Privacy Policy

Welcome to Profilix (“Profilix,” “we,” “our,” or “us”), a cloud-native career workstation and developer portfolio engine operated by VeriqLabs Inc.This Privacy Policy articulates our rigorous standards and transparent practices regarding the collection, storage, encryption, processing, and transfer of personal and telemetry information when you interact with the Profilix platform, application endpoints, APIs, and associated web properties (collectively, the “Platform”).

As software engineers ourselves, we maintain an uncompromising commitment to user privacy and data sovereignty. Profilix adheres strictly to global data protection standards, including the General Data Protection Regulation (GDPR) within the European Economic Area, the UK-GDPR, the California Consumer Privacy Act (CCPA/CPRA), and relevant international privacy frameworks.

If you have questions, inquiries regarding this policy, or wish to exercise statutory data rights, you may reach our dedicated Privacy & Security Desk directly at support@veriqlabs.com.

We only collect data strictly necessary to furnish the career tooling, portfolio hosting, resume compilation, and analytics services you intentionally configure on Profilix:

• Account Credentials & Identity: When you register an account, we record your email address, full name, hashed password (salted via bcrypt), and chosen username/handle. If signing in through third-party authentication (e.g. GitHub OAuth or Google OAuth), we receive your verified email, display name, and avatar image.
• Professional Profile Data: Information you voluntarily populate inside the Profile Studio, including professional headlines, summaries, employment history, educational background, project repositories, technical skills, certifications, custom URLs, and social profile links.
• GitHub Public Telemetry: When you connect your GitHub handle or sync your developer stats, we retrieve publicly exposed metrics via GitHub's REST and GraphQL APIs. This includes public repository counts, star counts, top languages by byte volume, and contribution activity. We do not access, clone, or read the source code of private repositories without explicit, granular OAuth permission scopes.
• Uploaded Artifacts & Resumes: Source files you upload for document parsing or portfolio embedding (e.g., existing PDF or DOCX resumes, avatar graphics, project screenshots). Uploaded media is securely hosted via encrypted Cloudinary CDN storage with automated sanitization.
• Payment & Transaction Information: Subscription upgrades, Pro Lifetime passes, and recurring memberships are processed via PCI-DSS Level 1 certified payment processors (Razorpay and Polar.sh). Profilix never receives, stores, or processes raw credit card numbers or CVV codes on our own application servers.
• Platform Analytics & Telemetry: Anonymized interaction logs such as portfolio page views, QR code scans, resume downloads, country-level geolocation derived from IP addresses, referring domains, and browser user-agent tokens to furnish your dashboard analytics.

Profilix offers optional intelligent features, including automated bullet point enhancement, ATS keyword matching, and targeted cover letter generation powered by state-of-the-art Large Language Models (including Google Gemini and OpenAI enterprise API endpoints).

Our agreements with underlying AI cloud providers mandate stateless API inference:

• Zero Training Guarantee: Your resumes, career history, project notes, and job descriptions submitted to our AI features are never utilized to train, retrain, or improve public AI models.
• Zero Persistence: Prompts sent to model endpoints are held in transient memory solely for the seconds required to synthesize the response, after which they are purged according to enterprise zero-retention guidelines.
• User Control: AI enhancements are completely opt-in. You retain 100% control over whether to accept, reject, or edit any generated suggestions prior to saving or publishing.

We leverage collected data strictly for legitimate operational purposes:

• Hosting & Portfolio Rendering: Dynamically serving your selected portfolio archetype (from 39 bespoke architectures) across your public handle (profilix.site/u/username) or custom vanity subdomain (subdomain.profilix.site).
• Document Compilation: Dynamically compiling ATS-compliant PDF and DOCX resumes, JSON resume interchange files, and personalized cover letters using our precision typography engine.
• Mobile & Social Asset Generation: Generating high-resolution QR codes, phone lock-screen networking cards, and OpenGraph social banner cards.
• Telemetry & Analytics: Compiling aggregated, real-time analytics on your profile reach, link conversions, and resume downloads in your private workspace dashboard.
• Customer Support & Reliability: Diagnosing service errors, resolving support tickets submitted to our Helpdesk, and alerting you to crucial account or billing updates.

