# Privacy policy Effective 22 October 2026. What Job Envoy keeps about you, why, on what legal basis, who else handles it, how long we keep it, and how to get it back, correct it or have it deleted. We do not sell your data, we do not show ads, and we do not use your resume to train models. Outside the European Economic Area, the United Kingdom and Switzerland, we tell our advertising partners when a visit from one of our ads ends in a sign-up or a purchase. ## Who we are and what this covers Job Envoy is run by Anthid LLC, a Delaware limited liability company doing business as Job Envoy, located in Seattle, Washington, United States ("we", "us"). We determine the purposes and means of the personal-data processing described here. Where applicable data-protection law uses the term, we act as a controller. Questions, requests and complaints go to support@jobenvoy.ai. This policy covers the web app at jobenvoy.ai, our API, the Job Envoy browser extension, our contact form, and the emails we send. It does not cover the job boards, the companies you apply to, or any other site we link to: each has its own policy, and we do not control what it does. This policy explains our handling of personal data. It is not a request for blanket consent. Where a particular activity requires consent, accepting the terms or continuing to use the service does not replace that consent. ## What we collect, and where it comes from From you, when you give it to us: - **Your account.** Your name and email address, from your Google account or from whichever other method our sign-in provider's page offers, such as a link sent to your email, through our sign-in provider, WorkOS. We never see or keep a password. We keep when you created the account, when you were last seen, and the record of changes to it. - **Your resume.** The files you upload, text extracted from them, drafts, every resume version you save, contact details you confirm, and tailored resumes and PDFs. This includes work history, education, skills, certifications and licences, and any reference details or other information you include. - **Your saved answers.** Answers you choose to save so that application forms can be filled: your citizenship, where you are allowed to work and where you would need sponsorship, and the voluntary self-identification questions many forms ask: gender, race and ethnicity, veteran status, disability status, whether you are transgender, and sexual orientation. Every self-identification answer starts as "I choose not to disclose" and stays so unless you change it. You never have to answer any of them. - **Your envoy.** Your search preferences, including titles, seniority, pay, work setting, places and languages; the city it looks around for hybrid and on-site work and how far from it (see Approximate location); your tailoring instructions; which model you select; and whether your envoy is running or paused. - **Saved jobs and lists.** Jobs you save or remove, list names and membership, and their change history. Saved postings may remain available in your account after the source closes or removes them. Removing a job from a list does not necessarily erase historical events; account deletion and applicable erasure rights are described below. - **Your email choices.** Which emails you want and the time zone your rollups go by. - **What you write to us.** If you use the contact form on our site or email us, your name, your email address and your message. The contact form is protected by Cloudflare Turnstile, which checks you are not a robot, and the message is sent to our inbox by email. Made by Job Envoy as you use it: - **What happens to each posting.** Matches, keyword comparisons, tailoring attempts, skips, failures and application status changes, with the prepared answers and material used to prepare an application. This is a record of preparation and status, not a complete copy of what an employer received. You can edit fields and attachments on the employer site after we fill them. - **Application confirmation records.** When the extension detects confirmation after you submit an application, it sends the confirmation page's address, text and time to Job Envoy. We retain the address without its query string, the time, the attached resume reference when available, and a SHA-256 hash of the confirmation text. We do not retain the confirmation text or a screenshot as proof. Detection can be incomplete or mistaken; it does not prove the employer reviewed or accepted the application. - **Consent records.** When you agree to the terms and this policy, confirm you are 18 or older, or allow or refuse analytics, we keep a record of it: the version of the text, the time, and the control you used, such as the sign-up check box, a prompt to agree, the analytics banner or the switch on your account page. A record is never changed; a later one of the same kind replaces it as your current choice. The records are in your account export, and they are kept after you delete your account, as the evidence of what you agreed to and when (see What stays after deletion). A visitor's analytics choice is kept only in that browser's storage. - **Billing.** Your plan, your purchases, your invoices, and how many tailors you have used and have left. Payments go through Stripe. We never see or keep your card number. - **Model usage.