Privacy Policy

Who We Are

Opportyx is operated by Change Enablers Ltd, company number 07437984, registered office 16 Verdayne Gardens, Warlingham, CR6 9RN, England. For UK GDPR purposes, Change Enablers Ltd is the controller of personal data processed through Opportyx unless a separate written agreement says otherwise.

For privacy, support, or GDPR requests, contact support@opportyx.com.

Personal Data We Collect

Depending on how you use Opportyx, we may collect and process:

• name, email address, username, and account details;
• passwords in hashed form only;
• employment history, education history, skills, certifications, desired roles, and career preferences;
• CVs, cover letters, uploaded documents, generated documents, and document metadata;
• job applications, saved jobs, job matching activity, application links, and application status information;
• interview preparation data, interview answers, AI feedback, and preparation reports;
• payment records, credit purchases, credit usage, Stripe checkout references, and refund records;
• customer support messages and GDPR correspondence;
• analytics and product usage events, including feature usage, page interactions, device type, browser, approximate location derived from technical data, and timestamps;
• security, authentication, session, CSRF, cookie, IP address, and device information; and
• information you choose to provide in free-text fields or uploaded documents.

Why We Use Personal Data

We process personal data to:

• create and manage user accounts;
• provide AI-powered career services, including CV analysis, job matching, tailored CVs, cover letters, interview coaching, and career feedback;
• store documents and generated outputs for the current authenticated user;
• process payments, manage Career Copilot Credits, handle refunds, and maintain financial records;
• provide customer support and respond to GDPR requests;
• prevent fraud, abuse, prompt injection, unauthorised access, duplicate submissions, and misuse of credits;
• secure, monitor, troubleshoot, and improve the platform;
• understand product usage through analytics; and
• comply with legal, tax, accounting, regulatory, and dispute-resolution obligations.

Lawful Bases Under UK GDPR

We rely on different lawful bases depending on the processing activity:

• Contract: to create accounts, provide paid and free platform features, manage credits, and deliver requested AI services.
• Legitimate interests: to secure the platform, prevent fraud, improve services, diagnose technical issues, understand product use, and protect legal rights, provided those interests are not overridden by your rights.
• Legal obligation: to keep required financial, accounting, tax, compliance, and dispute records.
• Consent: where consent is specifically requested, such as for certain non-essential cookies, marketing, or optional processing.

AI Training

User CVs, uploaded documents, cover letters, generated documents, job application data, interview data, and other personal information are never used by Change Enablers Ltd to train AI models.

Where third-party AI infrastructure is used to provide a requested feature, content is sent only as needed to generate the requested output for the current authenticated user and subject to the processor safeguards and configuration used by the platform.

Third-Party Processors

We use service providers that may process personal data on behalf of Change Enablers Ltd. These may include:

• Google Cloud: cloud storage, AI infrastructure, document processing, embeddings, and related hosting or security services.
• Stripe: payment processing, checkout, fraud checks, billing records, and payment dispute handling.
• Render: application hosting, deployment, logs, networking, and infrastructure operations.
• PostHog: product analytics, usage events, feature interaction data, and product improvement insights.

These organisations may process data on behalf of Change Enablers Ltd only for the services they provide, subject to their contractual and technical safeguards.

International Transfers

Some processors and infrastructure providers may process personal data outside the United Kingdom. Where this happens, Change Enablers Ltd relies on appropriate safeguards such as adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, processor commitments, or other legally recognised safeguards.

Data Retention

We keep personal data only for as long as reasonably needed for the purposes described in this policy, including providing the account, complying with law, resolving disputes, and maintaining security. Active account data is generally retained while the account remains active. Deleted account data is handled as described on our UK GDPR page.

Your UK GDPR Rights

Subject to legal conditions and exemptions, you may have the right to access your data, correct inaccurate data, request erasure, restrict processing, object to processing, request portability, withdraw consent where processing is based on consent, and complain to the Information Commissioner's Office.

To exercise your rights, contact support@opportyx.com. We may need to verify your identity before acting on a request.

Security

We use technical and organisational measures designed to protect personal data, including authentication, access controls, secure cookies, CSRF protection, HTTPS controls, rate limiting, document access controls, cloud storage permissions, monitoring, and prompt-injection safeguards.

No internet service can be guaranteed completely secure. You should keep your password confidential and contact us promptly if you suspect unauthorised access.

Contact and Complaints

Privacy contact: support@opportyx.com

You also have the right to complain to the Information Commissioner's Office at ico.org.uk.