Where your data lives
Honest answers, including the parts that are not Australian.
- Compyle runs on Railway, a hosting provider. Our database and stored files are currently hosted in the United States. If that changes we will update this page.
- Your profile, applications, job ads, uploaded files and generated PDFs are stored per account and are visible only to you, plus the small number of staff who need access to run and support the Service.
- Your profile is your single source of truth: you edit it once and Compyle uses it for every application.
How it is protected
Practical protections, not a promise that nothing can ever go wrong.
- In transit: the Service is served over HTTPS.
- Passwords: stored only as bcrypt hashes. We cannot read them.
- Your own AI keys (optional): encrypted before they are stored, only decrypted to make a request for you, never written to logs, and removable in Settings.
- Payments: handled by Stripe. We never see or store your card number.
What goes to AI providers
This is the most important thing to understand about Compyle.
- To write your documents, our server sends your relevant profile details and the job ad text to an AI provider. That is how the product works, and it means this information leaves Compyle.
- By default requests go through OpenRouter to a model host. The main writing model is currently DeepSeek V4 Flash, and short analysis steps use OpenAI GPT-4o-mini. Providers may be in the United States and, depending on the model host, other countries including China.
- If you add your own key in Settings, your requests go to the provider you chose, under your account with them.
- We do not use your data to train AI models. What each provider does with data it receives depends on its own terms and the model used. Check their policies (linked in the Privacy Policy) and do not enter anything you are not comfortable sending to them.
- We keep the resulting drafts and PDFs (so you can download them) but not a separate copy of raw prompts or raw AI responses, and we do not intentionally put your content in our logs. We do keep token counts for quotas and costs.
What we can see
Only what is needed to run the Service.
- Account details (email, name), for sign-in and account management.
- Your profile, applications and generated documents, because they are stored in our database. A small number of authorised people can access them to give support, handle billing, investigate abuse or fix faults. We do not browse accounts out of curiosity.
- Usage counts, plan and quota, and basic technical data such as IP address in server and security logs.
- Student verification details (academic email and any ID you upload), used only to check eligibility.
Who else is involved
The service providers that may handle your data. The full table with countries is in the Privacy Policy.
- Railway: hosting (US)
- OpenRouter and the model providers behind it, such as DeepSeek and OpenAI: AI processing
- Stripe: payments
- Resend: service emails
- Google Fonts and jsDelivr: your browser loads fonts and two code libraries directly from them, so they see your IP address
- Your chosen provider, only if you add your own AI key
- We do not use advertising or analytics trackers, and we do not sell your data.
Your rights
Under the Australian Privacy Act, and the GDPR and UK GDPR if they apply to you.
- Access: ask for a copy of what we hold. You can export your profile as JSON from Settings.
- Correction: edit your profile any time, or ask us to fix anything else.
- Deletion: delete your account in Settings (see below).
- Complaints: email privacy@compyleapp.com, or contact the Office of the Australian Information Commissioner (OAIC), or your local regulator if you are in the EU or UK.
How to delete your data
Two ways. Cancel any paid subscription first.
- Go to Settings, find the Danger Zone, click Delete Account and confirm.
- Your account, profile, uploaded documents, generated resumes and cover letters, applications, support records, usage records and stored AI keys are removed from our live systems.
- Some things can remain for a limited time or by law: backups (we aim for no more than 30 days), hosting logs, payment records held by Stripe, and data already sent to AI providers.
- Prefer email? Write to privacy@compyleapp.com from your account address with the subject "Delete My Account".
If something goes wrong
We will tell you.
- If we have a data breach likely to cause serious harm, we will notify affected people and the OAIC as the Notifiable Data Breaches scheme requires (and EU or UK regulators where those laws apply).
- We will explain what happened, what was involved and what you can do.
Children
Compyle is for job seekers. It is not intended for anyone under 16, and we do not knowingly collect personal information from children.
📬 Questions?
Ask about your data, privacy or this page.
Email: privacy@compyleapp.com
Post: [Owner to add: business or postal address], Melbourne, Victoria, Australia