How iQtions handles personal data

Scope and controller

iQtions is independently hosted at iqtions.com and app.iqtions.com. It is not published or maintained through ChatGPT Sites. The public website explains the service; the separate customer application handles accounts, private career sources, orders, and delivery.

The legal operator identity, contact details, governing terms, and applicable transaction information are provided at checkout and in the customer application.

Data we collect

We process account and authentication details; CV files or pasted CV and LinkedIn profile text; customer corrections and optional preferences; generated packages; order, coupon, referral, and payment state; support and privacy requests; security and content-free operational logs; and consent records.

Hosting and security systems may process IP address, user agent, request path, timestamp, and abuse signals. Bank Transfer proof is private, scanned, access-controlled, and retained only for the approved dispute or accounting purpose. Never email a CV, proof, password, MFA code, bank detail, or private download link.

• Required data is used to create and secure the account, provide the requested package, verify payment, deliver files, answer support requests, prevent abuse, and meet legal duties.
• Optional marketing consent is separate from account creation and is off by default.
• Sensitive career content is never sent to advertising or audience platforms.

AI processing and limited operational access

After explicit source and AI consent and verified payment, bounded career content may be sent to OpenAI through the API for structured generation and text-to-speech. API data is not used for model training by default. The application sends Responses requests with store=false, but this does not mean zero retention: OpenAI abuse-monitoring logs may retain content for up to 30 days unless a different approved data-control agreement applies.

Packages are generated with AI and are not reviewed by iQtions staff. Generated material can be wrong. Customers must check every file before use. The service does not infer protected traits, invent qualifications, apply for jobs, or make employer hiring decisions.

Authorized operations access is limited to the minimum data needed for a customer-requested support case, payment proof handling, security, safety, or abuse investigation. It is not a package-content review service.

Processors, payments, and international transfers

Cloudflare supports delivery and security; Supabase provides authentication, database, and private Storage; OpenAI is the AI processor only when live generation is approved; and the configured SMTP provider delivers account and service messages. Brevo may receive an email only after a separate marketing request and double opt-in. Dodo Payments or Stripe may process hosted online payments only when separately enabled; Bank Transfer remains administrator reviewed.

Providers may process data outside the customer’s country under their contracts and applicable transfer safeguards. Rights and safeguards depend on the applicable law, operating entity, and customer location. Contact Privacy with questions about international processing.

Retention, deletion, and security

Active intake, uploaded sources, generated files, payment proof, support records, financial evidence, consent evidence, suppression records, and encrypted backups follow record-specific retention and deletion rules. Account controls explain available export and deletion actions; legally required financial, fraud, dispute, and suppression records may remain after ordinary content is deleted.

Private objects use ownership checks and short-lived signed links. Uploads are type, size, signature, parser, and malware checked. Security controls reduce risk but cannot promise absolute security. A suspected breach is contained, investigated, documented, and notified where applicable.

Your rights and choices

Depending on applicable law, you may request access, correction, export, deletion, restriction, objection, portability, or withdrawal of consent. The account provides export and deletion request controls, and the Your Privacy Choices page controls optional browser tracking.

Withdrawal does not make earlier lawful processing invalid and may not erase records that must be retained for accounting, disputes, fraud prevention, legal claims, or backup expiry. Contact privacy@iqtions.com with a minimal description; identity verification may be required.