The core mission of Profilix is to showcase your professional credentials to recruiters, engineering leaders, and peers. Consequently, when you publish a portfolio and claim a subdomain:

• Public Visibility: Information included in your active profile (e.g., name, headline, projects, links, selected portfolio archetype) becomes accessible on the public Internet via your standard handle or assigned subdomain.
• Private Information: Your account password, billing invoices, support ticket correspondence, email address (unless you explicitly choose to show it in your public contact card), and internal draft documents are strictly kept private and inaccessible to public visitors.
• Immediate Unlink: You can disconnect your custom subdomain at any time directly in your Portfolio Workspace, which instantly de-links the live subdomain.

Profilix does not sell, rent, monetize, or trade your personal data, resumes, or contact details to third-party data brokers, marketing agencies, or recruiters.

We share data solely with trusted, enterprise infrastructure sub-processors under strict Data Processing Agreements (DPAs):

• Cloud Infrastructure & Edge: Vercel (frontend deployment, edge caching) and Railway/AWS (secure backend compute).
• Database Storage: Managed PostgreSQL running automated daily encrypted backups and strict network isolation.
• Media CDN: Cloudinary (encrypted media delivery for profile images and generated PNG QR assets).
• Billing & Merchant Infrastructure: Razorpay and Polar.sh (PCI-DSS compliant payment processing, global currency and tax handling).
• Legal Compulsion: We will only disclose personal data if required by enforceable subpoena, court order, or applicable law, after providing you prior notification where legally permissible.

We retain your profile data and generated assets for as long as your account remains active. You maintain total sovereignty over your data lifecycle:

• Data Export: You may request a complete machine-readable export (JSON format) of your entire profile data, work history, and project configuration at any time from your account settings.
• Permanent Account Deletion (Right to Be Forgotten): When you request account deletion through your dashboard or via email, our system executes an automated cascade deletion. This permanently purges your user record, profile metadata, resume documents, QR code records, custom subdomain allocations, and hosted media files within 72 hours.
• Backup De-identification: Residual encrypted database backups automatically overwrite and expire within 30 days.

Profilix extends comprehensive privacy rights to all registered users globally, conforming to GDPR (Articles 15–22) and CCPA/CPRA standards:

• Right of Access: The right to obtain confirmation and copies of personal data processed by us.
• Right to Rectification: The right to instantly amend inaccurate or incomplete career and profile data.
• Right to Erasure: The right to demand permanent deletion of your data (“Right to Be Forgotten”).
• Right to Data Portability: The right to receive your personal data in a structured, commonly used format.
• Right to Object & Restrict: The right to object to automated processing or request processing restrictions.
• Non-Discrimination: We will never deny services, alter pricing, or degrade quality if you exercise any privacy right.

To exercise any statutory right, submit a verified request to support@veriqlabs.com. We respond to all verified requests within thirty (30) calendar days.

The security of your engineering portfolio and personal documents is paramount. We deploy defense-in-depth security architectures:

• Encryption in Transit: All data transmitted between your browser, our edge network, and our backend microservices is encrypted using modern TLS 1.3 protocols with HSTS enforcement.
• Encryption at Rest: Database volumes and storage buckets are encrypted using industry-standard AES-256 algorithms.
• Credential Security: Passwords are cryptographically salted and hashed using adaptive bcrypt with high work factors. Raw credentials are never logged or visible to operators.
• API Hardening: Distributed Denial of Service (DDoS) mitigation, intelligent Web Application Firewalls (WAF), and strict Redis-backed rate-limiting on sensitive endpoints.

We may update this Privacy Policy from time to time to reflect platform improvements, new features, or legislative changes. When material modifications occur, we will provide prominent notice via email dispatch or a persistent banner in your workspace dashboard prior to the effective date.