Draft — this text has not been reviewed by a lawyer yet and may change before launch.
Careely Privacy Policy
About the AI in Careely
Careely's replies are written by an AI model. It suggests; you decide. It can be wrong, and it is not a mental-health professional. What you share is used as your privacy settings allow.
Careely is a career-guidance companion. You chat with an AI, set goals, get skill roadmaps, take assessments and, if you want, meet a coach. This policy explains what data we collect, why, who we share it with, how long we keep it and what your rights are.
It follows Vietnam's Personal Data Protection Law No. 91/2025/QH15 and Decree 356/2025/ND-CP. Section 15 covers Singapore and the US briefly.
1. Who we are
| Item | Details |
|---|---|
| Data controller | [LEGAL ENTITY NAME] |
| Address | [ADDRESS] |
| Data Protection Officer (DPO) | [DPO NAME] · [DPO EMAIL] |
| General contact | [SUPPORT EMAIL] |
| Representative in Vietnam (if required) | [CONFIRM: is a VN representative required] |
2. What we collect
| Category | Examples | Required? |
|---|---|---|
| Account | username, email, password (stored only as an argon2id hash), language, age band (16–17 / 18+), your device's time zone (to hold 16–17 push notifications outside 22:00–07:00), role (learner / coach / admin) | Yes, to use the app |
| Sign-in session | refresh token, sign-in time. On the web: an httpOnly cookie (7 days). On phones: the device's secure keystore | Yes |
| Profile and CV | CV file, details read from it (experience, skills, education), profile fields you fill in | No. A CV is optional |
| Assessments | Big Five, Leadership, Communication results | No |
| Chat content | messages you send to the AI and its replies, your chat threads | No, but chat needs it |
| Insights ("What Careely understands about you") | things the AI suggests it learned from chat. Used only after you confirm them | No |
| Wellbeing signals | content-free safety events (see Section 5) | Automatic when you chat |
| Goals and roadmap | goals (role, skill set, relocation…), roadmaps, milestones, progress | No |
| Achievements | [UPCOMING FEATURE] achievements the AI picks out from chat. You can undo, edit by hand and add notes | No |
| Device and diagnostics | Once a day: platform, device model name (e.g. "Pixel 8"), OS major version, app version and screen-size class — on the web the browser family and OS instead. Never a serial number, IMEI or advertising ID. Crash reports (the kind of error, a cleaned error message and the top lines of the stack trace — emails, numbers, quoted values, tokens and IDs removed; never chat text or what you typed) are minimal operational data: we need them to keep the app working, so they are sent even if you turn product analytics off. Performance numbers (start-up time, time to the first word of a chat reply, screen loading time, whether a request failed or timed out) are product analytics: not collected while product analytics is off. All stored on our own servers. Also: days you were active, AI tokens used, reduced usage events | Automatic |
| Payments | through payment processors (Stripe in the US/SG). We do not store card numbers. We keep transaction IDs, amounts, status, refunds and disputes | Only if you book a paid coach session |
| Feedback | what you type in "Feedback". Sent by email to the Careely team | No |
| Coach data | coach profile, domains, price, schedule, reviews, reports, blocks, the code-of-conduct version you accepted | Only if you turn on the coach role |
| Coach–learner messages | [UPCOMING FEATURE] private messages between you and a coach | No |
We do not collect biometric data. Fingerprint or face unlock runs only on your device. That data never leaves it.
3. Purposes and legal basis
| Data | What we use it for | Basis |
|---|---|---|
| Account, session | create the account, sign in, security, verification and password-reset emails | Contract (Terms of Service) |
| CV, profile | read the CV, suggest roles, build roadmaps | Your consent when you upload [CONFIRM: is a separate CV consent box needed] |
| Assessments | show your results, personalise roadmaps | Consent (personalisation). Answering and scoring run on your device [CONFIRM: whether results are always sent to the server] |
| Chat content | reply to you; suggest goals (you decide whether to accept) | Contract + consent |
| Insights | personalise replies, only once you confirmed them | Personalisation consent |
| Wellbeing signals | show the safety card with hotlines; count events (no content) to improve safety | Protecting your life and health [CONFIRM: correct basis under Law 91] |
| Goals, roadmap, achievements | build and track your plan | Contract |
| Device, diagnostics | fix bugs, keep the app stable, apply AI limits, prevent abuse | Legitimate interest / contract [CONFIRM: whether VN needs separate consent] |
| Payments | take payment for coach sessions, refunds, disputes, tax and accounting duties | Contract + legal obligation |
| Feedback | reply to you, improve the product | Consent (you choose to send it) |
| Coach data | let learners find coaches, book, review, keep people safe | Contract |
| Aggregate research | anonymous statistics (Section 11) | Research consent (OFF by default) |
We do not sell personal data. We show no ads. We do not use your data to track you across other apps or websites.
