privacy policy

1. What we collect

• Account data: your name, email address, and authentication details (including your Google account identifier if you sign in with Google).
• Your CV: the file you upload and the structured data we extract from it (education, experience, skills, contact details). A CV can reveal a lot about you — treat this as the core of what we hold.
• Job data: URLs you submit, the scraped content of those postings, and the match scores and summaries we generate for you.
• Email data (only if you set up forwarding): once you create a private forwarding address and point your job mail at it, we read the messages that arrive there to spot application updates. For messages we identify as job-related we store the sender, subject, date, the message text, and the stage change we inferred from it. Messages we identify as unrelated are not stored. Setting up forwarding is entirely optional and the rest of the service works without it. We never access your mailbox directly — only mail you choose to forward reaches us.
• Technical data: logs needed to run and secure the service (e.g. IP address for rate limiting).

2. How we use it

We use your data solely to provide the service: parsing your CV, scraping the job postings you submit, scoring how well you match them, and showing you the results. We do not sell your data or use it for advertising.

If you set up forwarding, we use the mail that reaches your forwarding address for one purpose: recognising updates about jobs you are tracking (interview invites, rejections, offers) and keeping the stage of those applications up to date. We do not use it for anything else, and we do not use it to train AI models.

Legal bases under UK/EU GDPR: performance of our contract with you — parsing your CV and scoring it against the jobs you submit is the service you sign up for, so that processing is necessary to provide it — and legitimate interests (securing and improving the service). You can end the contract, and the processing with it, at any time by deleting your account. Processing mail sent to your forwarding address relies instead on your consent, given when you create the address; you can withdraw it at any time by removing the address from your profile settings, and that withdrawal does not affect processing carried out beforehand.

3. Who processes your data

We use third-party processors to run the service. In particular, CV content, job posting content, and (if you set up forwarding) the content of job-related emails are sent to AI providers for analysis:

• Supabase — database, authentication, and CV file storage
• Anthropic (Claude) — CV parsing, job match analysis, and classifying job-related emails
• OpenAI — text embeddings of your CV and job postings
• Jina AI — fetching the job posting URLs you submit
• PostHog (EU-hosted) — product analytics
• Resend — transactional email, and (if you set up forwarding) receiving mail sent to your forwarding address
• Our hosting providers (currently Vercel and Railway) — running the web app and API

4. Email forwarding data

Setting up forwarding is optional. If you create a forwarding address, we generate a private address unique to your account and store the mail that arrives there so we can keep checking for new job-application updates. We never send email from it, and never read anything other than the mail you or your provider forward to it.

Email content we identify as job-related is sent to Anthropic (Claude) for classification. Anthropic acts as our processor and, under our commercial terms, does not use this content to train its models.

Removing your forwarding address from your profile settings deletes the stored email data associated with it.

Before 30 August 2026 we offered a Gmail account connection that read your mailbox directly over OAuth (the restricted gmail.readonly scope) to detect the same kind of updates. We no longer offer this to new accounts — it has been retired in favour of forwarding, described above. If you connected your Gmail account previously, that connection may still be active: you can revoke it at any time from your Google Account permissions page, or delete your account (see §6), which removes it along with everything else. Our use of that Gmail access adhered to the Google API Services User Data Policy, including the Limited Use requirements: it was used solely to provide the job-tracking features described here, never for advertising, and never to develop or train generalised AI or machine-learning models.

5. International transfers

Some of these providers process data outside the UK/EEA (notably the AI providers, in the United States). Where that happens, transfers rely on the providers’ standard contractual clauses or equivalent safeguards.

6. Retention and deletion

We keep your data while your account is active. When you delete your account, your CV files, extracted profile data, jobs, scores, stored email data, and analytics profile (including its events) are deleted. Residual copies in backups are removed on the backup rotation cycle.

Stored email data is also deleted as soon as you remove your forwarding address — you do not have to delete your account to remove it. If you have a legacy Gmail connection (see §4), revoking it from your Google Account settings has the same effect for that data.

You can delete your account from your profile settings, or email us and we will do it for you.

7. Your rights

Under UK/EU GDPR you can ask us to access, correct, export, restrict, or delete your personal data, and you can object to processing based on legitimate interests. Email us to exercise any of these — we respond within one month. You also have the right to complain to your supervisory authority (in the UK, the ICO).

8. Cookies and analytics

We use cookies that are strictly necessary to keep you signed in (Supabase auth session cookies). We do not set advertising or cross-site tracking cookies.

We use PostHog, hosted in the EU, for first-party product analytics — which pages are visited and which features are used (for example adding a job or uploading a CV). It is configured cookieless: it stores a random identifier in your browser's localStorage rather than in cookies, does not record your screen, and does not track you across other sites. While you are signed in, analytics events are linked to your account ID and email so we can understand usage per user; this data is deleted when you delete your account. We rely on our legitimate interest in understanding and improving the service.

9. Changes and contact

If we change this policy materially we will take reasonable steps to notify you. Questions or requests: isaac.cruise@gmail.com.