Privacy Policy — Recruitd

Overview

This Privacy Policy explains what information Recruitd ("we") collects, how we use it, and the choices you have. We collect only what we need to provide the Service, and we do not sell your personal information.

Information we collect

We collect the following categories of information:

Account information: email address, password hash, and (optionally) OAuth identifiers from providers like Google.
Resume and profile content: the resume you upload and the structured data parsed from it (work history, education, skills, contact info).
Application data: the jobs we match for you, the answers you or our agent provide on application forms, and the status of each application.
Email metadata: messages sent to the email alias we provision for you (e.g., verification codes from applicant tracking systems) so we can complete applications on your behalf.
Usage data: log data about how you use the Service, including IP address, browser type, and timestamps.
Payment information: if you purchase a paid plan, our payment processor (Stripe) collects and stores your card details. We receive only a token and limited metadata — we never see your full card number.

How we use information

To operate the Service — match jobs, fill applications, forward verification codes.
To communicate with you about your account, applications, and product updates.
To process payments and prevent fraud.
To improve the Service, including debugging and analytics on aggregate usage patterns.
To comply with legal obligations and enforce our terms.

We do not use your resume or application content to train third-party AI models. We do send content to AI providers (such as Anthropic) as part of processing a specific request, under contracts that prohibit training on your data.

How we share information

We share information only with service providers who help us operate the Service, and only to the extent necessary:

Supabase — database, authentication, and file storage.
Anthropic — AI processing for resume parsing, job matching, and form filling.
Postmark — transactional email and inbound email processing.
Stripe — payment processing and billing.
Render / Vercel — application hosting.
Google — if you sign in with Google.

When you submit an application, the content you review (resume, answers, contact info) is transmitted to the employer or their applicant tracking system. That transmission is governed by the employer's privacy practices, not ours.

We do not sell your personal information. We may disclose information if required by law or to protect rights, property, or safety.

Data retention

We retain account data while your account is active. You can delete your account at any time by contacting support, and we will delete or anonymize your data within 30 days, except where we are required to retain it for legal, tax, or fraud-prevention purposes.

Security

We use encryption in transit (TLS) and at rest, row-level security on our database, and restricted access to service role credentials. No system is perfectly secure; if we become aware of a breach affecting your data, we will notify you as required by law.

Your rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, and to object to certain uses. To exercise these rights, email nima.rad@recruitd.app. We will respond within the timeframes required by applicable law.

California residents have rights under the CCPA/CPRA including the right to know, delete, correct, and limit use of sensitive personal information. We do not sell or share personal information as defined by those laws.

EU/UK residents have rights under the GDPR including access, rectification, erasure, portability, restriction, and objection. Our legal basis for processing is primarily the performance of our contract with you (to provide the Service) and our legitimate interests in operating and improving it.

Cookies

We use essential cookies to keep you signed in and to maintain your session. We do not use advertising cookies or cross-site tracking.

Children

Recruitd is not intended for anyone under 18. We do not knowingly collect information from children. If you believe a child has provided us information, contact nima.rad@recruitd.app.

International transfers

Our service providers may process information in the United States and other countries. Where required, we rely on standard contractual clauses or equivalent legal mechanisms for international transfers.

Changes

We may update this policy from time to time. Material changes will be communicated by email or in-app notice. Continued use of the Service after changes take effect means you accept the updated policy.

Contact

Questions of any kind: nima.rad@recruitd.app.