact details, passwords, keys or card details. Account IDs are linkable information, not anonymous data. Administrative access is restricted; administrators can view counts and payment or error metadata, not users' CV contents.

These first-party events cover landing visits, starting and generating a CV, preview and pricing views, checkout initiation, verified payments and completed downloads. They are stored in JobCraft's backend, hosted by Lovable Cloud. The random guest ID persists in your browser, so these events differ from the cookie-free visitor analytics described below.

Application error diagnostics use generic messages instead of CV text or credentials. Hosting, authentication, AI and payment providers may maintain their own operational records.

Published-site visitor analytics

On the published site, Lovable records pages visited, where visitors came from, their country, browser, operating system and device type, how long they stay, how fast pages load and errors. Editor preview visits are not counted. This analytics uses no cookies, stores nothing on the visitor's device, does not keep IP addresses and does not identify visitors or recognise returning visitors.

There is currently no consent banner. Page visits, time on page, page speed and errors are recorded for every visitor to the published site, without cookies and without identifying anyone. Detailed data is kept for 90 days and daily summaries for a year.

Lovable collects this data for us. Lovable's privacy policy explains how it handles it.

Your rights

You can edit your CV details in the app. To remove your account, open Dashboard → Settings → Delete my account and data and confirm the permanent deletion. This removes your private CVs, answers and download access while retaining the minimal order records described above.

Depending on applicable law, you may have rights to access or correct your information, request deletion, object to certain processing or complain to the relevant data protection authority, including the Nigeria Data Protection Commission. Use the Support page for contact information. A monitored privacy contact and the service operator's legal identity must be supplied by the owner before launch.

Policy changes

Updates will be posted on this page with a revised date. Review the policy when deciding what information to submit.

Nigerian data protection

Nigerian data protection law, including the Nigeria Data Protection Act 2023, may apply to this service. This draft is not a statement or certification of legal compliance. The owner must have a qualified lawyer review this policy, provider arrangements, international processing and retention practices before launch.