Who operates this site
CareerSpark is an independent career-tools website. The site operator is responsible for personal data processed through the website. The operator can be contacted through the contact form. Before operating commercially or enabling advertising, the operator should add their legal identity and postal or other contact details wherever required by applicable law. This public project currently does not identify a registered company.
Text entered into the tools
The cover-letter, resume-bullet, and interview tools build prompts in your browser. The job-keyword checker compares text in your browser. The website code does not send the text you enter in those tools to a CareerSpark server, and the site does not store it. Avoid entering unnecessary sensitive personal data.
If you copy generated prompts or other information into an AI assistant or another third-party service, that service will process the information under its own terms and privacy policy. CareerSpark does not control that service's retention or model-training practices.
Contact-form information
If you use the contact form, the site processes your name, email address, message, a hidden anti-spam field, and the technical request information needed to deliver the message and prevent abuse. Please do not submit passwords, payment details, identity documents, health details, or confidential work material.
When the form is enabled, Cloudflare Pages Functions validates the request and forwards the name, reply email, and message to FormSubmit for delivery to the site operator. The recipient address is held in a Cloudflare secret and is not included in the public page source. Cloudflare Turnstile is used to verify the submission is not automated. The Turnstile widget may process browser, device, network, and interaction signals for fraud and abuse detection. FormSubmit and Cloudflare process information under their own terms and privacy notices; see Cloudflare’s privacy policy and FormSubmit’s privacy information.
Rate limiting and technical logs
To limit contact-form abuse, the server uses the visitor IP address supplied by Cloudflare to create a keyed HMAC identifier. The identifier and a submission counter are stored in Cloudflare KV for a short-lived rate-limit window (up to approximately 65 minutes). The raw IP address is not written to that KV key by this code. Cloudflare itself may process IP addresses, request metadata, and security events as part of its network, hosting, and anti-abuse services; its own logs and retention rules apply.
The contact endpoint limits requests to five contact requests per IP-based key in an hourly window. This is a best-effort anti-abuse limit; KV is eventually consistent, so it is not a strict accounting or security boundary. Turnstile, input validation, a honeypot, request-size limits, and same-origin checks provide additional layers.
Retention
The rate-limit records expire automatically after the short window. FormSubmit's published documentation states that it retains submissions for 30 days; check FormSubmit's current help page for current details. Once delivered, messages may remain in the site operator's email account according to that provider's settings and the operator's deletion practices. The operator should delete messages when they are no longer needed, subject to any legal retention obligations.
Purposes and legal basis
Contact information is used to reply to your message, operate the contact channel, and prevent spam or abuse. Where the EU/EEA General Data Protection Regulation applies, the intended legal basis for ordinary inquiries and security measures is the operator's legitimate interest in answering requests and protecting the service; where you ask for pre-contractual steps, that basis may instead apply as appropriate. The site operator must confirm the applicable basis for their actual circumstances before commercial operation.
Processors and international transfers
Cloudflare provides hosting and anti-abuse infrastructure. FormSubmit provides contact-message delivery. These are third-party services with their own terms, privacy policies, subprocessors, and data-location arrangements. Depending on their current configuration, information may be processed outside your country or the EEA. Review their current documentation and appropriate transfer safeguards before relying on the services for sensitive information.
Your choices and rights
Where data-protection law applies, you may have rights to request access, correction, deletion, restriction, or objection, and in some circumstances data portability. Use the contact form to contact the site operator about a request. You may also complain to your competent data-protection authority; in Norway, this is Datatilsynet. Rights and response requirements depend on the applicable law and circumstances.
Cookies, analytics, and advertising
As of the date above, this project contains no analytics code and no active advertising tags. If analytics, affiliate tracking, AdSense, or other advertising tools are added, this policy and the consent experience must be updated before those tools are activated. For personalised advertising to people in the EEA, UK, and Switzerland, Google requires publishers to use a Google-certified consent management platform integrated with the IAB Transparency and Consent Framework; check current Google requirements before enabling ads.
Children
The tools are intended for people researching jobs and preparing applications, not specifically for children. Do not knowingly send personal information about a child through the contact form.
Security
The website uses HTTPS, response security headers, server-side input validation, request-size limits, same-origin checks, spam detection, and short-lived rate limiting. No internet service can guarantee absolute security. Keep messages and any personal information you receive secure and remove them when they are no longer required.
Changes to this policy
This policy may be updated when site features, service providers, or legal requirements change. The “Last updated” date above will be revised when material changes are made.
This policy is written for the current implementation, not as legal advice or a guarantee of compliance. The site operator must confirm the legal identity, applicable jurisdiction, processing purposes, and vendor arrangements before monetisation or broader commercial launch.