Privacy Policy

Effective Date: 3 March 2026 | Last Updated: 14 April 2026

---

Part 1 — General Terms (All InnovaLabWorks Products)

1. Data Controller

The data controller responsible for your personal information is:

9547-8715 Quebec inc. operating as InnovaLabWorks
1027-1055 rue Lucien l’Allier
Montreal, QC H3G 3C4
Canada

For any privacy-related enquiries, please use the contact form on our website or the built-in support form within our apps.

2. Scope

This Privacy Policy applies to all products, services, websites, and communications offered by InnovaLabWorks, including but not limited to:

• The CURRIQ: AI CV Builder iOS application
• The innovalabworks.com website
• Any future products or services we develop and release
• Support and communication channels
• Newsletter and marketing communications

3. General Data Practices

We build all our products with privacy as a core design principle. Our approach is guided by:

• Data Minimisation: We collect only the data strictly necessary to provide our services. We do not use third-party analytics SDKs, advertising networks, or social media tracking tools.
• Purpose Limitation: Data is used only for the specific purpose for which it was collected and is never repurposed for unrelated activities.
• Storage Limitation: We retain data only for as long as it is needed to fulfil its purpose, after which it is permanently deleted.
• Privacy by Design: Our apps are architected so that user-created content stays on your device by default. We do not require account creation or login credentials.

4. Types of Data We May Collect

Across our products and services, we may collect the following categories of data:

• Personal Information: Name, email address, and any other information you voluntarily provide through our products or forms.
• Usage Data: Feature interaction data stored locally on your device (such as rate-limiting timestamps). We do not transmit usage analytics to our servers.
• Device Information: When you contact support, basic device metadata (app version, device model, OS version, language preference) may be included with your submission.
• Communication Data: Messages, subject lines, and related metadata submitted through support or contact forms.

5. Legal Bases for Processing

We process your personal data based on the following legal grounds:

• Consent: When you voluntarily provide your data (such as subscribing to a newsletter, submitting a support form, or initiating an AI-powered feature). You can withdraw consent at any time.
• Contract Performance: When processing is necessary to provide you with the services you have requested (such as managing your subscription).
• Legitimate Interests: When processing is necessary for our legitimate business interests (such as improving our products, preventing abuse, or ensuring security), provided these interests do not override your fundamental rights.
• Legal Obligation: When we are required to process data to comply with applicable laws, regulations, or legal proceedings.

6. Data Security

We implement appropriate technical and organisational measures to protect your data:

• All network communications use HTTPS/TLS encryption (TLS 1.3 where supported)
• Local app data is encrypted at rest using platform-native data protection (e.g., iOS Data Protection)
• Access to production systems is restricted to authorised personnel with role-based access controls
• We do not maintain external databases of user information — user-created content remains on-device
• API keys and sensitive configuration are stored securely, never in application source code
• Third-party service providers are selected for their strong security and privacy practices

7. Third-Party Services

InnovaLabWorks products may integrate with the following third-party services. Data is shared with these services only as described:

• Cloudflare: DNS management, content delivery, Cloudflare Workers (API processing), and email routing.
• Brevo (formerly Sendinblue): Newsletter delivery and email communications. Data hosted in the European Union.
• Apple: StoreKit (subscription management), iCloud CloudKit (cloud sync and data backup), and MapKit (address autocomplete).
• Anthropic: AI-powered features via the Claude API. Data sent only when you explicitly initiate an AI feature.
• Porkbun: Domain registration and DNS hosting for our website. Registrar information is required by ICANN regulations.

8. International Data Transfers

Your data may be processed in jurisdictions outside of where you reside. When you use AI-powered features, data may be processed by Anthropic’s servers in the United States. When you submit a support form, data is processed by Cloudflare Workers, which may route through servers in various locations. Newsletter data is stored by Brevo in the European Union.

Where applicable, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions recognizing sufficient data protection levels in the receiving country
• Contractual commitments from our service providers to protect your data in accordance with applicable law

9. Your Rights Under Global Privacy Laws

Depending on where you reside, you may have specific rights regarding your personal data under the following frameworks:

If your jurisdiction is not listed above, you may still have rights under applicable local data protection laws. To exercise any of your rights, please use the contact form on our website or the support form within our apps. We will respond within the timeframe required by the applicable law (typically 30 days).

GDPR (European Union / EEA)

Right of access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, objection to processing, and rights related to automated decision-making and profiling.

UK GDPR (United Kingdom)

The same rights as under the EU GDPR, enforced by the Information Commissioner’s Office (ICO).

CCPA / CPRA (California, United States)

Right to know what personal information is collected, right to delete, right to opt out of the "sale" or "sharing" of personal information, and the right to non-discrimination. We do not sell or share your personal information.

