Nexstepper

Privacy Policy

Updated 2026-09-25

What we collect, why we collect it, who else touches it, and how you take it all back — in plain English, with your rights under GDPR, CCPA and PIPEDA.

At a glance

What do you collect?Your email and password (hashed), your resumes and job descriptions, and payment records if you ever subscribe.Who sees my data?Nobody, unless you make something public. Resume text is never sold. Named subprocessors are listed in full in section 4.What are my rights?Access, correction, deletion, portability and objection — regardless of where you live. One email gets you started.How do I delete my data?Self-serve from Settings → Security, or by emailing us. Deletion is irreversible and finishes within 30 days.How long is it kept?Until you delete it. Revisions are trimmed to 30; deleted accounts are purged within 30 days.How is it protected?Passwords hashed, sessions in httpOnly cookies, traffic encrypted, and every AI provider call scoped to your document.

Summary

Nexstepper (“Nexstepper”, “we”, “us”) is an AI-assisted resume builder. We collect only the information we need to run the service, retain it only as long as we have a reason to, and give you tools to export or delete it on demand. We do not sell your personal information. We do not use your resume content to train third-party AI models. Subprocessors are listed in §4.

1. Information we collect

We collect three categories of information:

  • Account information you provide — email address, display name, and a hashed password. If you sign in with a third-party provider (e.g. Google) in the future, we receive the email and basic profile fields that provider exposes.
  • Resume content you create— the master resume, its revisions, tailored variants, applications (job postings you've attached), and AI-generated suggestions you accept or reject. This content is yours; we hold it to render the editor and to power features like ATS scoring.
  • Usage information collected automatically — IP address, browser type, pages visited, and timestamps. We use this for security (rate limiting, abuse detection) and product analytics (which features get used). Analytics data is sent to PostHog; see §4.

2. How we use information

We use the information above to:

  • Operate the service (render your editor, score your resume, generate AI suggestions).
  • Process your subscription if you upgrade to Pro (handled by Stripe; we never see your card number).
  • Detect abuse, protect against security incidents, and enforce our Terms.
  • Send transactional email (password reset, billing receipts) — never marketing email without your explicit opt-in.
  • Improve the product: aggregated, de-identified usage patterns. We do not use your resume content for AI training.

Under the EU GDPR we process your personal data on the following bases:

  • Contract (Art. 6(1)(b)) — providing the service you signed up for, processing your subscription, storing your resume content.
  • Legitimate interest (Art. 6(1)(f)) — security, fraud prevention, basic product analytics. You can object at any time (see §7).
  • Consent (Art. 6(1)(a))— only for optional features that aren't part of the core service (e.g. marketing email). You withdraw consent at any time.

4. Subprocessors

We share your information with the following subprocessors to run the service. Each is bound by a Data Processing Agreement.

  • Neon — managed Postgres database (US or EU region).
  • Vercel — hosting + edge network.
  • Stripe — payment processing. Receives your email and billing details; never receives your resume content.
  • Resend — transactional email (password reset, receipts).
  • PostHog — product analytics, AI observability, and (potentially) session replay. Three capabilities, same vendor:
    • Product analytics. Autocaptured pageviews, button clicks, form submissions, and custom events ($pageview, $autocapture, and our own events). Events are keyed by an opaque user ID, not your email or any resume content. We scrub user properties on account deletion (§7).
    • AI observability. Every AI request (chat assistant, bullet rewrite, JD parser) sends PostHog the model name, latency, token counts, cost, error status, and a synthetic trace ID. We do not send your prompts or model responses. The SDK runs in privacy mode (configured in lib/ai/providers.ts), which excludes $ai_input and $ai_output_choices from captured events. PostHog otherwise retains large $ai_* properties for 30 days, then deletes them. Even with privacy mode off, this 30-day window applies.
    • Session replay. Not currently active. The PostHog JS SDK ships with the recorder included but does not record sessions unless the feature is enabled in our PostHog project settings. If we turn it on in the future, form input values are masked by default (maskAllInputs: true), so passwords, resume content typed into form fields, and other sensitive inputs appear as * in replays. We will update this section before enabling recording.
  • Sentry — error monitoring. Errors are automatically scrubbed of PII by Sentry's default data-scrubbing rules.
  • Vercel AI Gateway— routes AI requests to model providers (see below). Receives your resume content + your prompt; the gateway returns the model's response. See §8 for retention behaviour.
    Actual model providers (configured in lib/ai/providers.ts):
    • Mistral (mistral/mistral-nemo) — primary. Free-tier.
    • Meta (meta/llama-3.1-8b) — first fallback.
    • Amazon (amazon/nova-micro) — second fallback.
    • OpenAI (openai/gpt-4o-mini) — third fallback.
    The fallback chain kicks in only when the previous model fails or times out. Your prompt is sent to at most one provider per request. We may swap the primary or fallbacks without notice (e.g. if a provider's free tier changes); the current configuration is always visible at the GitHub link in §11.

