Privacy notice

Effective date: 19 July 2026

Who We Are

NextMove Studio is currently operated by Jimmy Leung in Hong Kong. This notice will be updated if a company becomes the legal service operator.

Privacy requests may be sent to privacy@nextmovestudio.co. This address must be verified before the Voice service accepts public uploads.

Information Collected

Depending on the service, we may collect your name, contact details, email address, account and session records, Career Profile, CV, LinkedIn export or profile information, target role, job requirements, application progress and structured outcome, generated CV and cover letter, career context, interview answers, audio, transcript, feedback report, support messages, consent choices, device and security records, and Stripe payment confirmation. Stripe handles payment-card details; NextMove Studio does not require your full card number.

Resume And Job-Post Import

When you use resume import, the selected PDF, DOCX, or text file is sent to the service for immediate text extraction. The import endpoint does not intentionally retain the original file. Extracted values remain an editable draft and are not added to your saved Career Profile until you review, confirm, and submit them.

When you import a public job-post URL, the service retrieves the public page and may follow a limited number of redirects to extract an editable role draft. Imported page content is not automatically saved as a target role. You must review the source, accuracy, and right to use the information before submitting it.

How Information Is Used

We use information to authenticate you, deliver career and interview services, generate requested materials, show your private application funnel and deterministic next action, manage payments and entitlements, provide support, secure the service, prevent misuse, meet legal obligations, and process access, correction, export, or deletion requests.

Account And Social Sign-In

You may sign in with an email magic link or, when available, Google or LinkedIn sign-in. Social sign-in requests OpenID scopes for a provider-verified email address, basic identity, and profile display information. We use the verified email to create or locate your NextMove Studio account and transform the provider's stable member identifier into a keyed, non-reversible HMAC for account linking. We do not store social-provider access, refresh, or ID tokens after sign-in.

Using Google or LinkedIn sign-in does not import your employment history, CV, contacts, posts, or complete social profile. A separate LinkedIn PDF or CV import occurs only when you select and upload that file in the Career Workspace.

LinkedIn Identity Connection

Free-preview applicants may connect LinkedIn to verify professional identity and enforce one standard free trial per member. The initial connection requests only the OpenID scopes needed for sign-in, basic profile identity, and email. We do not scrape LinkedIn pages or treat sign-in as permission to obtain your complete employment history.

We transform the LinkedIn member identifier into a keyed, non-reversible HMAC for account linking and free-trial control. This remains personal data in our service context. We do not retain the LinkedIn access token after the required identity claims have been validated. We record the consent version and connection time, and remove the linked identity through the account-deletion workflow unless retention is legally required.

Browser-Session Drafts

To reduce accidental data loss, unsaved Career Profile, target-role, CV, and cover-letter edits may be placed in your browser's session storage. These drafts are not saved to the Career Workspace server until you submit them. They may survive a page reload or passive session expiry in the same tab so that you can sign in again and resume, but browser settings, private-browsing rules, crashes, storage limits, or closing the tab may remove them.

Browser-session drafts are scoped to the signed-in account and relevant application where possible. They are cleared when you explicitly sign out or delete your account. Do not rely on an unsaved browser draft as your only copy of important material, especially on a shared device.

AI, Transcription, And Human Review

AI Interview services may transcribe simulated interview audio and use AI models to generate questions, analyse answers, and prepare feedback. AI output may be inaccurate or biased and is not a hiring decision.

The Career Workspace may send the professional evidence and target-role requirements you enter to an AI provider to draft a tailored CV and cover letter. Direct contact fields such as your email address, phone number, and LinkedIn URL are not sent to the AI provider and are added by the service only when presenting your document. Generated claims are linked to the evidence fields supplied in your Career Profile, but you must still review every document before use.

Human review occurs only when you purchase or request a reviewer-supported service, when limited support access is necessary to resolve a problem, or when required for security or legal compliance. Access should be limited to authorised personnel with a legitimate need.

Client content is not used to train public foundation models unless you provide separate, explicit, optional consent for a clearly described product-research programme.

Service Providers And Processing Locations

We use service providers for hosting, private storage, email, payments, transcription, and AI processing. The initial production design uses infrastructure in or near Singapore, while a provider may process support or security data in other locations stated in its terms. Real customer data will not be sent to a new AI provider until its processing location and contractual controls pass review.

At launch, selected interview transcription and AI-processing operations use the OpenAI API. NextMove Studio sends Responses API requests with response storage disabled. Under OpenAI's published default controls, customer content may still be retained in abuse-monitoring logs for up to 30 days, and our current default API project does not guarantee regional data residency. Provider processing may therefore occur outside Hong Kong and Singapore.

This provider review rule is a service policy and privacy commitment for release control. It is not a guarantee about AI output quality, hiring results, or any provider's future terms.

Retention

Unfinished uploaded objects are scheduled for deletion after 24 hours. Voice source materials, audio, and transcripts are scheduled for deletion 30 days after report completion, and generated interview feedback and reports after 90 days. Career Profile versions, target-role requirements, application progress and structured outcomes, and generated career documents are retained while needed for the active Career Workspace and are removed through the application or account-deletion workflow. Payment, security, deletion tombstone, and legal records may be retained longer where reasonably required to deliver the service, comply with law, prevent fraud, or handle disputes.

Your Choices And Rights

You may request access, correction, export, or deletion by signing in and using the available privacy controls or by emailing the privacy contact. We may verify your identity before acting. Some records may be retained where legally required.

Marketing messages and optional product-research participation require separate consent. Refusing either does not prevent you from buying the core service, and consent may be withdrawn prospectively.

Security And Confidentiality

Career materials are treated as confidential. We use verified access, private storage, encryption controls, short-lived links, restricted staff access, and deletion workflows, but no internet service can guarantee absolute security.

Changes And Complaints

Material changes will be posted with a new effective date. Please contact us first with a concern so it can be investigated. You may also contact the privacy or consumer authority available in your jurisdiction.