Privacy Policy

Overview

leveld ("we," "our," or "us") operates the leveld.io website, the app.leveld.io platform, and the insights.leveld.io resume portal (collectively, the "Service"). This privacy policy explains how we collect, use, store, and protect your personal data when you use our Service.

By using the Service, you consent to the data practices described in this policy. If you do not agree, please discontinue use of the Service.

Information We Collect

Account Information

When you create an account or request beta access, we collect:

• Email address and authentication credentials (managed by our authentication provider)
• User type: whether you are a candidate or employer
• Registration timestamp

Candidate Profile Data

If you use leveld as a candidate, you may provide:

• Professional headline, summary, and personal narrative
• Location and remote work preferences
• Salary expectations
• Work history (titles, companies, descriptions, employment dates)
• Skills, proficiency levels, and years of experience
• Certifications, licenses, security clearances, and education
• Employer ratings and reviews

Employer and Organization Data

If you use leveld as an employer or recruiter, you may provide:

• Company name, description, industry, size, and website
• Job postings (titles, descriptions, requirements, salary ranges)
• Business verification documents (tax IDs, domain verification records)
• Organization membership and team roles

Resume Portal Data

If you use the Resume Insight Portal (insights.leveld.io), we collect:

• Uploaded resumes and application documents (PDF, DOC, DOCX)
• Application details (company, position, method, notes)
• Subscription and billing information

Automatically Collected Data

We automatically collect certain information when you use the Service:

• IP address: used for rate limiting and security
• User agent: browser type and device information
• Resume open tracking: when a shared resume link is accessed, we record hashed IP addresses, device characteristics, and approximate geographic location for the purpose of providing analytics to the resume owner

How We Use Your Information

We use collected data for the following purposes:

• Service operation: matching candidates with jobs, managing applications, processing subscriptions
• Authentication and security: verifying your identity, preventing fraud, enforcing rate limits
• Resume analytics: providing resume open tracking, activity timelines, and engagement insights to resume owners
• Employer accountability: monitoring response times, enforcing SLA compliance, maintaining employer standing
• Communications: sending transactional emails (application confirmations, SLA notifications), and marketing emails you opt into (launch updates, platform news)
• AI-powered features: processing profile text and job descriptions through AI models to provide coaching, matching, and assistance
• Verification: validating employer business credentials, candidate skill certifications, and document authenticity
• Internal analytics: aggregated, de-identified metrics to improve the platform

We do not sell, rent, or share your personal information with third parties for their own marketing purposes.

Candidate Privacy Protections

We provide specific privacy protections for candidates:

• Anonymized search results: employers see anonymized preview cards during searches; your identity is not revealed until you consent
• Staged identity reveal: your personal information is disclosed to employers progressively, under your control
• Employer blocking: you can block specific employers from viewing your profile
• Location masking: your precise location can be masked in search results

Resume Tracking and Analytics

The Resume Insight Portal provides analytics on shared resume links. When someone opens a resume shared through our Service:

• A small tracking pixel records that the document was accessed
• We collect hashed IP addresses (not stored in plain text), device type, and approximate geographic region
• This data is presented to the resume owner as part of their analytics dashboard
• Premium subscribers may receive Sentinel Token alerts if their resume is forwarded beyond the original recipient

Resume tracking data is collected regardless of the resume owner's subscription tier. However, detailed analytics are only visible to users within their subscription plan limits.

Third-Party Services

We use the following third-party services to operate the platform:

• Cloudflare (hosting, database, storage, AI inference, CDN): processes all data as our infrastructure provider. Privacy policy
• Clerk (authentication): manages your login credentials, session tokens, and identity verification. Privacy policy
• Stripe (payment processing): processes subscription payments. We do not store your credit card information; it is handled entirely by Stripe. Privacy policy
• Resend (email delivery): delivers transactional and marketing emails on our behalf. Privacy policy

We do not use third-party advertising networks, social media tracking pixels, or external analytics services (such as Google Analytics).

Data Storage and Security

Your data is stored using Cloudflare's global infrastructure, including:

• Cloudflare D1: relational database for account data, profiles, applications, and analytics
• Cloudflare R2: encrypted object storage for uploaded files (resumes, verification documents, images)
• Cloudflare KV: key-value store for sessions, rate limiting, and caching

We implement the following security measures:

• All connections encrypted via HTTPS with HSTS enforcement
• Authentication via cryptographically signed JWT tokens
• Content Security Policy (CSP) headers on all responses
• CORS restrictions limiting API access to authorized origins
• Rate limiting on all public endpoints
• File upload validation including magic byte verification
• Verification documents are hashed (SHA-256) and stored separately from identifying information
• HttpOnly, Secure, and SameSite cookie attributes on all session cookies

Cookies

We use only essential cookies required for the Service to function:

• Session cookie: authenticates your session (HttpOnly, Secure, SameSite=Strict, 7-day maximum lifetime, 1-hour inactivity timeout)
• OAuth state cookie: CSRF protection during login (HttpOnly, Secure, SameSite=Lax, expires after 10 minutes)
• Clerk authentication cookies: managed by our authentication provider for session management

We do not use advertising cookies, third-party tracking cookies, or analytics cookies.

Data Retention

• Account data: retained while your account is active, deleted upon request
• Uploaded resumes: retained for 90 days after upload, then automatically deleted
• Verification documents: retained for 90 days after submission, then automatically deleted
• Resume tracking data: retained as long as the associated application exists
• Beta access requests: retained until you request deletion or receive platform access
• Rate limiting data: automatically expires within 1 hour
• Internal analytics: aggregated and de-identified; retained indefinitely

AI Processing

We use AI models hosted on Cloudflare's infrastructure to provide features such as profile coaching, job matching, and in-app assistance. Your profile text, job descriptions, and chat messages may be processed by these models. AI processing occurs entirely within Cloudflare's infrastructure; your data is not sent to external AI providers, and AI-processed data is not used to train models.

Your Rights

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your account and associated data
• Export your data in a portable format
• Opt out of marketing communications at any time (unsubscribe links are included in all marketing emails)
• Block specific employers from accessing your candidate profile
• Revoke consent for specific data processing activities

To exercise any of these rights, contact us at privacy@leveld.io.

Children's Privacy

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected data from a child under 18, we will delete it promptly.

Changes to This Policy

We may update this privacy policy from time to time. We will notify registered users of material changes via email. The "Last updated" date at the top of this page indicates when the policy was last revised. Archived versions of previous policies are available at previous versions.

Contact Us

If you have questions about this privacy policy or our data practices, please contact us at:

Privacy inquiries: privacy@leveld.io
General inquiries: tony@leveld.io