Privacy Policy for Curriculo Inc.

1. Introduction and Scope of Application

Welcome to Curriculo.me (operated by CURRICULO INC., “Company,” “we,” “our,” or “us”). We are committed to protecting your privacy and ensuring the sovereign security of your personal data. This Privacy Policy comprehensively outlines our practices regarding the collection, algorithmic processing, storage, and protection of your personally identifiable information (“Personal Information”) when you access or utilize our AI Resume Builder, website, and associated digital services (collectively, the “Services”).

This policy has been explicitly structured to comply with the most stringent global data protection frameworks, including the European Union General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) as amended by the CPRA, and the Bangladesh Personal Data Protection Ordinance, 2025 (PDPO).

2. Notice of Collection: Categories of Personal Information Processed

To provide our dynamic resume adaptation and document formatting services, we strictly adhere to the principle of data minimization, collecting only the information inherently necessary to deliver the requested PDF document.

A Note on Sensitive Personal Data: Curriculo.me does not solicit or require the submission of sensitive personal data (such as health records, political beliefs, or religious affiliations). If such data is inadvertently provided within your free-text resume, it is processed entirely based on your explicit consent, utilized solely for typographic insertion into your final document, and is never used by our platform for algorithmic profiling or discriminatory categorization.

3. Artificial Intelligence and Algorithmic Processing

Curriculo.me utilizes a proprietary “AI Agent” to assist users in tailoring their experience to match the keywords and structural requirements of specific job descriptions. We assert the following regarding our AI processing:

• No Automated Decision-Making: Our AI Agent operates purely as an advanced formatting and semantic suggestion tool. We do not evaluate your candidacy or make any automated decisions that produce legal or employment effects. You maintain absolute manual control over the final content exported in your PDF.
• No External Model Training: The personal professional data you input into Curriculo.me is processed ephemerally. We unequivocally do not sell, license, or transfer your personal data to external third parties to train generalized, public large language models (LLMs) or artificial intelligence systems.

4. Data Retention, Security, and Localization Strategy

We retain your Personal Information only for the duration that your account remains active.

• Automated Deletion: If your account experiences a continuous period of inactivity exceeding twelve (12) months, our systems will permanently erase your Personal Information from our active databases and backup cycles.
• Security Safeguards: We deploy industry-standard cryptographic protocols, including Transport Layer Security (TLS) for data in transit and AES-256 encryption for data at rest.
• Localization and Cross-Border Transfers: For users residing in jurisdictions with strict data localization mandates (such as the confidential data parameters established by the Bangladesh PDPO), we apply strict geographic routing controls or rely on legally validated transfer mechanisms to ensure your data receives continuous, uncompromised protection regardless of physical server location.

5. Your Comprehensive Global Privacy Rights

Regardless of your physical location, Curriculo.me extends the following comprehensive rights to all users:

• Right to Access, Portability, and Rectification: You possess the right to request a structured, machine-readable electronic copy of your data, and you may instantly correct or amend any inaccurate employment data directly within your dashboard.
• Right to Erasure (The Right to be Forgotten): You possess the absolute right to request the permanent deletion of your data. Upon initiating an account deletion request, Curriculo.me will immediately cease all processing and execute the cryptographic shredding of your records.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time with the same ease as it was provided.

Specific Provisions for California Residents (CCPA/CPRA): Curriculo.me honors the “Honest, Free” ethos. We do not sell or share your personal information with data brokers or marketing agencies.

6. Protection of Minors and Students

While Curriculo.me offers fast, simple templates suitable for students seeking their first internships, our Services are not directed toward individuals under the age of 16 (or the applicable age of digital consent in your specific jurisdiction). We strictly prohibit the behavioral tracking, targeted advertising, or algorithmic manipulation of minors.

8. Curriculo ATS: Employer and Candidate Data Processing

In addition to the Curriculo Resume Builder, CURRICULO INC. operates Curriculo ATS, an AI-powered Applicant Tracking System for employers and recruiters. The following provisions apply specifically to data processed through Curriculo ATS.

8.1 Employer Account Data

When an employer creates a Curriculo ATS account, we collect company name, contact information, billing details, team member identities, and organizational data necessary to operate the hiring platform. This data is processed under a data processing agreement and retained for the duration of the employer’s active subscription.