Configured but not currently active. We have client SDKs wired for Inngest (background jobs) and Liveblocks (real-time collaboration, planned for Phase 5). Neither processes user data today. When either ships, we will update this list before the change takes effect.

We will give you 30 days' notice via email before adding a new subprocessor that handles personal data. Continued use of the service after notice is your consent; you may export or delete your data before the change takes effect.

5. Cookies and tracking

We use the minimum cookies necessary. See our Cookie Policy for the full list, including retention times and how to disable non-essential cookies.

6. Data retention

We retain your account data for as long as your account is active. Specific retention windows:

  • Account profile, resumes, chat history — until you delete your account or 24 months after your last login, whichever comes first.
  • Billing records — 7 years (tax / financial audit requirement). Contains your name, email, invoice amount, and last 4 digits of card. Card numbers never touch our servers.
  • Stripe webhook event log — append-only; pruned after 30 days. Used for idempotency; retained on a legal obligation basis.
  • Backups — Neon PIT backups retained 7 days (or per your plan tier). Backups are scrubbed of personal data on the same 30-day rolling cycle as live data.

7. Your rights

You have the right to:

  • Access — see what we hold. Go to /dashboard/security and click Download my data; the file is generated and downloaded instantly as JSON.
  • Portability — receive your data in a structured, machine-readable format. Same export as above.
  • Deletion — request erasure of your data. Same /dashboard/security page, Delete Account button. We erase across our database, our payment processor, and our analytics. Most deletions complete in under 60 seconds; some third-party processors may take up to 30 days.
  • Correction — edit your profile information from /dashboard/general.
  • Object / restrict — email privacy@nexstepper.com. We'll respond within 30 days.
  • Withdraw consent — for any optional processing (e.g. marketing email), unsubscribe link in the email itself or contact us.

California residents (CCPA/CPRA):you also have the right to (a) know what categories of personal information we collect (see §1), (b) opt out of sale or sharing (we don't sell or share), (c) limit use of sensitive personal information (we don't collect any under CPRA's definition), and (d) non- discrimination for exercising these rights.

Canadian residents (PIPEDA): the same access, correction, and deletion rights apply. To file a complaint with the Office of the Privacy Commissioner of Canada, visit priv.gc.ca.

EU/UK residents (GDPR): you may lodge a complaint with your supervisory authority. The list of EU DPAs is at edpb.europa.eu; the UK ICO is at ico.org.uk.

8. International transfers

Nexstepper is operated from the United States. If you use the service from outside the US, your information will be transferred to and processed in the US. We rely on the European Commission's Standard Contractual Clauses (2021/914) and the UK International Data Transfer Addendum for transfers from the EU/UK to the US. AI Gateway model providers may process your prompts in their own regions; the Vercel AI Gateway routes per their published policy.

9. Children's privacy

Nexstepper is not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has signed up, email privacy@nexstepper.com and we will delete the account.

10. Security

We protect your data with industry-standard measures: TLS in transit, AES-256 at rest (via Neon's encryption), bcrypt-hashed passwords (via Better Auth), strict role-based access controls on internal systems, and continuous monitoring via Sentry. No system is perfectly secure; if you discover a vulnerability, please email security@nexstepper.com (PGP key on request).

11. Open-source + self-hosting

The Nexstepper source code is released under theMIT license. This Privacy Policy covers only the hosted service at nexstepper.com.

If you self-host the code on your own infrastructure, you are the data controller for any data your users put into the system. The Nexstepper privacy policy does not apply to your instance. You are responsible for:

  • Publishing your own privacy policy that names you as the controller.
  • Listing the subprocessors you actually use (Stripe, Resend, AI providers, etc. — likely the same as ours, but it's your call).
  • Responding to user data-access, deletion, and portability requests within the timelines required by your jurisdiction.
  • Compliance with GDPR, CCPA, PIPEDA, or any other applicable privacy laws based on where your users live.

See self-hosting guide for the full checklist.

12. Changes to this policy

We will post material changes here at least 14 days before they take effect and email active users. Non-material changes (typo fixes, clarifications) are logged in the revision history below.

  • 2026-09-24 — initial version (generated from Termly open templates).
  • 2026-09-24 — added §11 “Open-source + self-hosting” scope clarification (the Nexstepper hosted service and your self-hosted instance have separate data-controller relationships).
  • 2026-09-25 — expanded §4 PostHog entry into three sub-capabilities (product analytics, AI observability, session replay) and clarified that AI observability runs in privacy mode so prompts and responses are never sent to PostHog.

13. Contact

Privacy questions: privacy@nexstepper.com.
Security disclosures: security@nexstepper.com.
Postal: available on request(we're a small team; email is the fastest path).