Privacy Policy

Overview

Xriven is a career readiness platform operated by The Career Mentor LLC, an Arizona limited liability company (“Xriven”, “Company”, “we”, “our”, or “us”).

This Privacy Policy explains how we collect, use, and protect your information when you use Xriven and related services.

Our goal is to help professionals prepare for career decisions with clarity and confidence while protecting the privacy of their professional information.

Information We Collect

Account Information

When you create an account we collect:

• Name
• Email address
• Account password (securely hashed)

Profile and Career Data

To provide platform services we may collect:

• Resume or CV content
• Professional experience
• Skills and career interests
• Target roles or career goals
• Interview preparation inputs
• Career questions submitted through the Career Mentor

This information is used only to generate personalized guidance and insights within the platform.

Usage Data

If you enable optional analytics cookies, we collect aggregated, pseudonymized information about how the platform is used, such as:

• Pages visited
• Features used
• Session duration
• Interaction patterns

Optional analytics are off by default. Separately, we always keep limited operational and security logs (such as request and login records) to keep the platform reliable and protect against abuse, regardless of your cookie choices.

Device and Session Information

For account security and abuse prevention we may collect:

• Pseudonymous device identifiers stored in the browser
• Browser type
• Operating system
• Timezone and language preferences
• Screen dimensions
• Login timestamps
• Session activity logs
• IP address

Device identifiers are pseudonymous and are not used for advertising, cross-site tracking, or behavioral profiling.

Device signals are stored in hashed or pseudonymous form and are used only for security monitoring and abuse prevention.

Device signal data is retained for up to 90 days and is included in account deletion requests.

Categories of Personal Information (California)

For purposes of the California Consumer Privacy Act (as amended by the CPRA), in the past 12 months we have collected the following categories of personal information: identifiers (name, email, IP address, pseudonymous device identifiers); professional or employment-related information (resume content, experience, skills, career goals); internet or network activity (usage data as described above, if enabled); commercial information (subscription and transaction records); and inferences drawn to provide personalized career guidance. We collect these directly from you or your device, use them for the purposes described in this Policy, retain them as described in the Data Retention section, and disclose them only to the service providers listed below. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use or disclose sensitive personal information for purposes requiring a right to limit.

Third-Party Authentication Providers

If you sign in using providers such as Google or Apple, we may receive:

• Name
• Email address
• Profile image

This information is used only for authentication and account setup.

We do not access your contacts, files, or other third-party data.

How We Use Your Information

We use your information to:

• Provide career readiness services
• Personalize guidance and recommendations
• Maintain account functionality
• Improve product performance
• Monitor system security
• Communicate service updates
• Prevent fraud or abuse

We may also use aggregated and pseudonymized data to understand general career trends and improve platform insights.

We do not sell or share personal information for cross-context behavioral advertising, and do not sell personal information to third parties.

Legal Bases for Processing

Where laws such as the EU/UK General Data Protection Regulation apply, we process your personal data on the following legal bases: performance of a contract (providing the platform and subscriptions you request); legitimate interests (platform security, abuse prevention, and service improvement, balanced against your rights); consent (optional cookies and marketing communications, which you may withdraw at any time); and legal obligation (records we must retain by law).

AI Features and Language Model Processing

Some platform features — including Atlas, our AI career mentor — use AI systems to analyze user-provided information such as resumes, skills, and career questions, and to generate structured insights and guidance that support your career preparation.

To generate these insights, the information you submit (such as your questions, resume text, or goals) is processed through the Vercel AI Gateway, which routes each request to a third-party large language model provider acting as our sub-processor. The current default provider is Anthropic; depending on the feature, requests may be routed to other vetted model providers. The current providers and models are listed in the sub-processor list maintained in our Data Processing Addendum.

We do not use your data to train AI models. We do not use your personal data or the content of your Atlas conversations to train, fine-tune, or improve any third-party or general-purpose AI model. Every request is sent under a zero-data-retention, no-model-training configuration: your data is used only to return your result, is not retained by the provider beyond the request, and is not used to train their AI models. If a request cannot be processed under those conditions, it is refused rather than downgraded.