4. Two separate consents
Under Profile → Privacy there are two separate switches. Each one works on its own.
| Switch | Default | When on | When off |
|---|---|---|---|
| Personalisation | OFF until you choose | The AI may suggest insights from chat for you to confirm. Confirmed insights make replies fit you better | No new insights are suggested. Chat still works |
| Research | OFF | Your data may be included in anonymous aggregate statistics | Not included |
Neither switch is on in advance. In your first chat Careely asks: "Let Careely remember what you share, to personalize your guidance?" with Allow and Not now. Only "Allow" turns personalisation on. "Not now" records nothing, and personalisation stays off. People who chose earlier keep their choice.
- Every change is recorded (time, choice) as proof. These records are append-only.
- You can withdraw consent at any time in the app.
- Withdrawal is not retroactive. What was done before stays lawful, but we stop using your data for that purpose from that moment. Research only uses data from after you turned it on, never older data.
5. Sensitive data
Some data may count as sensitive under VN law: what you share about feelings, mental health or private life; insights; Big Five results; payment data. We treat all of it as sensitive:
- A safety check runs before every chat turn. Before the AI replies, a check looks for signs of crisis (for example, intent to self-harm). If it finds one, or if the check fails, the app shows a fixed safety card with hotlines. There is no switch that turns this check off.
- Safety events hold no content. We record only that a safety event happened, its type and time. Your words are not stored in that record. Kept up to 365 days, then deleted automatically.
- A message flagged as a crisis is not sent back to the AI in later turns, never becomes an insight and never goes into research statistics.
- Admins and coaches do not read your chats unless you share an item yourself.
- We send as little personal data as possible to the AI provider. What you send is treated as data, never as instructions to the system.
- Encryption in transit (HTTPS/TLS).
[CONFIRM: encryption at rest at each provider]
6. AI in Careely
- You are chatting with an AI, not a person. Chat replies, goal suggestions, insights and roadmaps are AI-generated (Vietnam AI Law No. 134/2025/QH15).
- The AI can be wrong. Check important information.
- The AI suggests; you decide. It never creates a goal, confirms an insight or changes your role on its own.
- Careely makes no automated decisions with legal or similarly significant effects on you (for example hiring or credit).
- Careely does not diagnose, does not provide therapy and does not replace a doctor or professional.
- We ask our AI provider not to use your data to train models
[CONFIRM: provider zero-retention / no-training settings].
7. Processors and cross-border transfer
We use the providers below. Most run servers outside Vietnam, so your data is transferred abroad.
| Provider | What they do | Region |
|---|---|---|
| Google (Gemini API) | AI model for chat, CV reading, roadmaps | [CONFIRM: US / global] |
| Render | runs the application servers | Singapore |
| Neon (PostgreSQL) | main database | [CONFIRM: region] |
| Upstash (Redis) | cache, queues, rate limits | [CONFIRM: region] |
| Cloudflare R2 | CV file storage | [CONFIRM: region / jurisdiction] |
| Resend | email (verification, password reset, feedback, notices) | [CONFIRM: US] |
| Stripe | payments for coach sessions in the US/SG | US / Singapore |
[VN PAYMENT GATEWAY] | VN coaches pay Careely's referral fee | Vietnam |
| Expo (push notifications) | sends notifications to phones | [CONFIRM: US] |
The app also fetches public job-market data (Adzuna, BLS, USAJOBS, MyCareersFuture, O*NET). We send only a role name and market, never your personal data.
- We sign a data processing agreement with each provider
[CONFIRM: DPAs signed]. - We prepare a data-processing impact assessment and a cross-border transfer impact assessment and file them with the Ministry of Public Security (A05) under Decree 356
[CONFIRM: deadline, filed].
