Last updated: July 13, 2026
Who is responsible
Vantage is operated by Ishvir Chopra and built for Canadian users. We handle personal information under Canada’s PIPEDA (Personal Information Protection and Electronic Documents Act). What we collect and why is described in the Privacy Policy; this page describes how we protect it and how you stay in control.
How your data is protected
- •Every database record is tied to your account with per-account access rules enforced by the database itself - one user can never read another user’s rows.
- •Resume files live in private storage: access rules only allow the uploading account to read its own files, and download links are short-lived.
- •All traffic is encrypted in transit (HTTPS), and our hosting providers encrypt data at rest.
- •Passwords are stored as secure hashes we cannot read; card data is held by Stripe only.
- •Administrative access is limited to the operator, and admin actions never expose resume contents or documents.
- •AI requests are sent server-side with only the text the feature needs - our AI keys and your data never pass through the browser of another user.
We do not currently hold formal certifications like SOC 2 - we are a small product and say so plainly. Our infrastructure providers (Supabase, Vercel, Stripe, Google) maintain their own audited compliance programs.
AI processing
- •All AI features run on Google’s Gemini API - a single provider.
- •Your resume and application data are not used to train AI models - not by us, and not by Google under its paid API terms.
- •The experimental Resume Studio never stores your resume server-side: the file is read once in memory and the working copy lives only in your browser tab.
Subprocessors
These are the services that process data on our behalf:
Your controls
- •Access and correction - most of your data is visible and editable in the app; email us for a copy of anything else.
- •Reset my data (Settings) - wipes your resumes, jobs, documents, applications, and history while keeping the account.
- •Delete account (Settings) - full erasure of the account and everything in it, completed within 30 days.
- •Email opt-out - a Settings toggle plus a one-click unsubscribe link in every product-update email.
- •Data export - not self-serve yet; email us and we will provide your data manually.
If something goes wrong
If a breach ever puts your personal information at real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada without undue delay, as PIPEDA requires, and tell you plainly what happened and what we are doing about it.
Questions
Contact ishvir.chopra@gmail.com or use the feedback page for anything about data handling, including access, correction, or export requests.