Privacy Policy

MyCareerShift ("we", "us", "our") is operated from Bulgaria, a member state of the European Union. We are committed to protecting your personal data in accordance with the EU General Data Protection Regulation (GDPR — Regulation 2016/679) and the Bulgarian Personal Data Protection Act.

This policy explains what personal data we collect, how we use it, who we share it with, how long we keep it, and what rights you have over it.

For any questions or data-related requests, contact us at sophie@mycareershift.ai.

MyCareerShift is operated by FLIPPY EOOD (ФЛИППИ ЕООД), a company registered in Bulgaria, which is the data controller for all personal data collected through mycareershift.ai.

• Company ID (EIK): 208806020
• Registered address: Bulgaria, Silistra 7500, 1 Petar Boyadzhiev St.
• Contact: sophie@mycareershift.ai

For a plain-language summary of your rights and how to exercise them, see our GDPR & Data Rights page.

We only process your personal data where we have a lawful basis to do so under Article 6 of the GDPR:

• Intake form data — Legitimate interest (Art. 6(1)(f)). You voluntarily provide this data for the specific purpose of receiving a personalized career strategy analysis. We process it solely to generate your report.
• Email address — Performance of a contract (Art. 6(1)(b)). We use your email to deliver purchased reports and send transaction confirmations.
• Payment data — Performance of a contract (Art. 6(1)(b)). Processed by Stripe as a separate data controller under their own privacy policy.
• Follow-up emails — Legitimate interest. We may send a limited sequence of emails about our reports. Every email includes an unsubscribe link.

• To generate your free preview and paid career strategy reports
• To deliver reports via our website and by email
• To send transaction confirmations and report delivery emails
• To send a limited email sequence about our reports (maximum 5 emails), with an unsubscribe option in every message
• To improve our report quality — we may analyze aggregate, anonymized patterns across submissions

AI processing and profiling. To provide the service we analyze the information you submit using large language models (Anthropic Claude) to generate your reports, Readiness Scores, plans, interview feedback, and chat responses. This constitutes profiling in the GDPR sense (automated analysis of personal aspects to produce personalized content). It does not constitute automated decision-making with legal or similarly significant effects under Article 22 GDPR: the outputs are informational content delivered only to you, at your request; no decision about you is made or communicated to any third party. If you believe any output misrepresents you, contact sophie@mycareershift.ai and a human will review it.

Please do not enter special-category data (for example health, religious, or political information) into the intake form or chat — the service does not request it and does not need it.

We use the following sub-processors to operate our service. Each is bound by a data processing agreement and appropriate safeguards:

When your intake data is sent to Anthropic for report generation, it is used solely to produce your report. We do not opt into training data sharing with any AI provider.

• Intake data and reports — Stored indefinitely so you can return to read your reports at any time. You may request deletion at any time (see Section 8).
• Payment records — Retained for 7 years as required by Bulgarian tax and accounting law.
• Email logs — Retained for 2 years for delivery verification.
• After a deletion request — Your intake data, reports, and user account are deleted within 7 business days. Payment records are retained as required by law, with personal identifiers minimized where possible.

You have the following rights regarding your personal data:

• Access (Art. 15) — Request a copy of all personal data we hold about you.
• Rectification (Art. 16) — Request correction of inaccurate or incomplete data.
• Erasure / Right to be forgotten (Art. 17) — Request deletion of your personal data.
• Restriction (Art. 18) — Request that we limit how we use your data in certain circumstances.
• Data portability (Art. 20) — Receive your data in a structured, machine-readable format.
• Object (Art. 21) — Object to processing based on legitimate interest.
• Withdraw consent — Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email sophie@mycareershift.ai. We will respond within 30 days as required by GDPR.

Some of our processors are based in the United States. Where personal data is transferred outside the European Economic Area, we ensure that appropriate safeguards are in place, including:

• The EU-US Data Privacy Framework (where applicable)
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Equivalent legal mechanisms under Chapter V of the GDPR

• All data is encrypted in transit using TLS/HTTPS.
• Database access is restricted to authenticated server-side operations only.
• Previews and reports are readable only from the browser that created the intake or by the signed-in account that purchased them; a link by itself grants no access.
• We use Supabase Row Level Security and service role keys for data access control.
• Payment data is handled entirely by Stripe, which is PCI DSS Level 1 certified.
• We do not store credit card numbers, CVVs, or full payment details.
• Access to production systems is restricted to authorized team members.

Our service is offered to adults only and is not directed at individuals under 18 years of age (see Terms, Section 1). The intake form rejects an age below 18, and every checkout asks you to confirm you are 18 or older. We do not knowingly collect personal data from anyone under 18, and in no case from children below the Bulgarian digital-consent age of 14. If you believe a minor has submitted data through our service, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. When we do, the updated version will be posted on this page with a revised date. Material changes that significantly affect your rights will be communicated more prominently.

Continued use of our service after changes are published constitutes acknowledgment of the updated policy.