Privacy Policy

TwinkleHaha ("we", "us", "our") is committed to protecting your privacy. This policy explains what information we collect, how we use it, and your rights.

1. Information We Collect

Account Information

When you create an account, we collect:

Your name
Your email address
A hashed password (we never store your actual password)
If you sign in with Google: your Google profile name, email, and profile picture

CV Data (Paid Feature)

When you use our CV optimizer, we:

Extract the text content of your uploaded PDF
Store this text in our database linked to your account
Send it to OpenAI to generate your optimized CV
Use it to recommend relevant jobs to you (if you opt in)

We do not store the original PDF file — only the extracted text. We do not sell your CV data to any third party.

Payment Information

Payments are processed by Paddle. We never see or store your credit card number. Paddle shares with us only: your email, the amount paid, and the product purchased.

Usage Data

We collect analytics via Google Analytics: pages visited, time on site, approximate location (country/city), browser type, and referring URL. This data is aggregated and does not personally identify you.

If you subscribe to our newsletter, we store your email. You can unsubscribe at any time via the link in any email.

2. How We Use Your Information

To provide the Service (job listings, AI features, research reports)
To process payments and manage credits
To recommend relevant jobs to you (only if you have uploaded a CV)
To send you our newsletter (only if you subscribed)
To improve our Service (analytics, error logs)
To comply with legal obligations

3. Third-Party Services

We share your data with the following third parties, strictly as needed:

OpenAI — receives your CV text and job description to generate AI output. OpenAI's terms prohibit using this data to train their models.
Paddle — processes payments. Paddle is a Merchant of Record and handles their own privacy compliance.
Neon — hosts our database where your account and CV text are stored.
Vercel — hosts our website.
Resend — sends transactional and newsletter emails.
Google Analytics — provides aggregated site usage statistics.

4. Cookies

We use:

Session cookies (NextAuth) — to keep you logged in. Essential.
Google Analytics cookies — to track site usage. You can opt out via browser extensions like uBlock or Google's opt-out tool.

5. Data Retention

We keep your account data and CV text for as long as your account is active. If you delete your account, we will delete all your personal data within 30 days, except where we are legally required to retain it (e.g., tax records for purchases).

6. Your Rights

You have the right to:

Access your data (email nucleus.data.719@gmail.com and we'll send it to you)
Correct inaccurate data (you can edit your name and email in your dashboard)
Delete your account and all associated data (email us)
Export your data (email us)
Opt out of marketing emails (via unsubscribe link or email us)
Lodge a complaint with a data protection authority

7. Security

We protect your data using industry-standard practices: HTTPS encryption, hashed passwords (bcrypt), secure database access, and API key rotation. We do not store credit card data.

8. International Data Transfers

Our service operates globally. Your data may be transferred to and processed in countries outside your own (including the United States and the European Union). We only use providers that offer appropriate data protection safeguards.

9. Children's Privacy

Our Service is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has provided us with data, contact us and we will delete it.

10. Changes to This Policy

We may update this policy. The "Last updated" date at the top reflects the most recent change. If we make material changes, we will notify registered users via email.

11. Contact

Questions? Email nucleus.data.719@gmail.com.