Privacy Policy

1. Who we are and what this policy covers

Compyle ("we", "us", "our") is an early-access service at compyleapp.com (the "Service") that turns your saved profile and a job ad into a tailored resume and cover letter. It is operated from Melbourne, Victoria, Australia by [Owner to add: legal entity name and ABN/ACN].

This policy explains what personal information we collect, why, who we share it with (including overseas), how long we keep it and what you can do about it. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We aim to follow them whether or not a particular exemption would apply to a business of our size. If you are in the EU, EEA or UK we also describe your rights under the GDPR and UK GDPR (section 11).

If something here does not match what you see in the product, tell us at privacy@compyleapp.com and we will fix it.

2. Information we collect

2.1 Information you give us

• Account: email address, name, and a password (stored only as a bcrypt hash).
• Professional profile: education, work experience, projects, skills, certifications, awards, volunteering, publications, phone number, location and profile links (such as LinkedIn or GitHub), as far as you choose to enter them.
• Work rights: visa or work-authorisation details, only if you enter them.
• Job ads and applications: job ad text or links you paste, the company and role, your notes and status, and the drafts and PDFs we generate for each application.
• Uploaded files: resumes, cover letters, transcripts or other documents you upload.
• Student verification: the academic email address you submit and, if you choose, a student ID or similar document.
• Your own AI provider keys (optional): if you choose to use your own key, it is stored encrypted (section 7).
• Messages to us: support tickets, bug reports and email correspondence.

2.2 Information collected automatically

• Usage and quota data: how many applications you have generated, and counts of AI tokens used per request (we record the numbers, not the text).
• Technical data: IP address, browser type and request details, recorded in server access logs and in security or audit logs (for example sign-ins).
• Billing status: your plan and subscription status and your Stripe customer ID. We do not see or store your card number; Stripe does.
• Referral information: if you arrive through a referral link, a short-lived cookie records the referral code so the referrer can be credited (see the Cookie Policy).

3. How we use your information

• To create and run your account and provide the Service, including generating tailored resumes and cover letters and analysing job ads.
• To process payments and manage plans, quotas and the student offers.
• To send service emails: verification, welcome, password reset, notifications you turn on, billing and support replies. We do not send third-party marketing.
• To keep the Service secure and to detect and prevent fraud, abuse and quota circumvention.
• To fix problems and improve the Service, using usage counts and the information in support tickets and bug reports.
• To meet legal obligations, such as tax record-keeping.

We do not sell your personal information and we do not use it for advertising.

4. AI processing: what is sent and to whom

Compyle works by sending text to AI language models. When you generate a document or analyse a job ad, our server sends the AI provider the information needed for that task. That includes the relevant parts of your profile (for example work history, education, skills and projects, and work-rights details where they matter for the job), the job ad text, and our instructions. The provider returns text, which we turn into your resume and cover letter.

What we store: we store the resulting drafts, PDFs and the job ad as part of your application so you can see and download them. We do not keep a separate copy of the raw prompts or raw model responses, and we do not intentionally write profile or job ad content to our logs. We do record token counts.

Which provider: by default the Service uses OpenRouter, a gateway that forwards each request to a model provider. At the time of writing the main writing model is DeepSeek V4 Flash, and some short analysis steps (reading the job ad, fact-checking) use OpenAI GPT-4o-mini through OpenRouter. We may change models or providers from time to time to improve quality or cost. If you add your own key in Settings, your requests go to the provider you choose (OpenAI, Anthropic, Google Gemini, Mistral, DeepSeek or OpenRouter) under your own account with them, and their terms and privacy policy apply to that relationship.

Training: we do not use your content to train AI models, and we do not give providers permission to do so on our behalf. What each provider does with data it receives is governed by that provider's own terms and settings, and can depend on the specific model and which company hosts it. Major providers such as OpenAI and Anthropic say that their API data is not used for training by default; OpenRouter passes requests on to the underlying model host, whose terms apply; and DeepSeek is a China-based company whose terms and retention practices differ. We encourage you to read the policies linked in section 5 and not to put information into your profile or job ads that you are not comfortable sending to these providers.

5. Service providers and overseas disclosure

We use the providers below to run the Service. Some of them are outside Australia, so your personal information is disclosed overseas when you use the Service. This section is our APP 8 disclosure.

Before we disclose personal information overseas we take reasonable steps to make sure the recipient handles it consistently with the APPs, mainly by choosing established providers and relying on their published terms. We cannot control how every provider behaves, and overseas privacy laws can be less protective than Australian law. By using the AI features you acknowledge this disclosure. If you do not want your profile or job ads processed by overseas AI providers, please do not use the generation features.

We do not use analytics services. Our software can send technical error reports (error type, the page of code that failed, and the time) to Sentry, a US-based error-monitoring service, when we switch that on. It is configured not to send request bodies, cookies, authorisation headers or the contents of your profile or job ads. We will list it in the table above if we turn it on. Other places where data may be shared are in section 6.

Other countries may be involved if a provider moves its infrastructure. We will keep this page current as our providers change.