8.2 Candidate Data Submitted Through ATS

Employers using Curriculo ATS may upload or receive candidate applications containing resumes, cover letters, contact information, employment history, and other professional data. The employer acts as the data controller for candidate data submitted through their ATS account. CURRICULO INC. processes this data as a data processor on behalf of the employer, in accordance with the employer’s data retention settings and applicable employment laws.

8.3 Hiring Decision Data and AI Screening Results

Curriculo ATS generates AI-powered screening results including signal-based candidate rankings, impact scores, and skill gap analyses. These outputs are tools to assist human decision-makers and do not constitute automated hiring decisions. All final hiring decisions remain with the employer. AI screening results are stored as part of the employer’s hiring records and are subject to the employer’s retention policies.

9. Data Sharing Between Curriculo Products

When a Curriculo Resume Builder user applies to a job posted on Curriculo ATS, the resume and application data submitted by the job seeker is shared with the employer who posted the position. This data sharing occurs only when the candidate actively submits an application. Curriculo Resume Builder user data is never passively shared with or made accessible to employers without the candidate’s explicit action of applying.

10. Google User Data and Limited Use

When you connect a Google account to Curriculo ATS, we access, use, and store certain Google user data solely to provide the features you enable. Specifically, with your authorization:

• Reading email (gmail.readonly): We read inbound application emails and their attachments (such as résumés) from the connected mailbox in order to create and organize candidate profiles, parse résumé content, and display your application inbox within Curriculo. We do not read, scan, or process messages for any other purpose.
• Sending email (gmail.send): We send interview invitations, status updates, and replies to candidates on your behalf, from your connected address, only when you initiate or approve the action.
• Calendar events (calendar.events): We create, update, and cancel interview calendar events for candidates and interviewers, and read free/busy availability to suggest meeting times. We do not access or manage entire calendars.
• Account email (userinfo.email, openid): We read the email address of the connected account to associate the connection with your workspace.

How we store and protect this data. OAuth tokens and any stored Google user data are encrypted at rest and are accessible only to deliver the features described above.

Limited Use. Curriculo’s use and transfer of information received from Google APIs to any other application will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. In particular:

• We do not use Google user data for serving advertisements.
• We do not sell Google user data or transfer it to third parties except as necessary to provide or improve the user-facing features, comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to users.
• We do not allow humans to read Google user data unless we have your affirmative consent, it is necessary for security purposes or to comply with applicable law, or the data is aggregated and anonymized.

You can disconnect your Google account at any time from within Curriculo, which revokes our access. You may also review and revoke access at https://myaccount.google.com/permissions.

11. AI Processing Disclosure

CURRICULO INC. uses artificial intelligence across both products in the following ways:

• Resume Analysis: AI analyzes resume content for keyword relevance, impact quantification, and structural optimization (Resume Builder).
• Candidate Scoring: AI evaluates candidate applications using signal-based ranking that measures demonstrated impact, relevant experience, and career trajectory (Curriculo ATS).
• Skill Gap Analysis: AI identifies gaps between candidate qualifications and job requirements to generate constructive feedback (Curriculo ATS Constructive Closure feature).
• Automated Feedback Generation: AI generates personalized rejection feedback with actionable improvement suggestions, replacing generic rejection emails (Curriculo ATS Constructive Closure feature).

All AI processing is designed to augment human judgment, not replace it. Employers retain full control over all hiring decisions.

12. Data Retention for Curriculo ATS

Employer account data is retained for the duration of the employer’s active subscription and for up to 90 days following account closure to allow for data export. Candidate data submitted through Curriculo ATS is retained according to the employer’s configured retention settings, which comply with applicable employment data retention laws. Employers may configure automatic deletion of candidate data after a specified period. Upon termination of an employer’s subscription, all candidate data is permanently deleted within 90 days unless legally required to be retained.

13. Exercising Your Rights and Contact Information

To submit a Data Subject Access Request (DSAR), initiate data erasure, or if you have any inquiries regarding our algorithmic processing frameworks, please contact us at:

CURRICULO INC. Address: 863 Hart St APT 1R, Brooklyn, NY 11237-7211, United States 

We legally commit to acknowledging and fulfilling all verified data rights requests within thirty (30) days of receipt, free of charge.