CASL (Canada — Anti-Spam Legislation)

We obtain express consent before sending commercial electronic messages. Every message includes a clear unsubscribe mechanism that is honoured promptly.

Law 25 (Quebec, Canada)

Right to consent, access, rectification, de-indexation, data portability, and the right to be informed of automated decision-making.

PIPEDA (Canada — Federal)

Right to access your personal information, right to correction, right to challenge our compliance, and the right to withdraw consent.

LGPD (Brazil)

Right to confirmation of processing, access, correction, anonymisation, portability, deletion, information about shared data, and the right to revoke consent.

POPIA (South Africa)

Right to access, correction, deletion, and objection to the processing of your personal information.

PDPA (Singapore / Thailand)

Right to access, correction, data portability, and withdrawal of consent.

APPI (Japan)

Right to disclosure, correction, and cessation of use of your personal information.

Privacy Act 1988 (Australia)

Right to access and correction of your personal information.

PIPA (South Korea)

Right to access, correction, suspension of processing, and deletion of your personal information.

10. Data Retention

• App data: Stored locally on your device for as long as the app is installed. Uninstalling permanently removes all local data.
• Support communications: Retained for up to 2 years for quality assurance and follow-up purposes, then permanently deleted.
• Newsletter subscriptions: Retained by our email service provider until you unsubscribe or request deletion.
• AI processing: We do not retain copies of data sent to AI providers. Data is processed in real time and is not stored on our behalf.
• iCloud synced data: Your data synced to iCloud via CloudKit is retained on Apple’s servers as long as iCloud sync is enabled and the app is installed. Deleting your data via Settings → Delete My Data removes it from both your device and iCloud.

11. Children’s Privacy

Our products and services are not directed at children under the age of 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take prompt steps to delete that information.

Where required by applicable law, we will obtain verifiable parental consent before collecting personal information from individuals under the relevant age threshold.

12. How to Delete Your Data

You have the right to request complete deletion of all your personal data. Here is how:

• App data (CVs, cover letters, job applications, profile photos): Delete the app from your device. All locally stored data is permanently removed when the app is uninstalled.
• iCloud synced data: Use Settings → Delete My Data within the app to permanently delete all data from your device and from iCloud/CloudKit. You can also manage your iCloud storage through your device’s system settings.
• Newsletter subscription: Toggle off the newsletter in the app settings, or use the unsubscribe link in any email you have received from us.
• Complete deletion request: To request deletion of any data we may hold (support communications, newsletter records), submit a request via the contact form on our website with the subject "DELETE MY DATA" and include the email address associated with your request. We will process your request within 30 days.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices:

• Company: 9547-8715 Quebec inc. o/a InnovaLabWorks
• Address: 1027-1055 rue Lucien l’Allier, Montreal, QC H3G 3C4, Canada
• In-App: Use the built-in support form within any InnovaLabWorks app
• Website: Use the contact form at innovalabworks.com

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our products, practices, technology, or legal requirements. When we do, we will update the "Last Updated" date at the top of this page.

Continued use of any InnovaLabWorks product or service after changes have been posted constitutes your acceptance of the updated policy.

15. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the Province of Quebec and the federal laws of Canada applicable therein, without regard to conflict of law principles.

Nothing in this policy is intended to limit or waive any rights you may have under the mandatory data protection laws of your jurisdiction.

16. Severability

If any provision of this Privacy Policy is found to be invalid, unlawful, or unenforceable by a court of competent jurisdiction, the remaining provisions shall continue in full force and effect.

17. Entire Agreement

This Privacy Policy, together with our Terms of Service, constitutes the entire agreement between you and InnovaLabWorks regarding the collection, use, and protection of your personal information.

Part 2 — CURRIQ-Specific Terms

The following sections describe data practices specific to the CURRIQ: AI CV Builder iOS application. These terms supplement the general terms above.

18. Data Collected in CURRIQ

When you use CURRIQ, you may enter personal information into your CVs, cover letters, and job applications, including but not limited to:

• Your name, email address, phone number, LinkedIn URL, website, and mailing address
• Job title/headline and professional summary or objective
• Work experience, education history, skills, languages, and certifications
• Volunteer experience, awards, projects, professional memberships, references, and core competencies
• Profile photos (stored locally as base64-encoded JPEG, resized to 400×400 pixels)
• Cover letter content (company name, job title, full letter text)
• Job application tracking data (company names, applied dates, notes, linked cover letters)
• Per-CV language preference (English US, English UK, French Quebec, or French France)
• User preferences (display name, email, app language, color scheme)

