Privacy Policy

Ricky Sharan Chinige, trading as Panthrex is the data controller for personal data processed through Panthrex. For any privacy question, or to exercise your rights, email privacy@panthrexai.com.

Account data. Your email address, password (stored only as a secure hash by our authentication provider), name, and any profile details you add such as headline, location or links.

Resume and career data. Everything you enter or upload: work history, education, qualifications, skills, projects, contact details, cover letters, and the text extracted from any CV file you import.

Usage data. Which features you use and how often, so we can enforce plan limits and improve the product.

Payment data. Stripe handles your card details directly. We never see or store your full card number. We keep a record of your subscription status, plan and transaction references.

Technical data. IP address, browser type and timestamps, used for security, abuse prevention and rate limiting.

Resumes sometimes contain sensitive information, for example health conditions, disability, ethnicity, religion, sexual orientation or trade union membership. Under UK GDPR this is special category data and gets extra protection.

We do not ask for it and we do not need it. If you choose to include such information in your resume, you are giving explicit consent for us to process it as part of delivering the features you request. You can withdraw that consent at any time by removing the information or deleting your account.

Our advice: leave sensitive details out of your Panthrex resume unless they are genuinely relevant to the roles you are targeting.

• To provide the service you signed up for — lawful basis: performance of a contract.
• To process payments and manage subscriptions — performance of a contract.
• To generate AI resume, cover letter, ATS and interview content at your request — performance of a contract.
• To enforce usage limits and prevent abuse — legitimate interests.
• To keep the service secure and investigate misuse — legitimate interests.
• To meet accounting and tax obligations — legal obligation.
• To process any special category data you choose to include — explicit consent.

We do not sell your personal data. We never share your resume with employers or recruiters unless you explicitly choose to send it. We use the following processors:

• Supabase — database, authentication and file storage.
• Vercel — application hosting and delivery.
• OpenAI — AI generation for resumes, cover letters, ATS scoring and interview preparation.
• Stripe — payment processing and subscription management.
• Adzuna — job listings provider. Your search terms are sent to Adzuna; your resume is not.

Each is bound by a data processing agreement. We may also disclose data where required by law or to protect our legal rights.

When you use an AI feature, the relevant content — typically your resume and the job description you provide — is sent to OpenAI to generate the output. Under OpenAI’s API terms, data submitted via the API is not used to train their models.

If you would rather not have your resume processed this way, you can still use Panthrex’s non-AI features such as the resume builder, job search and application tracker.

Some processors, including OpenAI and Stripe, operate outside the UK. Where data is transferred internationally it is protected by UK adequacy regulations or by Standard Contractual Clauses with appropriate safeguards.

• Account and resume data: for as long as your account is open.
• After account deletion: erased or anonymised within 30 days.
• Payment and transaction records: 6 years, as required by UK tax law.
• Security and rate-limit logs: short-lived, typically under 30 days.

Data is encrypted in transit and at rest. Database access is restricted by row-level security policies so that your records are only readable by your own authenticated account. Access to production systems is limited and passwords are never stored in plain text.

No system is perfectly secure. If a breach affects your rights and freedoms we will notify the Information Commissioner’s Office within 72 hours and tell you without undue delay where required.

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — have inaccurate data corrected.
• Erasure — ask us to delete your data.
• Restriction — ask us to limit how we use it.
• Portability — receive your data in a portable format.
• Object — object to processing based on legitimate interests.
• Withdraw consent — where processing relies on consent.

Email privacy@panthrexai.com to exercise any of these. We respond within one month and it is free of charge.

If you are unhappy with our response you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Panthrex is not intended for anyone under 16. We do not knowingly collect data from children under 16. If you believe a child has given us personal data, contact us and we will delete it.

We use a small number of cookies, described in our Cookie Policy.

We will update this policy as the service changes. Material changes will be notified by email or in the app before taking effect.