Privacy Policy – Operlya

Last Updated: April 2026

At Operlya, we are committed to protecting your privacy, securing your personal data, and ensuring full transparency in how your information is collected, processed, and used. Operlya is a modern AI-powered career ecosystem that enables users to build professional CVs, manage personal career profiles, access intelligent tools, and interact with digital employment services.

This Privacy Policy explains in detail how we handle your data when you use Operlya (the “Platform”, “Service”). By accessing or using Operlya, you agree to the terms described in this Privacy Policy.

1. Information We Collect

We collect only the information necessary to operate, improve, and personalize your experience on Operlya. This includes, but is not limited to, the following categories of data, which we gather either directly from your input, automatically through your interactions, or from third-party authentication services:

• Account Information: Full name, email address, authentication data (including hashed passwords and social login tokens), and unique account identifiers such as user ID and registration date.
• Professional Profile Data: Comprehensive CV details including education history (institutions, degrees, dates), skills inventory (hard, soft, and technical skills), work experience (job titles, company names, responsibilities, durations), certifications, licenses, professional affiliations, spoken languages with proficiency levels, and explicit career preferences (desired roles, industries, locations, and salary expectations).
• Generated Content: All AI-generated CVs, cover letters, professional summaries, accomplishment statements, skill suggestions, career biographies, and any document edits, revisions, or outputs created within Operlya’s AI tools. This also includes user feedback on AI outputs (e.g., likes, dislikes, corrections).
• Usage Data: Detailed interactions with the Platform, including feature usage frequency (e.g., number of CV generations per session), navigation behavior (click paths, time spent on pages), feature adoption rates, search queries, export actions, and system performance logs (error reports, latency data).
• Technical Data: IP address (for geolocation and security), browser type and version, device information (make, model, screen resolution), operating system, unique device identifiers, referring website addresses, and data from cookies or similar tracking technologies.
• Transaction Data: Records of virtual coins, credits, purchases (including amounts, timestamps, and payment method types, though full payment card details are processed by our PCI-compliant partners), subscription status, plan history, invoicing information, and any refund or dispute records.

2. How We Use Your Information

Operlya uses your data strictly to provide, maintain, protect, and improve its services. Your information is used for the following specific operational, analytical, and legal purposes:

• Creating, storing, versioning, and managing your professional CV and comprehensive career profile, including synchronization across devices.
• Powering AI-based CV generation, real-time content optimization, tailored wording suggestions, grammar and style correction, and automated formatting assistance.
• Personalizing your dashboard layout, job recommendations, learning content suggestions, and overall user experience based on your industry, seniority, and past behavior.
• Providing customer support, troubleshooting technical issues, responding to inquiries, and documenting service interactions for quality assurance.
• Ensuring platform security, fraud prevention, abuse detection (e.g., automated bot activity), and enforcing our Terms of Service.
• Sending essential service communications such as account verification emails, security alerts, password reset instructions, critical system updates, and policy change notifications (these are non-marketing and cannot be opted out of).
• Improving Operlya through aggregated analytics, user experience research, A/B testing, feature performance monitoring, and training our AI models (only on anonymized or de-identified data unless explicit consent is given).

3. AI Processing and Automation

Operlya includes AI-powered tools that process your CV and profile data to generate optimized content. This processing is automated and designed to assist users in improving their career documents. Specifically, our large language models (LLMs) may analyze your input text to produce suggestions for bullet points, summaries, skill phrasing, and keyword enrichment. AI outputs are suggestions only and should not be considered professional guarantees, legal advice, or definitive career counsel. You remain fully responsible for reviewing, editing, and validating any AI-generated content before use. Operlya does not use your personal data to train models for third-party products without your explicit, separate consent.

4. Data Protection and Security

We implement industry-standard security measures to protect your data against unauthorized access, alteration, disclosure, or destruction. These measures include, in technical and organizational detail:

• End-to-end encryption for sensitive data transmission (TLS 1.3 protocols for all data in transit) and at-rest encryption (AES-256 for stored personal information).
• Secure authentication systems (including multi-factor authentication support, OAuth2 integration, and brute-force protection) and strict role-based access control mechanisms (RBAC) limiting employee data access.
• Continuous, automated monitoring for suspicious activity, including login anomalies, data exfiltration attempts, and denial-of-service patterns, plus real-time security threat detection.
• Regular security audits, third-party penetration testing, continuous system patching, and proactive vulnerability assessments conducted at least quarterly.

5. Data Sharing and Third Parties

Operlya does not sell, rent, or trade your personal data to any external organization for advertising, marketing, or any commercial purpose unrelated to providing our service. We only share information in the following strictly defined cases:

• With trusted service providers who act as data processors (e.g., email delivery platforms like SendGrid, cloud hosting providers like AWS or GCP, analytics services like Mixpanel or PostHog), solely to perform functions on our behalf under binding data processing agreements.
• With security and fraud prevention tools (e.g., reCAPTCHA, IP reputation services) to detect and prevent malicious activity, spam, or unauthorized access attempts.
• When required by applicable law, legal process, subpoena, search warrant, court order, or governmental authority, and only to the extent strictly necessary to comply with such valid legal obligations.