8. How long we keep data
| Data | Retention |
|---|---|
| Account, profile, CV, assessments, chats, insights, goals, roadmaps | Until you delete them. When you delete your account: erased within 30 days |
| Chat threads | Until you delete them (one by one, or "Delete all conversations") |
| Rejected or deleted insights | Only a "rejected" marker so we do not suggest it again; no content [CONFIRM] |
| Safety events (no content) | 365 days |
| Active days (counting active users) | 400 days |
| Hourly AI token/cost statistics | 400 days |
| Admin action log | 730 days (the link to you is removed when your account is erased) |
| Consent history | [CONFIRM: how long kept as proof after account deletion] |
| Payment transactions | As accounting and tax law requires [CONFIRM: 10 years?] |
| Device per active day | 400 days (with the active days) |
| Crash reports, performance numbers | 90 days [CONFIRM] |
9. Your rights
| Right | How in the app |
|---|---|
| Access | See it in the app, or download everything: Profile → Your data → Download [CONFIRM: exact screen path] |
| Portability | Same as above. The file is JSON |
| Correction | Edit your profile, goals and insights directly. Insights can be confirmed, edited or rejected |
| Deletion | Delete one chat, all chats, or Delete account (can be cancelled while pending; erased within 30 days, including your CV file) |
| Withdraw consent | Turn off Personalisation or Research |
| Object, restrict | Email [DPO EMAIL] |
| Complain | Email [DPO EMAIL]. You may also complain to the Ministry of Public Security (A05) |
Our response times (Decree 356): acknowledgement within 2 working days; access, correction, copy: 10 days; withdrawal, restriction, objection: 15 days; deletion: 20 days (longer if a third party is involved).
10. Data breaches
If a breach happens, we notify the authority within 72 hours and tell you as soon as we can, with what you should do. Serious AI incidents are reported under the AI Law. [CONFIRM: internal procedure, owner]
11. Aggregate research
- Only data from people who turned Research on, and only from after they turned it on.
- Only aggregate numbers are published. Each group must contain at least 5 people (k ≥ 5). Smaller groups are hidden.
- No free-text chat content. No mental-health-related content.
- Reports cannot be used to identify any person.
- We never sell personal data. Selling aggregate reports, if ever, happens only after written legal advice.
12. Children
Careely is for people 16 and over. At sign-up you choose an age range (16–17 or 18+); we store only that range, never a date of birth. There is no account for anyone under 16: the form stops there and nothing is saved. If we learn an account belongs to someone under 16, we delete it.
For 16–17-year-olds we do less with your data, not more:
- your data is never used in any research or aggregate report, even if you turn research on;
- no marketing email; push notifications are held between 22:00 and 07:00 in your device's time zone (else your market's);
- you cannot be a coach, book paid sessions or message coaches, and coaches cannot see you;
- the wellbeing check shows the safety card at a lower level of concern, with lines for young people;
- the AI keeps its answers age-appropriate and focused on school, study choices and first jobs.
Switching from 16–17 to 18+ in Settings is recorded (date and the new range) so we can show when it changed. [CONFIRM with counsel: whether data of 16–17-year-olds is sensitive data or needs a parent's consent under VN law]
13. Cookies and browser storage
| Item | Purpose |
|---|---|
| Refresh session cookie (httpOnly) | keeps you signed in, up to 7 days on the web |
| Language cookie / localStorage | remembers your language (1 year) |
| Other localStorage | small conveniences such as drafts or the open tab |
We use no advertising or third-party tracking cookies.
14. Changes
If we change something important, we tell you in the app or by email before it applies. If a change needs new consent, we ask again.
15. Users in Singapore and the US
- Singapore (PDPA): you can access and correct your data; contact the DPO above. Notifiable breaches are reported to the PDPC within 3 calendar days of assessment. Transfers abroad are protected by contracts giving PDPA-comparable protection.
- United States: we do not sell or "share" personal data for behavioural advertising. Residents of some states (e.g. California) have rights to know, delete and correct; use the methods in Section 9.
[CONFIRM: whether CCPA thresholds apply]
16. Contact
DPO: [DPO NAME] · [DPO EMAIL] · [ADDRESS]