Who we are
Bullet CV is operated by EigenMesh Pty Ltd, based in Melbourne, Australia (we, us or our). This policy explains how we collect, use, store and share personal information when you visit the site, use the service or contact us. Reach us at info@bulletcv.com or through our contact page.
Information we collect
- Account details: your name, email, password hash, email verification records, account settings and subscription status.
- Career information: CVs, optional profile photo, contact details, work history, education, skills, qualifications, links and supporting documents; information extracted from them; and the edits and messages you provide.
- Job-search activity: target roles, locations, optional citizenship and work-permission preferences, saved jobs, generated documents, screening answers, application notes and assistant instructions.
- Assistant records: task progress, approvals, outcomes, screenshots and browser session data. If you connect a mailbox, we store connection settings and encrypted credentials for authorized applications.
- Billing, support and technical records: payment-provider identifiers, subscription and transaction information, messages you send us, and service and security records such as IP addresses, request times, errors and usage counts. Stripe handles payment-card details on its hosted pages.
Most information comes from you or your use of the service. If you ask us to import a LinkedIn profile, we retrieve available public or publicly indexed information from that URL. We do not connect to your LinkedIn account or ask for its password. Job and application information can also come from employer sites and connected services.
Only share information you have the right to provide, including referee details. Avoid unnecessary sensitive information such as identity-document numbers, health information or financial records. Photos and profile questions are optional; without information needed for a feature, that feature may be limited.
How we use information
We use information to create and secure your account; save and edit your career profile; generate and export documents; match roles to your preferences; carry out applications you authorize; process subscriptions; respond to support requests; diagnose errors; prevent abuse; and meet legal obligations.
We do not sell your personal information or use your career information for advertising. Authorized operators may access relevant records when needed to support you, investigate a problem or maintain the service.
AI and service providers
Relevant career information, messages, job descriptions and task context are sent to Google Gemini for AI features. Browser tasks can include observed page content and screenshots. Public-profile import also sends the URL and retrieved information to Gemini. AI output can be inaccurate; you can review and edit your documents.
- Google Gemini: AI generation, extraction, discovery and assistant decisions. Google's data-handling terms are in the Gemini API terms.
- DigitalOcean: application hosting, database and file storage.
- Stripe: checkout, recurring payments, invoices and subscription management.
- SMTP2GO: account verification and sign-in emails.
- GitHub Actions: storage of encrypted recovery backups.
Providers process information needed for their role. We may also disclose information where required by law or reasonably necessary to protect the service, investigate fraud or protect someone's rights or safety.
Applications and your mailbox
Employers and their application platforms receive the information and documents submitted to them. Reviewed tasks require approval before the guarded submission or send. If you explicitly enable autonomous applications, your saved authorization permits applications through your chosen website and/or email channels within your criteria and daily limit, without a separate review of every application. Follow-up messages keep their own review step.
Connecting a mailbox alone does not authorize sending. Email applications use your connected mailbox and its mail provider. Employer sites and mail providers have their own privacy and retention practices. Stopping a task or deleting information here cannot recall an application or message already received elsewhere.
International processing
Our providers operate internationally, so information may be stored or processed outside your country, including in the United States. Infrastructure and support locations vary by provider. Employers and mail providers you choose may process applications in other countries, including the country where the job is based.
We use access controls, encryption as described below and provider arrangements to protect information. Privacy laws differ between countries. Contact us for more information about a particular provider or destination.
Cookies and browser storage
Bullet CV uses local storage to keep you signed in and remember workspace preferences, and session storage to preserve sign-up progress and import choices between pages. Clearing storage can sign you out or reset those choices. The app does not use advertising cookies or third-party advertising trackers.
Stripe-hosted pages and employer websites may use their own cookies and similar technologies under their own policies.
Retention, deletion and security
We retain workspace information while your account exists. You can delete original uploads in Account → Data & privacy. Deleting an upload leaves the extracted career information in your profile; review or remove that separately. Removing a profile photo removes it from future previews and exports; previously downloaded documents are unchanged.
Account deletion removes workspace records and queues stored files for deletion; temporary cleanup failures are retried. Encrypted recovery copies expire within 90 days and are used for recovery. Restoring a backup must reconcile subsequent deletions before reopening access. Providers may retain records under their own legal obligations, including payment history. Support and security records may be kept as needed to resolve requests, prevent abuse or meet legal obligations.
We use HTTPS, account access controls, hashed passwords, encryption for stored mailbox credentials and browser session secrets, and encrypted off-host backups. Access is restricted to service operation. No system can guarantee absolute security.
Your choices and requests
You can edit your profile and documents, remove uploads, disconnect your mailbox, stop autonomous applications or delete your account. Changing autonomy settings revokes authority for new actions; an action already dispatched may still finish and be recorded.
For access, correction, a copy of your information, deletion assistance or another privacy request, email info@bulletcv.com from your account email where possible. We may ask for proportionate information to verify your identity before releasing or changing personal information. We will explain any legal reason we cannot fulfil a request. Depending on your location, you may have additional rights under applicable privacy law.
Complaints and policy changes
To raise a privacy concern, email info@bulletcv.com with what happened and the outcome you seek. We will review the matter, contact you if we need more information and aim to respond within 30 days. If it takes longer, we will explain why and keep you informed.
If you remain dissatisfied, you can contact your local privacy regulator. In Australia, the Office of the Australian Information Commissioner explains when and how it can consider a complaint.
We update this policy when practices change. The date above identifies the current version. Significant changes will be communicated through the service or your account contact details.