Privacy Policy

This policy explains what personal data Haiyaa collects, why we collect it, and how we look after it. Haiyaa handles sensitive career information, and we take that responsibility seriously. We aim to be clear and honest about how your data is used.

Who we are

Haiyaa is a career companion and AI-powered resume builder operated as a sole trader based in London, United Kingdom. Our website is haiyaa.me. You can contact us at hello@haiyaa.me.

Haiyaa is for people aged 16 and over. By using the service, you confirm that you meet this age requirement.

Haiyaa is the data controller for the personal data described in this policy. That means we decide how and why your data is processed when you use our service.

What data we collect

When you use Haiyaa, we may collect the following types of data:

• Account data. We collect your email address when you sign up. You can sign in with a magic link sent to your email or with Google through our authentication provider.
• Career data. This is the information you share with Kai during conversations, such as your work history, skills, achievements, target roles, and tone preferences.
• Resume data. We store the resumes Kai generates for you and any edits you make in the editor.
• CV uploads. If you upload an existing CV, we process the file (such as a PDF or Word document) and the text extracted from it.
• Job descriptions. If you use Pro features, we process job descriptions you paste in for resume tailoring and cover letter generation.
• Conversation transcripts. We keep your conversation history with Kai so she can remember your story and personalise future sessions.
• Voice data. If you use voice mode, we process audio you record. That audio is converted to text so Kai can understand and respond to you.
• Public profile data. If you publish a public career profile, we store your username and the resume content you choose to make visible at haiyaa.me/[username].
• Usage data. We collect basic technical information such as pages visited, features used, and timestamps through standard server logs.
• Payment data.If you subscribe to Pro, payments are processed by Stripe. We do not store your full card details. Stripe's privacy policy applies to payment processing.

What we do not collect. We do not use your data for advertising. We do not sell your data. We do not store your full payment card numbers.

Why we collect it

We use your data to:

• Provide and improve the Haiyaa service, including fixing bugs and building new features.
• Personalise Kai's responses based on your career history so conversations feel relevant to you.
• Generate, store, and update your resumes as you work on them.
• Power voice input and spoken replies when you choose to talk to Kai instead of typing.
• Publish your public career profile when you turn that feature on.
• Send account-related emails, such as sign-in links and important service messages.
• Process payments and manage Pro subscriptions.
• Comply with legal obligations, such as tax and fraud prevention requirements.

We do not use your data for advertising. We do not sell your data. Ever.

Legal basis (GDPR)

Under UK GDPR, we rely on the following legal bases to process your data:

• Contract. Processing is necessary to provide the service you signed up for, such as generating your resume and keeping your account running.
• Legitimate interests. We process some data to improve the product, keep Haiyaa secure, and prevent abuse. We balance these interests against your rights and only use data where this is reasonable.
• Legal obligation. We may need to process or retain data to comply with applicable UK law, including tax, accounting, or regulatory requirements.
• Consent. Where we explicitly ask for your permission, such as optional marketing emails if we introduce them in future, we will rely on your consent. You can withdraw consent at any time.

Who we share data with

We use a small number of trusted third-party services to operate Haiyaa. Each provider only receives the data needed for their role:

• Supabase. Stores your account, resume, and conversation data in our database and handles authentication. Data is stored in the EU region.
• Anthropic.Powers Kai's conversations and resume generation. Your career data and messages are sent to Anthropic's API for processing. Anthropic's data use policy applies.
• Groq.Converts voice recordings to text when you use voice mode. Audio is sent to Groq's transcription API for processing. Groq's privacy policy applies.
• ElevenLabs.Generates spoken audio for Kai's voice. Text from Kai's replies is sent to ElevenLabs' text-to-speech API. ElevenLabs' privacy policy applies.
• Stripe.Processes payments for Pro subscriptions. Stripe receives billing information needed to complete your payment. Stripe's privacy policy applies.
• Vercel. Hosts the Haiyaa website and runs our server infrastructure. Vercel may process technical request data such as IP addresses and server logs.

Some of these providers may process data outside the UK. See the section on international data transfers below for more detail.

We do not sell your data. We do not share it with advertisers or data brokers.

Public profiles

Pro users can choose to publish a public career profile at haiyaa.me/[username]. When your profile is public, anyone with the link can view the resume content you have chosen to share.

You control whether your profile is public. If you unpublish your profile or delete your account, public access to your resume is removed.

How we protect your data

We take reasonable steps to keep your data safe:

• All connections to Haiyaa use encryption (HTTPS).
• Access to your data is limited to what is needed to run the service.
• We work with third-party providers chosen for reliability and security.

No online service can guarantee perfect security. If you believe your account has been compromised, please contact us at hello@haiyaa.me as soon as possible.

International data transfers

Some of our service providers, including Anthropic, Groq, ElevenLabs, Stripe, and Vercel, may process data in the United States or other countries outside the UK.

Where data is transferred outside the UK, we rely on appropriate safeguards as required by UK law, such as standard contractual clauses or equivalent protections offered by our providers.

How long we keep your data

• Active accounts. We keep your account, resume, and conversation data for as long as your account is active and you continue to use Haiyaa.
• Account deletion. To request deletion of your account and personal data, contact us at support@haiyaa.me. We'll complete the deletion within 30 days.
• Backups. Copies of your data may remain in backups for a short period during the deletion process, but are removed as backups are refreshed.
• Aggregated usage data. We may keep anonymised, aggregated statistics indefinitely to understand how Haiyaa is used and to improve the product. This data cannot be used to identify you.
• Payment records. We may retain billing and transaction records for as long as required by UK tax and accounting law.

Your rights (UK GDPR)

Under UK GDPR, you have the following rights over your personal data:

• Access. You can ask for a copy of the personal data we hold about you.
• Rectification. You can ask us to correct inaccurate or incomplete data, such as a misspelled name or wrong job title.
• Erasure.You can ask us to delete your data. This is sometimes called the “right to be forgotten.”
• Restriction. You can ask us to limit how we use your data in certain situations, such as while a dispute is being resolved.
• Portability. You can ask to receive your data in a structured, machine-readable format so you can move it elsewhere.
• Object. You can object to processing based on our legitimate interests. We will stop unless we have a compelling reason to continue.

To exercise any of these rights, email hello@haiyaa.me with your request. We will respond within 30 days.

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Cookies

Haiyaa uses essential cookies only. These are needed to keep you signed in and to protect against cross-site request forgery (CSRF).

We do not use analytics, tracking, or advertising cookies. Because we only use strictly necessary cookies, we do not show a cookie consent banner.

Changes to this policy

We may update this policy as Haiyaa grows and new features are added. If we make material changes, we will notify active users by email.

The “last updated” date at the top of this page reflects the most recent version. If you continue to use Haiyaa after changes take effect, that means you accept the updated policy.

Contact

If you have any questions about this privacy policy or how we handle your data, please get in touch at hello@haiyaa.me. We are happy to help.