19. AI-Powered Features

When you use AI-powered features in CURRIQ, portions of your CV data are transmitted to Anthropic’s Claude API (specifically the Claude Sonnet model) for processing. AI features include:

• Cover letter generation: Your CV data and a job description are sent to the API to generate a tailored cover letter
• CV content translation: CV text is sent for translation across 4 languages (EN-US, EN-GB, FR-QC, FR-FR)
• Professional summary generation and enhancement: Relevant CV sections are sent for AI-assisted writing
• CV bullet point enhancement: Individual work experience entries are sent for improvement
• Skills suggestions: Your job title is sent to generate relevant skill recommendations
• CV parsing: Uploaded PDF or image files are sent using vision capabilities to extract CV data

20. CV Parsing

The CV parsing feature allows you to upload an existing CV in PDF or image format. The uploaded file is sent via encrypted HTTPS to Anthropic’s Claude API, which uses vision capabilities to extract structured CV data. The extracted data is then stored locally on your device. We do not store or retain the uploaded file or the extracted data on our servers.

21. Address Autocomplete

When you enter an address in your CV, CURRIQ uses Apple MapKit to provide address autocomplete suggestions. Search queries are processed by Apple’s servers. We do not store or transmit address search data ourselves.

22. Data Storage & Cloud Sync

Your data is stored locally on your device and, when iCloud is enabled on your device, automatically synced to Apple’s iCloud infrastructure using CloudKit — Apple’s secure cloud database service. This sync allows your CVs, cover letters, credit balance, credit usage history, settings, and profile to be restored if you reinstall the app or switch devices.

Apple Inc. acts as a data processor on our behalf for all data synced to iCloud. Apple’s handling of this data is governed by Apple’s Privacy Policy and Apple’s iCloud Terms and Conditions. We do not have independent access to your iCloud data outside of the Curriq app.

iCloud sync requires you to be signed into an Apple ID on your device. If iCloud is disabled or unavailable, your data remains stored locally on your device only.

23. Data Deletion & Right to Erasure

You have the right to permanently delete all your data at any time from within the app (Settings → Delete My Data).

When you delete your data: all CVs, cover letters, job applications, and profile information are permanently deleted from your device AND from Apple’s iCloud/CloudKit database associated with your account. Any locally cached files, PDFs, and thumbnails are removed from device storage. This action is irreversible. Deleted data cannot be recovered.

If your device is offline at the time of deletion, local data is deleted immediately. The iCloud deletion will be completed automatically the next time your device connects to the internet.

24. Data Restoration

If you previously used Curriq and had iCloud sync enabled, you may restore your data after reinstalling the app by tapping “Restore from iCloud” on the language selection screen during first launch. This feature retrieves your data directly from your iCloud account and does not involve Curriq’s servers.

25. Subscription Data

Subscription purchases are processed entirely through Apple’s App Store and StoreKit 2 framework. We do not collect, process, or store any payment information such as credit card numbers, billing addresses, or financial data. We only verify your subscription status locally on your device via StoreKit.

Users may purchase additional Extra Credits as one-time in-app purchases. Extra credit purchase history is processed through Apple’s App Store. We do not collect or store any payment information for extra credit purchases.

26. Credit Usage History

CURRIQ maintains a log of your AI credit usage on your device. This includes the type of action performed (such as AI write, CV import, or translation), the number of credits consumed or refunded, and the date and time of each transaction. This data is stored on your device using Apple’s SwiftData framework and, when iCloud is enabled, automatically synced to iCloud via CloudKit alongside your other app data. Credit usage data is never transmitted to our servers.

The log is maintained solely to provide you with a transparent record of your credit usage within the App. Credit usage logs are automatically limited to the most recent 100 entries.

27. Support Forms

When you use the in-app Contact Support, Priority Support (Pro users), or Feature Wishlist forms, the following data is transmitted via encrypted HTTPS to our API:

• Your name and email address
• Subject/category and message content
• Basic device metadata: app version, device model, OS version, language preference

28. Newsletter

If you opt in to our newsletter (via the app settings or our website), the following data is shared with our email service provider, Brevo:

• Your name (first and last)
• Your email address
• An anonymous device identifier (UUID)
• Subscription source (app or website)
• Language preference

29. Explore Mode

Explore Mode allows you to browse CURRIQ and view templates without a subscription. No additional data is collected in Explore Mode beyond what is described elsewhere in this policy.

30. AI Usage Limits & Rate Limiting

To ensure fair usage and prevent abuse, AI feature usage is subject to rate limits. AI generation timestamps and usage counters are stored locally on your device in UserDefaults. This data is not transmitted to our servers. Rate-limit data is automatically cleared when usage windows reset.