1. Introduction & Scope

Zyncora Inc. (“Zyncora,” “we,” “us,” or “our”) is an AI-powered career-assistance platform incorporated in the Commonwealth of Virginia, United States. This Privacy Policy explains what personal data we collect, how we use it, with whom we share it, and your rights regarding that data.

This Policy applies to all users of the Zyncora website and platform (“Service”) regardless of location. By creating an account or using the Service, you agree to the practices described in this Policy.

2. Information We Collect

We collect information you provide directly, including:

• Account data: name, email address, and password (stored as a salted Argon2 hash — we never store plaintext passwords).
• Profile data: work experience, education, skills, projects, phone number, date of birth, and industry information you enter.
• Job data: job descriptions, URLs, and company details you submit for analysis.
• Generated content: AI-tailored resumes and cover letters produced on your behalf.
• Payment data: billing information is processed entirely by Stripe, Inc. We do not store full card numbers or CVV codes. We store only the Stripe customer ID and subscription status.
• BYOK API keys: if you use a Bring-Your-Own-Key plan, your Gemini API key is stored in an AES-encrypted format and is never logged or transmitted outside of API inference calls you initiate.

We also collect limited usage metadata (session tokens, feature-interaction events) solely to operate and improve the Service. We do not use third-party analytics tracking pixels or advertising cookies.

3. How We Use Your Information

We use your data to:

• Create and manage your account and authenticate your sessions.
• Generate AI-tailored resumes and cover letters using your profile data and job descriptions.
• Process payments and manage your subscription via Stripe.
• Send transactional emails (account confirmations, password resets, billing receipts).
• Respond to support requests and resolve billing disputes.
• Monitor for abuse, enforce our Terms of Service, and maintain security.
• Improve the Service through aggregate, anonymised usage analysis.

We do not sell your personal information to third parties. We do not use your profile or resume content to train AI models without your explicit consent.

4. AI Processing & Third-Party Models

Resume and cover letter generation is powered by third-party AI models. When you request a curation, relevant profile data and job description content is sent to the AI provider’s API over an encrypted TLS connection. The current AI provider is:

• Google Gemini API — governed by Google’s Privacy Policy and Generative AI Terms. By using the Service, you acknowledge that your data is transmitted to Google for inference purposes.

On BYOK plans, API calls are made using your own key under your agreement with the key provider. Zyncora does not inspect or log the contents of BYOK inference responses beyond what is necessary to render the output in your account.

5. Cookies and Local Storage

We use browser localStorage to store your short-lived JWT session tokens and basic UI preferences (e.g., theme selection). We do not use third-party tracking cookies, advertising pixels, or cross-site analytics.

You may clear localStorage at any time through your browser settings, which will sign you out of the Service.

6. Data Retention & Deletion

We retain your account and profile data for as long as your account is active or as needed to provide the Service. Upon account deletion:

• Personal profile data (name, email, experience, education) is permanently deleted within 30 days.
• Generated PDF documents stored in our document storage are deleted within 30 days.
• Billing records required by law or Stripe are retained for up to 7 years as required by applicable financial regulations.
• BYOK API keys are deleted immediately upon account deletion or plan downgrade.

To request account deletion, email contact@zyncorainc.com from your registered address with subject line “Account Deletion Request.” We will confirm deletion within 30 days.

7. Third-Party Service Providers

We share data with the following third-party processors only to the extent necessary to provide the Service:

• Stripe, Inc. — payment processing. See Stripe’s Privacy Policy.
• Google LLC — AI content generation (Gemini API) and optional Google OAuth login. Governed by Google’s Privacy Policy.

We do not share your data with advertisers, data brokers, or any other third party not listed above.

8. Security

We implement industry-standard security measures including:

• All data in transit encrypted via TLS 1.2+.
• Passwords hashed with Argon2id — the current recommended password-hashing algorithm.
• JWT access tokens expire after 1 hour; refresh tokens rotate on every use and are blacklisted on logout.
• BYOK API keys stored encrypted at rest.
• Environment secrets managed via Docker secrets and are never committed to version control.

As an early-stage startup, our infrastructure continues to evolve. While we take reasonable precautions, no system is perfectly secure. In the event of a data breach that materially affects your personal data, we will notify you via your registered email within 72 hours of becoming aware of the breach, as required by applicable data protection law.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: request correction of inaccurate or incomplete data.
• Deletion: request deletion of your personal data (subject to legal retention requirements).
• Portability: request your data in a structured, machine-readable format.
• Restriction: request that we restrict processing of your data pending a dispute.
• Objection: object to processing based on legitimate interests.
• California residents (CCPA/CPRA): you have the right to know what personal information is collected, the right to delete, the right to opt out of sale (we do not sell personal information), and the right to non-discrimination for exercising your privacy rights.

To exercise any of these rights, email contact@zyncorainc.com from your registered address. We will respond within 30 days (or within the timeframe required by applicable law).

10. International Data Transfers

Zyncora is operated from the United States. If you are located outside the United States, your data may be transferred to, stored, and processed in the U.S. By using the Service, you consent to this transfer. We rely on Standard Contractual Clauses (SCCs) where required for transfers from the European Economic Area.

11. Children's Privacy

The Service is intended for users aged 18 and over and is not directed to minors. We do not knowingly collect personal data from anyone under 18. If you believe a minor has created an account, please contact us immediately at contact@zyncorainc.com and we will delete the account promptly.

12. Governing Law

This Privacy Policy is governed by the laws of the Commonwealth of Virginia, United States. Disputes related to this Policy are subject to the jurisdiction of the courts of Arlington County, Virginia, consistent with our Terms of Service.

13. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you via email to your registered address at least 14 days before the effective date. The “Last updated” date at the top of this page reflects the most recent revision. Continued use of the Service after changes constitutes acceptance.

14. Contact

For privacy questions, data access requests, deletion requests, or any legal and compliance matters, contact us at contact@zyncorainc.com.