Privacy Policy

Last updated: 27 October 2026

1. Who We Are

Speak2MyCV is operated by Bong Innovations Pvt Ltd (OPC), a company incorporated under the Companies Act, 2013, registered with the Ministry of Corporate Affairs (MCA), India. Website: speak2mycv.com.

2. What We Collect

• Account data: Name, email address, phone number
• CV/resume data: Documents and text you upload for processing
• Usage data: IP address (stored only as a salted hash, never raw), coarse location (country, derived from your network), browser type, pages visited, time spent
• Payment data: Processed by third-party payment gateways. We do not store card details
• Cookies: Session and persistent cookies for authentication and analytics on speak2mycv.com and your dashboard (see Visitors to member pages below for the exception)

2A. Visitors to Member Pages

When you visit a member's public page (an AI page or website hosted by us, including on the member's own domain), we count the visit without cookies or any storage on your device. We record: which page, the referring website's domain only (e.g. google.com, never the full address), any campaign tag in the link, your country (derived from your network), and a one-way code made from your IP address and browser that changes every day, so the same person cannot be recognised from one day to the next. We never store your raw IP address or browser details. Known search-engine and AI crawlers are not counted. The page owner sees totals only (number of visits and where they came from), never individual visitors. Google Tag Manager and other third-party analytics do not run on member pages.

2B. Member Pages in Search Engines

A member's public pages (their AI page, website and MCP page, including on the member's own domain) are indexed by search engines by default. Unless the member switches this off, we let search engines such as Google and Bing, and AI search tools, crawl these pages, and we list them in our sitemap, so they can appear in search results. What can be indexed is only what the member chose to publish: the page text built from their CV, their name, headline and photo, and the contact details they chose to show on the page. A page whose text contains a raw email address, phone number or government ID is kept out of search.

• Your choice: you decide at signup ("Enable SEO", on by default) and can switch it off or back on at any time in your dashboard under Your AI Page → Show up in search.
• When off: your page stays live for anyone with the link, but it tells search engines not to index it (noindex) and is removed from our sitemap.
• Removal takes time: search engines and AI tools are independent of us. Once indexing is off, pages usually drop out of their results within days to a few weeks, and we cannot control copies they have already made.
• Never indexed: your uploaded documents, private share links, your dashboard, and visitor conversations.

2C. Speak2MyCV Plugin and Speak2MyMCP Connections

When you use our plugin in ChatGPT, Codex or another MCP client, we receive only the tool inputs you choose to send, such as a professional's handle, your career question, or your enquiry. We do not request or retrieve your full AI conversation. Profile reads may be anonymous; sending an enquiry requires explicit OAuth consent for your name and email. Access tokens are verified for the intended MCP resource and are not stored in enquiry records or usage logs.

Professionals must publish their profile and switch on AI Connections before our MCP tools expose it. Switching this off stops subsequent tool requests, including for the founder profile. We do not cache MCP profile responses or answers. AI clients and recipients may retain information already returned; switching off cannot withdraw those copies.

Before an enquiry is sent, the plugin previews the recipient, your verified account name and email, and the exact message (including your company only if supplied). Sending requires your confirmation. We store the confirmed enquiry in the professional's inbox and queue notifications through Resend and, when configured, their webhook or CRM integration. Your name, email and message are shared with that recipient and their configured integration. We score enquiries Hot, Warm or Cold to help that professional prioritize responses; scoring is not an employment or eligibility decision. An AI service may draft a reply for the professional to review.

MCP operational records include the tool name, outcome, time, target handle/workspace, a salted one-way hash of the transport IP and user-agent, and the OAuth caller ID when signed in. We do not store the raw IP, raw user-agent, access token, question or enquiry body in these MCP event records. The hash supports rate-abuse investigation and aggregate usage counts; it can link calls from the same transport. We delete events older than 90 days through our scheduled worker. You can stop sending requests, disconnect the plugin, revoke OAuth access, or contact us to request access or erasure. Enquiries remain in the recipient's account until deleted or that account is removed; copies already delivered to email or a recipient-controlled integration cannot be recalled by us.

3. How We Use It

• Provide and improve the Service
• Process subscriptions and manage your account
• Respond to support queries
• Send transactional and service-related communications
• Comply with legal obligations under Indian law (IT Act 2000, DPDP Act 2023)

Purpose limitation: your CV/document data is used to provide the AI page and, when you enable AI Connections, to answer requests through the Speak2MyCV plugin and Speak2MyMCP. We never use it for marketing, nor to train AI models, without separate explicit consent.

4. Data Sharing

We do not sell your data. We share data only with:

• Hosting: Railway, Google Cloud, Azure
• AI: Anthropic, NVIDIA, OpenRouter, Jina
• Voice (Mira): Deepgram, ElevenLabs, Sarvam
• Sign-in and OAuth authorization: Clerk
• Enquiry delivery: Resend and the professional you choose to contact, including their configured webhook or CRM provider
• AI client: the ChatGPT, Codex or other MCP client you choose receives the tool results; its own data practices also apply
• Payments: Stripe, Razorpay, PhonePe (for subscription billing; they never see your CV)
• Analytics: Google (Tag Manager and Analytics, on speak2mycv.com and the member dashboard only, never on member pages)
• Legal authorities when required by law

All processors act only on our instructions.

5. Data Retention

MCP event records are retained for up to 90 days, with deletion performed by the scheduled worker. Confirmation receipts expire after ten minutes; only a one-way receipt hash is retained with a submitted enquiry to prevent duplicate sends. Enquiry retention and copies held by recipients are described in section 2C.

We retain personal data for the duration of your subscription plus 90 days after account closure, unless a longer period is required by law. Visit records on member pages (section 2A) are deleted after 90 days.

6. Your Rights

Under the Digital Personal Data Protection Act, 2023 (DPDP Act), you have the right to access, correct, and request erasure of your personal data. You can export or delete your data yourself at any time from your dashboard. For anything else, write to ceo@speak2mycv.com.

7. Security

We use commercially reasonable technical and organisational safeguards. No internet transmission is 100% secure.

8. Children

The Service is not directed to anyone under 18. We do not knowingly collect data from minors.

9. Changes

Material changes will be notified via email or prominent notice on the Site before they take effect.

10. Governing Law

This policy is governed by the laws of India. Disputes are subject to the exclusive jurisdiction of courts in West Bengal, India.

11. Cross-Border Transfer

Your data is processed mostly in the United States, with some voice processing in India. By using the Service you acknowledge your data is transferred to and processed on servers abroad. We use processors that apply industry-standard safeguards (encryption in transit and at rest).

12. Grievance Officer

Bong Innovations Pvt Ltd (OPC) · MCA Registered · West Bengal, India