Privacy Policy

OENOCV ("we", "us", "our") operates the Service accessible at oenocv.ai. This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use the Service, and sets out your rights as a data subject.

This policy applies to all users of the Service regardless of location. Where specific provisions apply to users in particular jurisdictions — including Nigeria, the European Union, and the United Kingdom — those provisions are identified clearly.

This Privacy Policy forms part of our Terms and Conditions. By using the Service, you confirm that you have read and understood this policy. If you do not agree, please do not use the Service.

1. Data Controller

OENOCV is the data controller responsible for your personal data processed in connection with the Service. For all privacy-related queries, requests, or complaints, contact us at:

support@oenocv.ai

2. What Personal Data We Collect

We collect the following categories of personal data:

Account and Identity Data

• Name and display name provided by your sign-in provider
• Email address
• Profile picture URL
• A unique identifier issued by your sign-in provider (never your password)

Resume and Career Content

• The resume or CV file you upload, including its full text content
• Career documents generated on your behalf (CVs, cover letters)
• Career analysis data derived from your resume (matched skills, identified gaps, narrative summaries)

Usage and Activity Data

• Actions you take within the Service (e.g., document generation events, job match requests)
• Subscription plan and billing status
• Service access timestamps

Technical Data

• An authentication session cookie used to keep you signed in securely
• Server-side request logs (IP address, user agent, request path) retained for security and operational purposes

We do not collect payment card details directly. Payment data is handled entirely by our authorized payment processor, subject to their own privacy policy.

3. How We Use Your Personal Data

We use your personal data for the following purposes, each supported by an identified lawful basis:

We do not use your resume content or generated documents for training AI models, nor do we sell, rent, or license your personal data to third parties for their own marketing purposes.

4. AI Processing and Your Resume Data

To provide resume analysis and document generation, your resume text is transmitted to AI model inference services operated by third-party providers. This transmission is governed by data processing agreements that prohibit those providers from using your data for their own model training or commercial purposes.

AI processing involves your resume content being analysed to extract skills, match against job listings, and generate career documents. This is automated processing; however, no solely automated decision with legal or similarly significant effect is made about you solely on the basis of this processing. All outputs are provided to you for review before any use.

If you are an EU or UK resident and wish to object to any automated processing or request human review of any AI-generated assessment affecting you, please contact us at support@oenocv.ai.

5. Data Sharing and Disclosure

We do not sell your personal data. We share data only as follows:

• Service providers acting as data processors: We engage third-party providers to operate the Service, including cloud storage, AI model inference, and payment processing. These providers process your data only on our documented instructions and under binding data processing agreements.
• Sign-in providers: When you sign in using a third-party sign-in provider, that provider shares your profile data with us under their own terms. We receive only what you have authorised that provider to share.
• Legal obligations: We may disclose personal data to law enforcement, regulators, or courts where required by applicable law or to protect the rights, property, or safety of OENOCV or others.
• Business transfers: If OENOCV is involved in a merger, acquisition, or sale of assets, your personal data may be transferred to the successor entity subject to equivalent privacy protections.

In all cases, we limit data sharing to what is necessary and proportionate for the stated purpose.

6. International Data Transfers

OENOCV operates globally and your personal data may be transferred to and processed in countries outside your country of residence, including countries that may not provide the same level of data protection as your home jurisdiction.

Where we transfer personal data from the European Economic Area or the United Kingdom to third countries, we ensure appropriate safeguards are in place — including Standard Contractual Clauses (SCCs) approved by the European Commission or UK Information Commissioner's Office, or reliance on adequacy decisions where applicable.

Where we transfer personal data of Nigerian residents internationally, such transfers are conducted in accordance with the Nigeria Data Protection Act 2023 and applicable regulations issued by the Nigeria Data Protection Commission (NDPC), including the execution of appropriate data transfer agreements where required.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements.

• Account data: Retained for the duration of your account. Deleted within 30 days of account closure, subject to legal retention obligations.
• Resume and generated documents: Retained while your account is active. Deleted on account closure or upon your request.
• Billing records: Retained for up to 7 years as required by applicable financial and tax law.
• Security and access logs: Retained for up to 90 days for security monitoring and incident response purposes.

You may request deletion of your personal data at any time as described in Section 9. Where we are required to retain data by law, we will inform you of the applicable retention period.

8. Cookies and Session Data

OENOCV uses a single authentication session cookie to keep you signed in. This cookie is:

• Secure: protected against unauthorised access by browser scripts
• Encrypted and signed: the contents are cryptographically protected
• Session-scoped: expires after 30 days or upon sign-out, whichever is earlier

We do not use third-party advertising cookies, tracking pixels, or cross-site behavioural analytics tools. We do not engage in cross-context behavioural advertising.

Some data is stored locally in your browser (such as your active resume identifier) to improve the user experience. This data does not leave your device except as part of normal API requests to the Service.

9. Your Rights

Depending on your jurisdiction, you have the following rights in relation to your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete personal data.
• Erasure: Request deletion of your personal data where there is no lawful basis for continued processing.
• Portability: Receive your personal data in a structured, machine-readable format.
• Restriction: Request that we restrict processing of your personal data in certain circumstances.
• Objection: Object to processing based on legitimate interests or for direct marketing purposes.
• Automated decision-making: Request human review of any decision made solely by automated means that significantly affects you.
• Withdrawal of consent: Where processing is based on your consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at support@oenocv.ai. We will respond within 30 days. We may need to verify your identity before processing your request.

Nigerian residents may also lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

EU residents may lodge a complaint with the supervisory authority in their EU member state of habitual residence.

UK residents may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

10. Children's Privacy

The Service is not directed at children under the age of 13 and we do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has provided personal data to us, please contact us at support@oenocv.ai and we will delete it promptly.

11. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include:

• Secure, server-protected authentication cookies
• Encrypted data transmission for all client-server communication
• Access controls limiting data access to authorised personnel only
• Security logging for detection of unauthorized access attempts

No method of transmission over the internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee absolute security. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users and relevant supervisory authorities as required by applicable law.

12. California Residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: The categories of personal information collected, the purposes for collection, and whether it is sold or disclosed.
• Right to Delete: Request deletion of personal information we have collected, subject to certain exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioural advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To submit a CCPA request, contact us at support@oenocv.ai with the subject line "CCPA Request". We will respond within 45 days.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. For material changes, we will provide at least 30 days' prior notice by posting the updated policy on this page and, where reasonably practicable, by sending an email notification to your registered address.

Your continued use of the Service after the effective date of any changes constitutes your acknowledgement of the revised policy. We encourage you to review this page periodically.