Your resume, career inputs, and Career Mentor conversations are never used to train AI models, including any model shared across other users’ accounts.

AI-generated outputs are advisory in nature and should not be interpreted as professional, legal, or hiring guarantees.

Service Providers and Sub-processors

We rely on a limited set of vetted service providers who process personal data only to provide their service to us, under contractual confidentiality and security obligations. We do not sell your personal information to any of them.

• Clerk — authentication, account and session management, subscription and billing management, and onboarding and transactional email.
• Stripe — payment processing (connected within Clerk); we do not store full card numbers.
• Supabase — application database and storage of your account and career data.
• Vercel — platform hosting and delivery, and the AI Gateway that routes AI requests to model providers under zero-retention, no-training terms.
• Anthropic — large language model processing for AI features, accessed only through the gateway under zero-retention, no-training terms.
• Resend — transactional email.
• Sentry — error monitoring and diagnostics, with personal data minimized and redacted.

Our current sub-processor list (including current AI model providers and models) is maintained in our Data Processing Addendum. We will provide reasonable notice of material changes to this list.

Cookies and Analytics

Xriven uses cookies and similar technologies to:

• Maintain login sessions
• Remember user preferences
• Understand feature usage
• Improve product performance

We use strictly necessary cookies to keep you signed in and the platform secure. Optional functional and analytics cookies are off by default and are only used if you allow them. We do not use advertising or cross-site tracking cookies.

You can change your choice for optional cookies at any time using the Cookie Settings control, or manage cookies through your browser preferences. For full details, see our Cookie Policy.

Data Retention and Deletion

We retain personal data only as long as necessary to provide the service and comply with legal obligations.

You can delete your Atlas conversation history at any time from your account settings, which removes it from your account right away. You can also download a copy of your data, or request deletion of your account and associated personal data, from your account settings; verified account-deletion requests are completed within 30 days, except where longer retention is required by law.

Limited governance and security logs associated with AI interactions are kept in a reduced, personally-identifying-information-minimized form for up to 90 days. Certain records may also be retained where required for legal, billing, or security purposes.

Data Security

We implement industry-standard safeguards including:

• Encrypted connections (HTTPS)
• Secure authentication
• Infrastructure monitoring
• Restricted internal access controls

These measures help protect the integrity of user accounts and professional information.

Your Privacy Rights

Depending on your jurisdiction, you may have the right to:

• Access your personal data and receive a copy in a portable format
• Correct inaccurate information
• Request deletion of your account and personal data
• Object to or restrict certain processing
• Withdraw consent where processing is based on consent
• Opt out of marketing communications
• Not receive discriminatory treatment for exercising your rights

You can exercise these rights (1) directly from your account settings, or (2) by emailing support@xriven.com. We will verify your request and respond within the timeframe required by applicable law. If you are in the EU/UK, you also have the right to lodge a complaint with your local supervisory authority. Authorized agents may submit requests on your behalf where permitted by law.

Children’s Privacy

Xriven is intended for professionals and individuals preparing for career development.

The platform is not intended for users under the age of 16. We do not knowingly collect personal information from anyone under 16. If we learn that we have collected personal information from a user under 16, we will delete that information and close the associated account promptly.

International Users and Data Transfers

Xriven is operated from the United States, and your information is processed and stored in the United States, where data-protection laws may differ from those in your jurisdiction.

Where required for transfers of personal data from the EU, UK, or Switzerland, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses (and UK/Swiss equivalents) with our sub-processors, or a sub-processor’s certification under the EU-U.S. Data Privacy Framework where applicable. You may contact us for more information about the safeguards applied to your data.

Policy Updates

We may update this Privacy Policy from time to time.

When updates occur, the revised version will be posted with a new “Last Updated” date. For material changes, we will provide notice by email or a prominent in-platform notice before the change takes effect.

Contact

For privacy-related questions or to exercise your rights:

The Career Mentor LLC (Arizona) — support@xriven.com