privacy policy

1. What we collect

• Account data: your name, email address, and authentication details (including your Google account identifier if you sign in with Google).
• Your CV: the file you upload and the structured data we extract from it (education, experience, skills, contact details). A CV can reveal a lot about you — treat this as the core of what we hold.
• Job data: URLs you submit, the scraped content of those postings, and the match scores and summaries we generate for you.
• Email data (only if you connect Gmail): we read messages in your mailbox to spot job-application updates. For messages we identify as job-related we store the sender, subject, date, the message text, and the stage change we inferred from it. Messages we identify as unrelated are not stored. Connecting Gmail is entirely optional and the rest of the service works without it.
• Technical data: logs needed to run and secure the service (e.g. IP address for rate limiting).

2. How we use it

We use your data solely to provide the service: parsing your CV, scraping the job postings you submit, scoring how well you match them, and showing you the results. We do not sell your data or use it for advertising.

If you connect Gmail, we use that access for one purpose: recognising updates about jobs you are tracking (interview invites, rejections, offers) and keeping the stage of those applications up to date. We do not use it for anything else, and we do not use it to train AI models.

Legal bases under UK/EU GDPR: performance of our contract with you — parsing your CV and scoring it against the jobs you submit is the service you sign up for, so that processing is necessary to provide it — and legitimate interests (securing and improving the service). You can end the contract, and the processing with it, at any time by deleting your account. Reading your Gmail relies instead on your consent, given when you connect the account; you can withdraw it at any time by disconnecting, and that withdrawal does not affect processing carried out beforehand.

3. Who processes your data

We use third-party processors to run the service. In particular, CV content, job posting content, and (if you connect Gmail) the content of job-related emails are sent to AI providers for analysis:

• Supabase — database, authentication, and CV file storage
• Anthropic (Claude) — CV parsing, job match analysis, and classifying job-related emails
• Google — Gmail access, if you choose to connect your mailbox
• OpenAI — text embeddings of your CV and job postings
• Jina AI — fetching the job posting URLs you submit
• PostHog (EU-hosted) — product analytics
• Resend — transactional email (for example, feedback you submit is emailed to us along with your email address)
• Our hosting providers (currently Vercel and Railway) — running the web app and API

4. Google user data

Connecting Gmail is optional. If you connect it, we request the read-only Gmail scope (gmail.readonly) plus your email address, and we store an encrypted refresh token so we can keep checking for new job-application updates. We never send email, never modify or delete anything in your mailbox, and never read it for any purpose other than tracking the applications you have added to the app.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we use Google user data only to provide the job-tracking features described here; we do not transfer it to others except as needed to provide those features, for security purposes, or to comply with the law; we do not use it for advertising; we do not use it to develop, improve, or train generalised AI or machine-learning models; and no human reads your email except where you specifically ask us to for support, or where required for security or legal reasons.

Email content we identify as job-related is sent to Anthropic (Claude) for classification. Anthropic acts as our processor and, under our commercial terms, does not use this content to train its models.

Disconnecting Gmail from your profile settings revokes our access token with Google and deletes the stored email data. You can also revoke access at any time from your Google Account permissions page.

5. International transfers

Some of these providers process data outside the UK/EEA (notably the AI providers, in the United States). Where that happens, transfers rely on the providers’ standard contractual clauses or equivalent safeguards.

6. Retention and deletion

We keep your data while your account is active. When you delete your account, your CV files, extracted profile data, jobs, scores, stored email data, and analytics profile (including its events) are deleted. Residual copies in backups are removed on the backup rotation cycle.

Stored email data is also deleted, and our Google access token revoked, as soon as you disconnect Gmail — you do not have to delete your account to remove it.

You can delete your account from your profile settings, or email us and we will do it for you.

7. Your rights

Under UK/EU GDPR you can ask us to access, correct, export, restrict, or delete your personal data, and you can object to processing based on legitimate interests. Email us to exercise any of these — we respond within one month. You also have the right to complain to your supervisory authority (in the UK, the ICO).

8. Cookies and analytics

We use cookies that are strictly necessary to keep you signed in (Supabase auth session cookies). We do not set advertising or cross-site tracking cookies.

We use PostHog, hosted in the EU, for first-party product analytics — which pages are visited and which features are used (for example adding a job or uploading a CV). It is configured cookieless: it stores a random identifier in your browser's localStorage rather than in cookies, does not record your screen, and does not track you across other sites. While you are signed in, analytics events are linked to your account ID and email so we can understand usage per user; this data is deleted when you delete your account. We rely on our legitimate interest in understanding and improving the service.

9. Changes and contact

If we change this policy materially we will take reasonable steps to notify you. Questions or requests: isaac.cruise@gmail.com.