6. Sharing

We do not sell, rent or trade your personal information. We share it only:

• with the providers in section 5, to the extent needed for them to do their job;
• with your consent, for example if you ask us to send something to someone;
• where the law requires it, such as a court order, or to protect our rights, users or the public (for example to investigate fraud or abuse);
• in the event of a sale or restructure of the business, to the new owner, who would have to honour this policy.

A small number of people who operate Compyle can access account data where needed to give support, handle billing, investigate abuse or fix faults. Your generated documents are visible only to your account unless you share them yourself.

7. Security

• In transit: the Service is served over HTTPS.
• Passwords: hashed with bcrypt; we cannot read them.
• Your own AI keys: encrypted before storage using Fernet (AES-128 with authentication) and only decrypted when making a request on your behalf. They are not written to logs and you can remove them at any time in Settings.
• Hosting: your data sits in a managed database on our hosting provider, protected by its infrastructure controls and by access limits on our side.

No online service is perfectly secure, and we cannot promise that data will never be accessed without authorisation. If we have a data breach that is likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme, and notify EU/UK regulators where the GDPR or UK GDPR requires it.

8. Retention and deletion

We keep your information while your account is open.

8.1 When you delete your account

You can delete your account yourself in Settings, in the Danger Zone (or by emailing privacy@compyleapp.com). Deleting your account removes from our live systems:

• your account and profile (education, experience, projects, skills and the rest of your profile);
• your uploaded documents and files;
• your generated resumes, cover letters and PDFs;
• your applications, including saved job ads, drafts and notes;
• your support tickets, bug reports, student verification requests (including any uploaded ID), usage records, audit logs, referral records and stored AI keys.

Deletion cannot be undone, so use Settings to export your profile first if you want a copy.

8.2 What may remain

• Backups: if our hosting provider keeps database backups, deleted data may persist in them until they expire. We do not alter individual backups. We do not control the exact backup schedule of our hosting provider, so we cannot promise a specific period.
• Logs: infrastructure and access logs (for example IP address, time and request path) are held by our hosting platform for a limited period, usually days to a few weeks, and are not intentionally searched by us for your content.
• Payments: Stripe keeps payment and invoice records as required by tax and financial regulations, under its own policy. We may also keep records we are legally required to keep.
• AI providers: data already sent to an AI provider is handled under that provider's retention policy and we cannot delete it for you. If you used your own key, you can manage this in your own account with them.
• Emails: copies of messages already sent to or by us remain in the relevant mailboxes until we delete them.

8.3 Paid subscriptions

Cancel any paid subscription in Settings (billing) before deleting your account. If you are charged after deleting your account, email billing@compyleapp.com and we will cancel the subscription and refund charges made after deletion.

9. Your rights under Australian law

• Access (APP 12): ask for a copy of the personal information we hold about you. You can export your profile as JSON from Settings, and we can provide more on request.
• Correction (APP 13): edit your profile in the app at any time, or ask us to correct anything else.
• Deletion: see section 8.
• Complaints: email privacy@compyleapp.com and we will respond within a reasonable time, normally 30 days. If you are not satisfied you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

To use any of these rights, email privacy@compyleapp.com from your account email address. We may need to confirm your identity first.

10. International students and graduates

Compyle is built for students and graduates in Australia, the UK, the US, Canada and elsewhere. You are welcome to use it from any country. By doing so you understand that your information is stored and processed in the United States and, through our AI providers, possibly in other countries (section 5), and that Australian law governs our handling of it.

11. If you are in the EU, EEA or UK (GDPR and UK GDPR)

• Who is responsible: we are the controller of the personal data described above. Contact: privacy@compyleapp.com. We have not appointed an EU or UK representative.
• Our legal bases: performing our contract with you (running your account and generating documents); our legitimate interests (security, fraud prevention, fixing and improving the Service); legal obligations (tax and accounting); and your consent where we ask for it.
• Your rights: access, correction, erasure, restriction, objection, and data portability, and the right to withdraw consent. To use them, email us. You can also complain to your local data protection authority, such as the UK Information Commissioner's Office.
• International transfers: your data is transferred to Australia (where we operate), the United States and other countries listed in section 5. Where a provider's standard terms include contractual safeguards for international transfers (such as standard contractual clauses), we rely on them.
• Automated decisions: Compyle uses AI to draft documents and to flag possible work-rights wording in job ads. It does not make decisions about you that have legal or similarly significant effects. The flags are informational only.

12. Children

The Service is not for anyone under 16. We do not knowingly collect personal information from children under 16. If you believe a child has given us information, email us and we will delete it.

13. Changes to this policy

We may update this policy as the Service or our providers change. We will change the date at the top and, for material changes, notify you by email or in the Service before they take effect.

14. Contact

• Privacy requests and questions: privacy@compyleapp.com
• General: support@compyleapp.com
• Post: [Owner to add: business or postal address], Melbourne, Victoria, Australia
• Regulator: Office of the Australian Information Commissioner, www.oaic.gov.au