How iQtions handles personal data

Scope and controller

iQtions is independently hosted at iqtions.com and app.iqtions.com. It is not published or maintained through ChatGPT Sites. The public website explains the service; the separate customer application handles accounts, private career sources, orders, and delivery.

The legal operator identity, contact details, governing terms, and applicable transaction information are provided at checkout and in the customer application.

Data we collect

We process account and authentication details; order contact details (first and last name, phone number, and country of residence); CV files or pasted CV and LinkedIn profile text; customer corrections and optional preferences; generated packages; order, coupon, referral, and payment state; support and privacy requests; security and content-free operational logs; and consent records.

Order contact details are saved privately for the order and supplied to Paymob when you choose that payment method. These separately collected fields are excluded from AI generation inputs and cleared when the order is deleted or the draft is discarded. They are not a marketing subscription.

Hosting and security systems may process IP address, user agent, request path, timestamp, and abuse signals. Bank Transfer proof is private, scanned, access-controlled, and retained only for the approved dispute or accounting purpose. Never email a CV, proof, password, MFA code, bank detail, or private download link.

• Required data is used to create and secure the account, provide the requested package, verify payment, deliver files, answer support requests, prevent abuse, and meet legal duties.
• Optional marketing consent is separate from account creation and is off by default.
• Sensitive career content is never sent to advertising or audience platforms.

AI processing and limited operational access

After explicit source and AI consent and verified payment, bounded career content may be sent to OpenAI through the API for structured generation and text-to-speech. API data is not used for model training by default. The application sends Responses requests with store=false, but this does not mean zero retention: OpenAI abuse-monitoring logs may retain content for up to 30 days unless a different approved data-control agreement applies.

Packages are generated with AI and are not reviewed by iQtions staff. Generated material can be wrong. Customers must check every file before use. The service does not infer protected traits, invent qualifications, apply for jobs, or make employer hiring decisions.

Authorized operations access is limited to the minimum data needed for a customer-requested support case, payment proof handling, security, safety, or abuse investigation. It is not a package-content review service.

Processors, payments, and international transfers

Cloudflare supports delivery and security; Supabase provides authentication, database, and private Storage; OpenAI is the AI processor for approved package generation and text-to-speech; and the configured SMTP provider delivers account and service messages. Brevo may receive an email only after a separate marketing request and double opt-in.

The hosted payment provider enabled and shown at checkout handles its payment form and full card details under its own notice. iQtions receives the transaction identifiers, amount, currency, status, and limited customer data needed to reconcile and support the order; it does not need to receive or store full card numbers or security codes. Some eligible accounts may see a card method during a restricted production pilot. Paymob, Paddle, Lemon Squeezy, or Stripe receives payment data only if that provider is later enabled and explicitly shown for the transaction. Bank Transfer, when enabled, remains administrator reviewed.

Providers may process data outside the customer’s country under their contracts and applicable transfer safeguards. Rights and safeguards depend on the applicable law, operating entity, and customer location. Contact Privacy with questions about international processing.

Retention, deletion, and security

Active intake, uploaded sources, generated files, payment proof, support records, financial evidence, consent evidence, suppression records, and encrypted backups follow record-specific retention and deletion rules. Privacy support explains available export and account-deletion requests; legally required financial, fraud, dispute, and suppression records may remain after ordinary content is deleted.

Private objects use ownership checks and short-lived signed links. Uploads are type, size, signature, parser, and malware checked. Security controls reduce risk but cannot promise absolute security. A suspected breach is contained, investigated, documented, and notified where applicable.

Your rights and choices

Depending on applicable law, you may request access, correction, export, deletion, restriction, objection, portability, or withdrawal of consent. Contact privacy@iqtions.com from your account email for account export or deletion; the Your Privacy Choices page controls optional browser tracking.

Withdrawal does not make earlier lawful processing invalid and may not erase records that must be retained for accounting, disputes, fraud prevention, legal claims, or backup expiry. Identity and deletion intent must be verified before account deletion is processed.