Home · Security
Security
Short summary of how Arrie protects your data. For the full privacy rules, see the Privacy Policy & PICS.
What we do
- HTTPS everywhere — the site is served only over TLS.
- No user accounts — no passwords for us to lose; upload, diagnose, done.
- Short retention — CV uploads on our server are deleted after 7 days (orders in progress pin a CV for at most 30 days). See Privacy → Retention.
- Consent-gated analytics — Google Analytics 4 and Google Ads measurement load only after you Accept. Your CV, job ads, names and emails are never sent to analytics.
- Payments by Stripe — Coach Review checkout is Stripe-hosted. Card numbers never touch Arrie’s servers (PCI SAQ A merchant model).
- AI processing — CVs are sent to AI providers solely to produce your diagnosis and tools; they are not published or sold.
Our commitments
- Hong Kong PDPO — a Privacy Policy and Personal Information Collection Statement in English, 繁體中文 and 简体中文. Privacy contact: cv@arrie.pro.
- Retention — CVs and diagnoses are deleted from our server after 7 days. A CV tied to an open Coach order is kept until the order is done, at most 30 days. Coach order records are deleted 12 months after their last update. Server logs are kept for at most 30 days.
- Payments — Coach Reviews are paid on Stripe Checkout. Arrie never sees your card number, and Stripe’s Data Processing Agreement applies.
- Security — HTTPS only; a security.txt reporting contact; hidden server files are blocked from the web; analytics and ad measurement run only after you accept cookies, with personalised ads turned off.
- Policy & self-assessment — we maintain a written security policy and a data breach response plan, aligned with PCPD guidance, and completed the PCPD Data Security Scanner self-assessment in October 2026.
Independent security tests
- Qualys SSL Labs (HTTPS / TLS configuration): grade A+
- Mozilla HTTP Observatory (web security headers): grade B
Report a vulnerability
If you believe you have found a security issue on cv.arrie.pro, please email cv@arrie.pro with enough detail to reproduce it. Do not include other people’s personal data in the report.
Machine-readable contact: /.well-known/security.txt (RFC 9116).