Privacy Policy

OfferCue is operated by NEXTBOUND LTD, a company registered in England and Wales under company number 16936834. Registered office: Initial Business Centre, Unit 7 Wilson Business Park, Manchester, England, M40 8WN, United Kingdom.

We are the controller of personal data processed to operate OfferCue. This policy covers OfferCue, including its website, resume workspace, AI features, authentication and billing. For privacy questions or requests, email privacy@offercue.app.

• Account and contact details: your email address, account identifier, sign-in information and preferences. If you choose a password, our authentication provider handles it.
• Career and conversation content: resumes, work and education history, contact details, skills, job descriptions, prompts, messages, AI responses and changes made in your workspace.
• Files: attachments you upload, file names, extracted text, images and generated resume documents or previews.
• Billing records: payment-provider identifiers, purchased plans, payment and subscription status, billing periods and transaction records. Stripe collects payment details directly; OfferCue does not store full payment-card numbers or security codes.
• Technical and support information: request and error logs, timestamps, IP addresses and browser or device information processed by our hosting and security providers, plus information you send when contacting us.

We obtain information from you, your use of the service, our authentication and payment providers, and websites you ask the Agent to read. Only upload information you are entitled to use. Avoid including identity documents, financial account details, health information or other sensitive personal data that is unnecessary for your resume.

Under UK and European data-protection law, we rely on the following legal bases where they apply:

• Contract: to create and authenticate your account, store and edit resumes, process the instructions and files you submit to the Agent, generate documents, deliver paid access and respond to service requests.
• Legitimate interests: to keep the service reliable, diagnose faults, prevent fraud and abuse, secure accounts and handle disputes. We consider the impact on your rights when relying on these interests.
• Legal obligations: to retain necessary accounting records, respond to lawful requests and meet applicable consumer and data-protection obligations.
• Consent: where a particular optional activity requires it. You can withdraw that consent without affecting processing that was lawful before withdrawal.

Reading or acknowledging this policy is not consent to unrelated processing. OfferCue does not sell your personal information or share it for cross-context behavioural advertising. We do not use the Agent to make hiring decisions about you.

When you use AI features, relevant resume content, conversation history, instructions, attachments or extracted file content are transmitted to the model provider serving that request. This processing is necessary to produce the response and requested edits. Avoid sending content you do not want an AI provider to process.

Our supported providers are Microsoft Azure OpenAI (OpenAI models served through Microsoft), xAI (Grok), and Alibaba Cloud Model Studio (Qwen). The active provider can change. If a selected provider is unavailable because its configuration is missing, the service may use Azure OpenAI instead.

OfferCue does not train its own AI models on your content. Providers process API requests under their applicable service terms, data-protection arrangements and retention settings; this policy does not promise that every provider retains no data. Contact us for information about the provider and transfer arrangements used for your data.

AI responses can contain incorrect personal information. You can edit resume content and contact us to request correction or deletion of other stored information.

• Supabase: account authentication, databases and file storage.
• Vercel: application hosting and the Agent runtime, including operational processing and logs.
• Microsoft Azure OpenAI, xAI and Alibaba Cloud Model Studio: AI processing as described above.
• Stripe: checkout, subscriptions, billing management, transaction processing and payment fraud prevention. Stripe also processes some information for its own regulatory and security purposes under its privacy policy.
• Cloudflare: Turnstile human verification and email delivery infrastructure.

We may also disclose information when required by law, to establish or defend legal claims, to protect people and the service, with your instructions, or as part of a business transfer subject to applicable protections. We do not make your resume public merely because you create it.

OfferCue uses authentication cookies to keep you signed in and a short-lived, signed cookie to authorise resending a sign-in code. The resend cookie expires after 10 minutes. Theme preferences use local storage; session storage remembers whether a payment-success message has already been shown in that tab.

Cloudflare Turnstile and Stripe may use cookies or similar technology when their security or payment features load. These support verification, fraud prevention and payments. OfferCue does not currently add analytics cookies, advertising cookies or advertising pixels.

You can clear or block cookies and local storage in your browser. Doing so may sign you out, reset preferences or prevent authentication and checkout from working. If we introduce optional tracking that requires consent, we will ask before enabling it.

We retain account, resume, attachment and conversation data as needed to provide your workspace, unless you request deletion. A trial or paid plan ending does not itself delete your resumes. Transaction and support records may be retained for accounting, fraud prevention, legal obligations and the handling of disputes.

You can delete individual resumes in the library. This is not the same as deleting your account or every attachment and Agent record. For account-wide deletion or a personal-data export, contact our privacy email. We will explain any data we must retain and why; backups and service-provider records may follow their own deletion cycles.

We use access controls and encrypted connections to protect data. No service can guarantee absolute security. Please keep your sign-in codes and credentials private and contact us if you suspect unauthorised access.

Our providers operate internationally, so your data may be processed outside your country, including outside the United Kingdom and European Economic Area. Protections in those countries may differ.

Where UK or European law requires transfer safeguards, we rely on applicable adequacy decisions or contractual safeguards, such as standard contractual clauses and the UK transfer addendum or agreement, as appropriate to the provider and destination. You can contact us for details of the safeguards applicable to your data.

Depending on where you live, you may request access to, correction of, deletion of or a portable copy of your personal data, restrict processing, object to processing based on legitimate interests, and withdraw consent where we rely on it.

California residents may also have rights to know the categories and specific pieces of personal information collected, the sources, purposes and recipients, and to correct or delete that information. The categories we handle and disclose for business purposes are described above. We do not sell personal information, share it for cross-context behavioural advertising, or use sensitive personal information to infer characteristics about you. We will not discriminate against you for exercising applicable rights.

Email privacy@offercue.app from your account email, stating your request and mentioning OfferCue. An authorised representative may also contact us; we may request proportionate proof of identity or authority. Do not email your password, sign-in code or full payment details.

We respond within the period required by applicable law, normally one month for UK and EEA requests and 45 days for California requests. If a permitted extension or an exception applies, we will explain it. You may complain to the UK Information Commissioner’s Office or your local data-protection authority.

OfferCue is intended for adults aged 18 or over. If you believe a child has provided personal data, contact us so we can address it.

We may update this policy as the service or legal requirements change. We will update the date above and provide additional notice of material changes where required. Contact NEXTBOUND LTD at its registered office or our privacy email with any questions.