Privacy Policy

Account information. Your email address, name and sign-in credentials (email/password or Google sign-in).

Profile information. Details you choose to add, such as your career persona (Builder, Creative or Academia), education, work history, skills and interests, used to match you with opportunities.

Documents and content you upload. CVs, essays, personal statements, application drafts, answers to Coach questions and any files you save to your document vault.

Payment information. When you buy a plan or top-up, payment is processed by Stripe. We never see or store your full card number; we store only your plan status, billing period and transaction references.

Usage information. Pages you visit, features you use, credits used, and technical data such as device, browser and approximate location derived from your IP address.

• To provide the service: matching you with opportunities, tracking applications, generating documents and giving Coach's Feedback.
• To process payments, manage your plan and enforce plan allowances.
• To improve and secure the service, including debugging, analytics and fraud prevention.
• To send service emails (sign-in links, receipts, account notices). We do not send marketing emails without your consent.
• To meet legal obligations, such as tax and accounting records.

We do not sell your personal information, and we do not use your uploaded documents to train AI models for other customers.

We disclose information only to the service providers that run Chombo, each under a data processing agreement, and only the data each one needs:

• Stripe: payment processing, tax, fraud and dispute handling. Your payment details are transmitted directly to Stripe over an encrypted connection; see stripe.com/privacy.
• Lovable Cloud (hosting, database and authentication): stores your account, profile, documents and application data on encrypted infrastructure.
• AI model providers: when you run a generator or Coach's Feedback, the relevant document text and your answers are sent to the AI provider to produce the result. Prompts are not used to train their models.
• Email delivery providers: to deliver sign-in and transactional emails to your address.

We may also disclose information if required by law, to enforce our Terms of Service, or to protect the rights and safety of our users. If Chombo is ever sold or merged, your information may transfer to the new owner under the same protections.

• All traffic is encrypted in transit using TLS (HTTPS).
• Data is encrypted at rest in our hosted database.
• Row-level security ensures each account can only access its own data.
• Passwords are never stored in plain text; authentication is handled by our managed auth provider.
• Card details are handled entirely by Stripe and never touch our servers.
• Access to production data is limited to authorised personnel and logged.

No method of transmission or storage is 100% secure, but we follow industry-standard practices and will notify affected users of any personal data breach as required by law.

We keep your account and content while your account is active. Payment and transaction records are kept for the period required by UK tax law (typically 6 years). You can delete your account at any time by contacting us; we then delete or anonymise your personal data within 30 days, except where we must retain it by law.

You have the right to:

• Access a copy of the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data ("right to be forgotten").
• Object to or restrict certain processing.
• Receive your data in a portable format.
• Complain to the Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, email support@usechombo.com. We respond within 30 days.

We use essential cookies to keep you signed in and remember your preferences, and privacy-respecting analytics to understand how the site is used. We do not use advertising or cross-site tracking cookies.

Chombo is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

We may update this policy from time to time. Material changes will be announced on this page with a new "last updated" date, and continued use of Chombo after changes means you accept the updated policy.