Privacy Policy

What we collect

To generate a rewritten CV, Xira receives your CV text and the job description you paste or upload. We also collect your account email address when you sign up, or your email when you start a guest generation.

Your original CV is not stored

We process your original CV to create the improved version, but we do not retain the original file or text after processing is complete. Only the rewritten CV and the associated analysis are saved to your account.

What we save

We save the rewritten CV, the ATS Readiness score, the Job Match score, and the Before / After / Why explanations. A saved result stays available for 30 days, after which it is deleted automatically — the entry remains in your history, but the rewritten CV can no longer be opened. You can delete any saved result yourself at any time before that. For guest generations, we store your email indefinitely as an abuse-prevention key (see ‘Guest email retention’ below).

How we use your data

Your data is used only to provide the Xira service. We do not use your CV or job description to train models, serve advertising, or share with third parties beyond the processing providers listed below.

We never sell your data

We do not sell, rent, or trade your personal data or documents to anyone, ever.

Data processors we use

To generate your tailored CV, Xira transmits your CV text and job description to the following third-party processing providers, who act as data processors on our behalf:

• Anthropic, PBC (United States) — primary processing provider. CV text and job description are sent to Anthropic's API for analysis and rewriting. Anthropic's data handling is governed by their Commercial Terms and Privacy Policy. CV data is not used to train Anthropic's models when accessed via API (per Anthropic's published API terms).
• OpenAI, L.L.C. (United States) — fallback processing provider. If Anthropic is unavailable, CV text and job description may be sent to OpenAI's API as a fallback. OpenAI's API data is not used to train OpenAI's models (per OpenAI's published API terms).
• Google Cloud Platform (multi-region, primarily Europe) — hosting, authentication (Firebase Auth), and database storage (Firestore). User account data is stored in Google's europe-west1 region.

International data transfers

When Xira sends your CV to Anthropic or OpenAI for processing, your data is transferred to the United States. These transfers are governed by Standard Contractual Clauses (SCCs) under Article 46 of the GDPR. Anthropic and OpenAI participate in the EU-U.S. Data Privacy Framework where applicable. By using Xira, you acknowledge that your CV text is processed in the United States by these providers.

Guest email retention

When you generate a CV without creating an account ('guest generation'), we store the email address you provide. This email is used as a lifetime abuse-prevention key — each email can generate one free CV, ever. We retain guest emails indefinitely for this purpose, unless you request deletion (see 'Your rights' below). Guest emails are not used for marketing or any purpose other than abuse prevention.

Your rights (GDPR)

If you are in the European Union, you have the right to access, rectify, delete, restrict, or port your personal data, and the right to object to processing. Authenticated users can delete their account directly from the profile page. To exercise any other right, including data export, contact us at contact@xira.app and we will respond within 30 days.

Minimum age

Xira is not intended for use by children under 16. If you are under 16, please do not use Xira or submit any personal data. If we become aware that a user under 16 has submitted data, we will delete it.

Cookies and tracking

Xira uses minimal session-level cookies required for authentication. With your explicit consent, Xira also loads the following analytics tools to understand and improve the product: Google Analytics 4 (page-view and event tracking), and Microsoft Clarity (session-replay and heatmaps to identify usability issues). These are loaded only after you accept analytics cookies in the consent banner, and you can withdraw consent at any time. We do not use advertising cookies.

Contact

For any privacy-related questions, contact us at privacy@xira.app.