Privacy Policy
Effective date: [DATE]
What data we collect and why
| Data | Why we collect it | How long we keep it |
|---|---|---|
| Account email and password (hashed) | Sign-in, account identification, notification emails | For the life of your account + [RETENTION PERIOD, e.g. 30 days] after deletion |
| Profile information (name, contact details, target roles, cover letter text, resume content, skills) | To generate tailored documents | For the life of your account; deleted when you delete your profile or account |
| Job postings we find on your behalf | To populate your review queue | [CURRENT BEHAVIOR — verify: not currently auto-deleted after a fixed period; confirm retention policy before publishing] |
| Generated documents (cover letters, resumes) | For you to download | Stored in object storage, deleted when you delete the associated job |
| Payment information | Billing | We never store your card details — Stripe handles payment processing and storage directly; we retain only your Stripe customer ID and subscription status |
| Usage data (search counts, generation counts) | Enforcing plan limits, billing | Retained for the life of your account for plan-limit and billing-history purposes |
What we don't do
- We do not sell your data to third parties.
- We do not use your profile information, resume content, or job search activity to train any AI/machine learning model — generation in this product is rule-based, not model-based, and no part of your data feeds a model of any kind, ours or a third party's.
- We do not share your data with the employers whose postings you view, beyond what you yourself submit when you apply.
Third parties we share data with
Account sign-in is handled entirely within our own systems — no third-party identity provider sees your credentials. Passwords are stored as one-way bcrypt hashes; we cannot recover or view your actual password.
- Stripe — payment processing. Handles your payment details; we never see your full card number.
- [OBJECT STORAGE PROVIDER — e.g. Cloudflare R2] — stores your generated documents.
- [EMAIL PROVIDER — Resend] — sends notification emails on our behalf.
- [ERROR TRACKING — Sentry, if enabled] — receives error reports from the app; configured to exclude personal information from these reports, but review its own data-handling terms before enabling it in production.
We do not share your data with LinkedIn or Indeed beyond the normal browsing activity involved in viewing their public job listings.
Your rights
You can access, correct, or delete your profile information at any time through your account settings. You can delete your account entirely, which removes your profile, generated documents, and job history after [RETENTION PERIOD].
[If you have EU/UK/California users, add GDPR/CCPA-specific language here — right to portability, right to object, etc. This draft does not include jurisdiction-specific rights language and needs it before those users are in scope.]
Data security
We use industry-standard practices to protect your data, including encrypted connections (HTTPS/TLS) for all data in transit, per-tenant data isolation at the database level (Row-Level Security, in addition to application-level checks), and access controls limiting who can view your data. No system is perfectly secure, and we cannot guarantee absolute security.
Changes to this policy
We may update this policy from time to time. Material changes will be communicated by email to your account address before they take effect.
Contact
[SUPPORT EMAIL]