Effective date: 9 July 2026 · Last updated: 10 August 2026

This Privacy Policy explains how B&H TRINITY TECH PTE. LTD. (“The Chair Across”, “we”, “us”), the operator of thechairacross.ai (the “Service”), collects, uses, discloses and protects your personal data. We are established in Singapore and comply with the Personal Data Protection Act 2012 (Singapore) (“PDPA”). By using the Service you consent to the practices described here.

Data controller: B&H TRINITY TECH PTE. LTD., a company incorporated in Singapore. Data Protection Officer: The Founder — privacy@thechairacross.ai (contactable during Singapore business hours). You may direct any question, access/correction request, complaint, or consent withdrawal to this address.

(a) Account data. Email address, display name, and your sign-in method (Google, LinkedIn, or email magic link). We never receive or store passwords — authentication is passwordless or handled by your chosen provider.

(b) Career documents you provide. Job descriptions you paste or upload; CVs/resumes you paste or upload (PDF, DOCX, or text); any additional context you supply.

(c) Career Highlights and profile data (Resume Studio). Structured achievements extracted from your CV by our AI (which you may confirm, edit, reject or delete), achievements you add yourself, and profile details (roles, education, certifications, languages, skills, and — only if you choose to confirm them — contact details for CV export).

(d) Generated content. The outputs the Service creates for you: readiness scores, interview questions and model answers, scoring rubrics, gap analyses, ATS reports, and generated CVs.

(e) Payment data. Payments are processed by Stripe. We receive and store transaction records (amount, product, timestamps, payment status, last-4/card brand as provided by Stripe) but never your full card number, CVC, or banking credentials.

(f) Technical and usage data. IP address (stored only as a salted one-way hash, for rate limiting and abuse prevention), browser/device information, session cookies, and first-party product-usage events (e.g., page views, feature usage, purchases). We do not use third-party advertising trackers.

(g) Communications. Emails you send us, and records of emails we send you.

We collect, use and disclose personal data to: (i) provide the Service — including sending your job description, CV, Career Highlights and related context to our AI provider to generate your prep materials and CVs; (ii) create and administer your account and credit balance; (iii) process payments, refunds and receipts; (iv) send transactional and service emails (results ready, receipts, security notices) and, with an unsubscribe in every message, limited product emails such as reminders about incomplete purchases; (v) secure the Service (rate limiting, bot prevention via Cloudflare Turnstile, fraud prevention); (vi) understand aggregate product usage and improve the Service; (vii) comply with legal obligations; and (viii) establish, exercise or defend legal claims. We do not use your data for purposes a reasonable person would consider inappropriate in the circumstances, and we will notify you and seek consent for any materially new purpose.

The Service is AI-powered. To generate your materials, your job description, CV, confirmed Career Highlights and related inputs are transmitted securely to our AI providers and processed by their models. Depending on the feature, that provider is Anthropic, PBC (USA) (Claude models) or Google LLC (USA) (Gemini models); both receive the same kinds of document content, and neither trains on it under the terms we contract on. Outputs are generated by AI and returned to us for delivery to you. AI outputs may contain errors; they are drafts for your review, not statements of fact (see the Terms of Use for related disclaimers). Extraction of Career Highlights from your CV is an automated process whose results you review and confirm — no decision producing legal or similarly significant effects about you is made solely by automated means.

We disclose personal data only to service providers who process it on our behalf under contractual protections, only as needed to run the Service:

We may also disclose personal data where required by law, regulation, court order or governmental request; to protect our rights, users, or the public; or in connection with a business transfer (in which case this Policy continues to apply and you will be notified).

Some providers above process data outside Singapore. In accordance with the PDPA’s Transfer Limitation Obligation, we transfer personal data overseas only under arrangements ensuring a standard of protection comparable to the PDPA — including the providers’ data processing agreements and standard contractual protections, encryption in transit, and (for career documents and generated content) encryption at rest under keys we control.

No method of storage or transmission is perfectly secure; we cannot guarantee absolute security, but we apply protection proportionate to the sensitivity of career data.

Your account data, career documents, Career Highlights and generated content are retained until you delete them or delete your account. Individual items (highlights, documents) can be deleted in-product at any time. When you delete your account, your career documents, highlights, profile and generated content are purged within 30 days; limited records we must keep are retained only as required — e.g., payment/transaction records for tax and accounting (retained up to 7 years per Singapore requirements) and security logs containing hashed identifiers (up to 12 months). Backups containing deleted data are overwritten on a rolling cycle of no more than 30 days. We may retain anonymised, aggregated statistics that no longer identify you.

Under the PDPA you may: access the personal data we hold about you and how it has been used or disclosed within the past year; correct errors or omissions; withdraw consent to collection, use or disclosure (with reasonable notice — we will explain the consequences, which may include closure of your account where the data is necessary to provide the Service); and delete your data via the in-product account deletion (Dashboard → Delete account) or by writing to privacy@thechairacross.ai. We respond to access and correction requests as soon as practicable and within any timelines prescribed by the PDPA; we may charge a reasonable fee for access requests where permitted. You may also lodge a complaint with the Personal Data Protection Commission (pdpc.gov.sg), though we would welcome the chance to resolve any concern first.

We use strictly necessary cookies (session authentication, security) and first-party analytics events tied to your session/account to operate and improve the Service. We use browser localStorage for interface preferences (e.g., collapsed panels). We do not use third-party advertising cookies. Cloudflare Turnstile may set cookies solely for bot detection. Blocking necessary cookies will prevent sign-in.

We send service and transactional emails as part of operating the Service. Non-essential emails (e.g., a reminder about an incomplete purchase or an unfinished prep pack) are limited, include a one-click unsubscribe, and stop when you opt out. We do not send telemarketing messages to Singapore telephone numbers and do not engage in unsolicited telephone marketing.

The Service is intended for working professionals and is not directed at persons under 18. We do not knowingly collect personal data from anyone under 18; if you believe a minor has provided data, contact privacy@thechairacross.ai and we will delete it.

We maintain an incident-response process. If a data breach occurs that is notifiable under the PDPA (likely significant harm to affected individuals, or affecting 500 or more individuals), we will notify the PDPC as soon as practicable and no later than 3 calendar days after assessing the breach to be notifiable, and will notify affected individuals as required, with clear information about what happened and protective steps to take.

The Service may link to third-party sites (e.g., job postings you reference). Their privacy practices are their own; this Policy does not cover them.

We may update this Policy from time to time. Material changes will be notified via the Service or email before taking effect, with the “Last updated” date revised. Continued use after the effective date constitutes acceptance.

Privacy questions, PDPA requests, complaints: privacy@thechairacross.ai (Data Protection Officer: The Founder), B&H TRINITY TECH PTE. LTD., Singapore.