Your data is used to help you find work, and nothing else.
Last updated · 5 October 2026
Draft: to be reviewed by a lawyer before launch. Some details, such as the support email and refund rule, are provisional.
1. Who we are
Gungfu is run by ABC AI Concepts Limited. This policy covers the website, the iOS app and the Chrome extension, and explains what personal data we collect, why, who else handles it, and the choices you have. It is written to meet Taiwan’s Personal Data Protection Act and Hong Kong’s Personal Data (Privacy) Ordinance.
2. What we collect
- Account: your email address and sign-in records.
- Your CV: the file you upload and the text we read from it, and the target profile you confirm from it.
- Standing answers: answers you choose to save, such as your right to work and expected salary for each market.
- How you use the service: jobs you save or pass, applications you prepare and send, coaching notes and practice answers.
- Purchases: your plan, credits and purchase records. Card numbers are handled by Stripe or Apple, never by us.
- From the extension, only when you click: the field labels, types and options of the form you click AutoFill on, and the job description on a page where you click “Save this job”, which is stored with that saved job for you alone.
3. How we use it
- To find and evaluate jobs that fit your target profile.
- To prepare your tailored CV, cover letter and form answers, and to fill forms when you ask.
- To coach you on interviews, offers and skills.
- To remind you about follow-ups, run your plan and credits, keep the service secure and answer support requests.
We don’t sell your CV or personal data, we don’t use it for advertising, and we don’t use it for any other purpose without asking you first.
4. AI processing
To evaluate jobs and prepare your applications, we send the text that’s needed — your CV text, the job text and answers you write — to our AI provider, OpenRouter (NVIDIA Nemotron and Qwen models), one request at a time. We read only the text of your CV, so photos in your CV are never sent, and Hong Kong and Taiwan identity numbers are removed from that text before it goes anywhere.
Questions about your right to work, salary and identity numbers are never drafted by AI: they come only from answers you have saved yourself, or are left for you to fill in.
Some of the free models we use today may let their providers use what they receive to improve their models. Before launch, we will move to services that don’t train on your data.
5. Companies that handle your data for us
These companies process data on our behalf and only for the purposes listed.
| Company | What for | Data | Where |
|---|---|---|---|
| Oracle Cloud | Runs our servers and background jobs | All data the service needs | Singapore |
| Supabase | Database | Account, target profile, CV content, job records | Singapore |
| Cloudflare | Website hosting, domain, database backups | Website connection data, encrypted backups | Global network; backups in Asia-Pacific |
| OpenRouter (NVIDIA Nemotron and Qwen models) | Evaluating jobs, preparing applications, coaching | CV text, job text, answers you write | United States, and the countries where the model providers operate |
| Brevo | Sending sign-in codes | Email address | European Union |
| Stripe | Payments on the website | Payment and subscription records (Stripe handles card numbers; we don’t keep them) | United States and elsewhere |
| Apple, RevenueCat | In-app purchases on iPhone | Purchase and subscription records | United States |
6. Where your data is stored
Your data is stored mainly in Singapore. Some of the companies above process data in other countries, including the United States and the European Union. By using the service, you understand that these transfers are needed to run it.
7. How long we keep it
We keep your data while your account is open. Your CV file is stored encrypted.
When you ask to delete your account (in the iPhone app’s Settings, or by writing to us), you are signed out everywhere and your account, CV and related data are erased 30 days later. If you sign in again within those 30 days, the deletion is cancelled. We keep a record of each purchase, with nothing that identifies you. Copies in backups are overwritten after 30 days. Records we must keep by law, such as payment records, are kept only as long as the law requires.
8. Your rights
You can ask to see your data, get a copy, correct it, ask us to stop using it, or delete it. You can correct your target profile in the app at any time. For anything else, write to support@gungfu.example; we’ll reply in line with the law.
10. The Chrome extension
The extension asks for four permissions — activeTab, scripting, sidePanel and storage — and no access to any website. It reads a page only when you click AutoFill or Save this job. From a form it keeps nothing but counts of what it filled. When you click Save this job, the job description shown on that page is stored with your saved job, visible only to you, used to work out your fit, and deleted with your account. See the extension page.
11. Age
Gungfu is for people aged 12 and over. If we learn that someone younger has an account, we’ll delete it.
12. Changes and contact
If we change this policy in a way that matters, we’ll tell you in the app or by email before it takes effect. Questions about privacy: support@gungfu.example.