All third-party partners are contractually required to comply with strict confidentiality, data protection obligations, and security standards at least as stringent as those described in this policy. They are prohibited from using your data for any purpose other than the specific service they provide to Operlya.

6. Data Ownership

You retain full and exclusive ownership of your personal data, original CV content, and all documents created on Operlya. We do not claim any intellectual property or ownership rights over your information. Any AI-generated suggestions are considered derivative works based on your input; as such, you hold all rights to the final document you choose to export. You may export, modify, or delete your data at any time without penalty. Operlya’s only rights are to host, process, and display your data as necessary to deliver the Service to you.

7. Cookies and Tracking Technologies

Operlya uses essential and functional cookies, local storage, and similar technologies to: maintain secure authentication sessions across pages, remember your UI preferences (e.g., theme, language), analyze platform performance (via first-party analytics), and improve overall user experience. We do not use targeting or advertising cookies unless you provide explicit consent via a cookie banner. You may disable or delete cookies in your browser settings at any time; however, certain core features — such as staying logged in, saving drafts, or generating CVs — may become limited or completely unavailable without functional cookies.

8. Data Retention

We retain your personal data only for as long as necessary to provide the Services to you, comply with legal obligations (e.g., tax, accounting, or anti-fraud laws), resolve disputes, or enforce our agreements. Specifically:
- Active account data: retained until you delete your account or request removal.
- Backup and logs: may persist for up to 90 days after deletion for disaster recovery.
- Transaction records: retained for 7 years to meet financial and legal audit requirements.
You may request deletion of your account and associated data at any time via the Settings page or by contacting support. After a verified deletion request, we will permanently delete or anonymize your personal data within 30 days, except where law requires longer retention.

9. International Data Transfers

Operlya may process and store data on secure servers located in different countries, including the United States, the European Union, and other regions where our service providers operate. By using the Platform, you consent to the transfer of your information across international borders in accordance with applicable data protection laws. When transferring personal data from the European Economic Area (EEA), Switzerland, or the UK, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) as approved by the European Commission, together with supplementary measures where needed.

10. User Rights

Depending on your location (particularly if you are in the EEA, UK, Switzerland, California, or other regions with specific privacy laws), you may have the following enforceable rights:

• Right to access your personal data — obtain a copy of the data we hold about you.
• Right to correct inaccurate, incomplete, or outdated information.
• Right to request deletion of your data (the “right to be forgotten”), subject to legal exceptions.
• Right to restrict or object to certain types of data processing, including direct marketing or automated decision-making.
• Right to data portability — receive your data in a structured, machine-readable format (e.g., JSON or CSV) and transmit it to another controller.

11. Coins, Credits, and Virtual Economy

Operlya may offer virtual coins, credits, or tokens used to access premium features, AI generations, or document exports. These virtual items have no monetary value outside the Platform, are non-transferable between accounts, cannot be exchanged for real currency, and may be modified, adjusted, or removed at Operlya’s sole discretion without liability. Unused credits do not entitle you to a refund unless required by local law. Any purchase of virtual items is final. We may update pricing, earning rates, or expiration policies with reasonable notice.

12. Security Limitations

While we apply strong security measures, no system — including Operlya — is 100% immune to compromise. We cannot and do not guarantee absolute protection against unauthorized access, sophisticated hacking attempts, malware, social engineering, or data breaches that may result from factors beyond our reasonable control (e.g., compromised user devices, insecure networks, or password reuse by users). You also bear responsibility for safeguarding your login credentials and using the Platform in a secure environment.

13. Changes to This Privacy Policy

Operlya may update this Privacy Policy periodically to reflect new features, changing legal requirements, regulatory guidance, operational improvements, or security enhancements. Updates will be posted on this page with a revised “Last Updated” date. For material changes (e.g., new data uses, expanded sharing), we will provide prominent notice within the Platform or via email at least 30 days in advance. Your continued use of Operlya after the effective date constitutes acceptance of the revised policy.

14. Contact Information

If you have any questions, concerns, requests, or complaints regarding this Privacy Policy, our data handling practices, or if you wish to exercise any of your user rights, you can contact us at:
support@operlya.com

For data protection inquiries or to reach our Data Protection Officer (DPO), please write to:
Privacy Office, Operlya, mdata@operlya.com
We aim to respond to verified requests within 30 days. If you are in the EEA, you also have the right to lodge a complaint with your local supervisory authority.

Operlya is built on trust, transparency, and innovation. Your privacy is not just a policy — it is a core part of our mission.