Privacy

What we collect

Only what the service needs to work:

• Account details. Your email address, and a password managed by our authentication provider. Passwords are hashed by that provider and are never visible to us. If you sign in with Google instead, there is no password at all: Google confirms who you are and passes us your email address and the name on your Google account. We never see your Google password, and we get nothing else from your Google account.
• Your profile. Your name, career stage, preferred location, the practice areas you are interested in, and a LinkedIn address if you add one. All optional, and you can edit or clear any of them on your account page. Bear in mind that a LinkedIn address points at a page naming you, so it identifies you more directly than the rest.
• Account settings. Which alerts you want to receive, and whether you have put your alerts on a break and until when. Settings rather than preferences, because they change what we send you.
• Application tracker entries. The roles you choose to record, the stage you have reached with each, and anything you log about a rejection.
• Text you submit to the career tools. Your CV, draft cover letter inputs, and interview practice answers.
• What the tools write back. Saved against your account so you can reopen it: your CV reviews, your drafted cover letters, your interview question sets, and any CV you ask us to generate. A review quotes lines from your CV back to you so you can see the rewrite, and a generated CV contains your name, contact details and full history, so treat these as holding the same personal data your CV does.
• Cookies and browser storage. We use no advertising cookies, no analytics, and no third-party trackers. What we do store is: a sign-in cookie, set by Supabase, which is what keeps you signed in and is deleted when you sign out; and a small amount of storage in your own browser that never reaches us. esquirely:prefs holds your answers to the questions on the home page if you answer them without an account, and esquirely:notifications-seen, esquirely:notifications-read and esquirely:welcomed-at, which only record which notifications you have already looked at so the same ones stop being flagged as new. One more, esquirely.saved.v1, holds the roles and firms you have saved. Saved items live in your browser and are not copied to our database, which is the trade: they cost us nothing and tell us nothing, and they do not follow you to another device. Clearing your browser data removes all of these, and what you lose is the read markers and your saved list.
• Technical logs. Standard server and security logs kept by our hosting provider, including IP address and request time.

We do not ask for your date of birth, national identification number, bank details, or any special category data, and you should not send them to us.

Your CV file is not stored. What we write from it is.

This one deserves its own clause because it is easy to state too generously, and we would rather draw the line in the right place than in the flattering place.

The file you upload is never kept. It is read into memory, the text is extracted, that text is sent for analysis, and the buffer is dropped when the request ends. It is not written to our database, our servers, or any storage bucket. We keep the file name so your history is recognisable, and nothing else of the document itself.

The output is kept, and the output contains your CV. A review saves the scores, the feedback, and the rewritten bullets, and a rewritten bullet necessarily quotes your original line so you can compare the two. Your employers, dates, degree and matters are therefore in that record. If you generate an ATS-optimised CV, we save the finished document against your account so you can download it again, and that document holds your name, phone number, email address and full career history.

So the accurate summary is not that we do not have your CV. It is that we never keep the file you sent, and we do keep what the tools made from it, because a history you cannot reopen is not a history. All of it is tied to your account, none of it is shown to anyone else, and clause 7 tells you how to make us delete it.

Why we are allowed to hold it

Our lawful bases under the Act:

• Performance of a contract. Account details and tracker entries, because the service does not function without them.
• Consent. Profile preferences, anything you put into the career tools, and the reviews, letters and generated CVs we save back against your account. You give it deliberately, generating a CV is a separate step you have to choose, and you can withdraw at any time.
• Legitimate interests. Security logging and preventing abuse, balanced against your interests and limited to what that purpose needs.

Who else processes it

We use a small number of providers. They act on our instructions and may not use your data for their own purposes:

• Supabase for the database and authentication. Holds your account, profile and tracker entries.
• Anthropic for the AI behind CV review, CV generation, cover letter drafting and interview preparation. Receives the text you submit to those tools, and nothing else. It does not receive your account details or tracker, and it does not use what you send to train its models.
• Vercel for hosting and delivery. Handles technical logs.
• Brevo for the emails we send you, such as the welcome message. Receives your email address and your name so the message can be addressed and delivered, and nothing else. It does not receive your CV, your tool output or your tracker.
• Google, but only if you choose to sign in with Google. It then confirms your identity to us and tells us your email address and account name. If you sign up with an email and password instead, Google is not involved at any point.

We do not sell your data. We do not share it with employers or law firms. Applying for a role takes you to the employer’s own site, and anything you submit there is governed by their privacy notice, not this one.

Data leaving Nigeria

Anthropic, Vercel, Brevo and Google process data outside Nigeria. Where the destination has not been recognised as providing adequate protection, we rely on the providers’ contractual data protection terms, which oblige them to protect your data to a comparable standard. You can ask us for details of those arrangements.

How long we keep it

• Account, profile and tracker data: for as long as your account exists.
• Uploaded CV files: not retained at all, as set out in clause 2. Only the file name survives the request.
• Saved tool output, meaning reviews, cover letters, interview question sets and generated CVs: for as long as your account exists, or until you ask us to remove it. We do not expire them on a timer, because the point of saving them is that they are there when you come back.
• After you delete your account: your data is removed 30 days later, except anything we must keep by law. The 30 days are a grace period, not a queue, and they work in a way you should know about before you use the button. Signing in during those 30 days cancels the deletion and puts your account back as it was. That is there for the person who deletes an account in a bad moment and wants it back on Tuesday, but it cuts both ways: if you mean to leave, do not sign in again to check, because checking is what undoes it.
• Technical logs: kept for a short period for security and diagnostics.

Your rights

Under the Act you may ask us to:

• give you a copy of the data we hold about you
• correct it if it is wrong
• delete it
• restrict or stop a particular use
• hand it over in a portable format
• stop relying on consent you have withdrawn

You can delete everything without asking us. The button is on your account page, it takes your account and all of the data attached to it, and clause 6 explains the 30 day grace period and how to avoid cancelling your own deletion by accident. You never need our permission and you never need to give a reason.

Deleting one item rather than everything is still a request to us. If you want a single review or a single generated CV gone but want to keep your account, say which one and we will remove it. There is no button for that yet, which is slower than it should be, and it is on the list.

Write to us and we will respond within 30 days. Exercising these rights costs nothing. If you are not satisfied with our answer you can complain to the Nigeria Data Protection Commission, and you do not need our permission to do so.

Security, honestly stated

Access to the database is restricted, traffic is encrypted in transit, and passwords are hashed by our authentication provider. No system is perfectly secure, and we are not going to pretend otherwise. If a breach occurs that is likely to affect your rights, we will notify the Commission and you as the Act requires.

Children

Esquirely is intended for law students and qualified lawyers, and is not directed at children under 13. If you believe a child has given us personal data, tell us and we will delete it.

Changes

If we change what we collect or who processes it, we will update this page and move the date at the top. Material changes will be flagged to account holders.

Contact

For anything in this notice, including requests under clause 7, contact us at privacy@esquirely.com.