Privacy Policy

At CV Booster (powered by Nnitiwe.io), your privacy is our priority. This Privacy Policy explains how we collect, use, store, and protect your information when you use our platform, and the rights you have over your data under the Nigeria Data Protection Act (NDPA) 2023 and, where applicable, the EU/UK GDPR.

1. Information We Collect

1.1 Personal Information

When you use CV Booster, we collect:

• Contact Information: Name, email address, phone number (optional)
• Professional Information: Current job title, years of experience, industry, target role
• Account Information: Preferences, feedback, and service usage history

1.2 CV Data

We collect and process:

• Resume/CV Files: PDF documents you upload for analysis
• CV Content: Text extracted from your CV including work experience, education, skills, achievements, and contact details
• Analysis Results: Scores, feedback, recommendations, and insights generated by our AI system

1.3 Technical Data

We automatically collect:

• IP address, browser type, device information
• Pages visited, time spent on site, and interaction data
• Cookies and similar tracking technologies

2. How We Use Your Information

We use your data to:

• Provide CV Analysis: Process your CV through our AI-powered analysis system
• Generate Reports: Create personalized feedback, scores, and recommendations
• Improve Services: Enhance our AI models and analysis accuracy (using anonymized data only)
• Communication: Send you analysis results, updates, and respond to inquiries
• Customer Support: Address technical issues and provide assistance
• Marketing: Send promotional content (only if you opt-in)
• Security: Prevent fraud, abuse, and ensure platform security
• Legal Compliance: Meet legal and regulatory obligations

3. Data Storage and Retention

3.1 Storage Location

Your data is stored using reputable cloud database and file-storage providers, and is processed by the categories of service providers described in Section 4. Some of these providers are located outside Nigeria; where that is the case, we rely on appropriate safeguards (see Section 9).

3.2 How Long We Keep Your Data

We keep your personal data and the content you create (such as your CVs, analyses and generated documents) for as long as your account remains active and as needed to provide the service to you, to comply with our legal obligations, resolve disputes, and enforce our agreements.

• Account & content data: Retained while your account is active so you can access your history. You may delete it at any time – see Section 7.
• When you delete your account: We permanently remove your account, your uploaded and generated files, and associated records. Some information may persist briefly in encrypted backups before being overwritten in the ordinary backup cycle, and we may retain the minimum records required by law (for example, transaction records for tax or anti-fraud purposes).
• Aggregated / de-identified data: Data that no longer identifies you may be retained to understand and improve the service.

4. Data Sharing and Disclosure

We DO NOT sell your personal data or CVs.

We may share your information with:

4.1 Categories of Service Providers

We share the minimum data necessary with vetted third-party providers who process it on our behalf, under contract, and only to deliver the service. These fall into the following categories:

• Cloud database & file storage: to securely host your account, content and generated files.
• AI processing: to analyse your CV and generate documents and recommendations.
• Authentication: to verify your identity and sign you in securely.
• Payment processing: to take payment for credits (handled by PCI-compliant processors; we do not store your full card details).
• Email delivery: to send you account, service and (with your consent) marketing messages.
• Analytics & advertising measurement: to understand usage and measure our marketing – these run only where you have accepted the relevant cookies (see Section 6).

Each provider is bound by a data-processing agreement and appropriate confidentiality and security obligations. We can provide further detail about a specific processor on request to info@nnitiwe.io.

4.2 Legal Requirements

We may disclose your information if required by legal obligations, court orders, or to protect our rights and safety.

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred subject to this policy.

5. Data Security

We implement industry-standard security measures:

• Encryption: All data transmitted via HTTPS/TLS encryption
• Access Controls: Role-based access to sensitive data
• Secure Storage: Encrypted databases and secure cloud infrastructure
• Regular Audits: Security assessments and vulnerability testing
• Backup Systems: Regular backups with encryption

6. Cookies and Tracking Technologies

We use cookies and similar technologies in the following categories:

• Strictly necessary: required for the site to work (e.g. sign-in sessions and security). These are always on.
• Analytics: help us understand how the site is used so we can improve it.
• Marketing / measurement: help us measure and improve our advertising.

When you first visit, our consent banner lets you accept or reject non-essential (analytics and marketing) cookies, and non-essential trackers are not loaded until you consent. You can change your choices at any time via the "Cookie preferences" / "Consent settings" control provided by our consent-management banner, or through your browser settings.

7. Your Privacy Rights

You have the right to:

• Access: Request a copy of your personal data
• Correction: Update inaccurate information
• Deletion: Request deletion of your data (right to be forgotten)
• Portability: Receive your data in a machine-readable format
• Objection/Restriction: Object to or limit processing
• Withdraw Consent: Revoke consent for communications

Two of these rights are self-serve – from your profile page you can "Download my data" (a machine-readable copy of your profile and analyses) and "Delete my account" (permanent erasure). To exercise any other right, or if you need help, contact us at info@nnitiwe.io; we aim to respond within 30 days. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).

8. Children's Privacy

CV Booster is not intended for children. Under the NDPA, a child is anyone under 18 years of age, and processing a child's data requires verifiable parental or guardian consent. We do not knowingly collect personal information from anyone under 18 without such consent. If you believe a child has provided us personal data, contact info@nnitiwe.io and we will delete it.

9. International Data Transfers

Some of our service providers process data in countries outside Nigeria (including the EU/EEA and the United States). Where personal data is transferred outside Nigeria, we rely on lawful transfer mechanisms and appropriate safeguards – such as data-processing agreements, standard contractual clauses, and providers' own certifications – consistent with the NDPA and, where applicable, the GDPR. You can request more information about the safeguards for a specific transfer at info@nnitiwe.io.

10. Third-Party Services

CV Booster relies on third-party providers (in the categories listed in Section 4) that each operate under their own privacy policies. These include AI processing, cloud database and storage, authentication, payments, email delivery, and analytics/advertising-measurement providers. We share only the data necessary for each provider to perform its function, under contract. On request, we can identify the specific provider responsible for a particular category of processing.

11. Marketing Communications

With your consent, we may send you updates and career tips. You can unsubscribe at any time.

12. Changes to This Privacy Policy

We may update this policy periodically. Updates will be posted on this page with a revised date.

13. Data Breach Notification

We maintain an internal procedure to detect, contain, assess and respond to personal-data breaches. In the event of a breach likely to affect your rights, we will notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of it, and will inform affected users without undue delay where required, describing the likely consequences and the steps we are taking.

14. Contact Information

15. Governing Law

This Privacy Policy is governed by the laws of the Federal Republic of Nigeria.