** For each model call made for you: which model, what it was for, how many tokens went in and out, and what it cost. Not the prompt and not the answer: those pass through to the model provider and are not stored with the record. - **Product analytics.** PostHog collects page patterns, named actions, clicks, heatmaps, performance measurements, errors and masked session recordings to help us understand and improve the service. Events may include record identifiers, counts and fixed control options. We configure capture to mask page text and inputs, omit element text and attributes, and exclude request bodies, headers and console output from recordings. We scrub page addresses to avoid sending searches and tokens. When you arrive from a link that carries campaign tags, such as utm_source, utm_medium or utm_campaign, PostHog records those tags so we can tell which of our links bring visitors. Where we ask first, we hold the tags in the page's memory until you answer: we write nothing to your browser and send nothing before a yes, and a no discards them. An ad's click id is masked before it leaves your browser. Signed-in activity is linked to your account id rather than your name or email; other visits use browser or session identifiers. These identifiers and associated activity remain personal data, not anonymous data. We run no surveys. Our PostHog configuration honours Do Not Track. The Cookies section explains the available controls and when consent is required. - **Ad measurement.** Outside the European Economic Area, the United Kingdom and Switzerland, while product analytics is on and your browser sends no Global Privacy Control, our advertising partners measure whether a visit from one of our ads ended in a sign-up or a purchase. When you create an account, start a paid plan or buy a pack, we tell each partner that counts that kind of event that it happened. For a sign-up, that is a one-way hash of your account id, so it is counted once. For a purchase it is the price and Stripe's checkout id, and for a paid plan a partner may also be told which plan it is. We send no page views, and never your account id itself, name or email. Where a partner offers them, we turn ad personalisation off and its limited or restricted data mode on. We send these reports to measure our own ads. We do not use them to build audiences or to show you ads, and each partner handles the report under its own terms. Like any site your browser loads, each partner receives your IP address and browser details with each request, and may receive the address of the page you are on and its own cookies where your browser allows them. Our partners are Google Ads, ChatGPT Ads (OpenAI) and Meta. - **Site performance.** Cloudflare Web Analytics uses a browser beacon to measure page visits and performance, including page addresses, referrers and page-load timings. Cloudflare receives these measurements to help us understand site speed and usage. This beacon runs separately from PostHog and from ad measurement. - **Approximate location.** Our network provider derives approximate country, region and city from your connection. We use it to suggest initial search areas and rank nearby jobs, including for signed-out visitors. This is not precise device or GPS location. You can choose another search area. When you are signed in, we keep the city it reports, with its approximate map position and your country and, in the United States and Canada, state or province, as your envoy's area, and use it to find hybrid and on-site jobs within 25 miles of that city. Your envoy page shows the city and the distance and lets you change both; once you do, we keep the city and distance you chose and no longer update them from your connection. The tab may cache the lookup as described below. - **Technical data.** As on any website, our network edge and our servers see your IP address, your browser and device type, the time of each request and the page or API route it asked for, and keep them in short-lived logs to run, secure and debug the service. Our logs hold errors, timings and ids. We do not write tokens, resumes, answers or other content to them. - **Browser storage.** The web app keeps your sign-in session and a few preferences, such as not to ask again about installing the extension, in your browser's own storage. The site and app also keep recent public job results, search filters and the approximate location lookup in the tab's session storage for up to thirty minutes to make navigation and refresh faster. This cache holds no resumes, account or billing data, and clears when the tab closes. The extension keeps your sign-in in the browser's extension storage, as described below. Our analytics provider keeps an identifier in your browser so it can tell your visits apart. From other sources: identity information from Google or your sign-in method through WorkOS; billing and payment information from Stripe; public postings from some job boards, not all, including Greenhouse, Lever, Ashby, Workable, SmartRecruiters, Rippling, Recruitee, Breezy, BambooHR and Workday; and job-page material you ask the extension to use. Public posting data is separate from your personal saved jobs and application history. We do not request precise device location, biometric or genetic data, government identity numbers, financial account credentials, or access to your email inbox or private messages. The optional disability answer can be health data, and messages or resumes you supply may contain sensitive information. Please do not include unnecessary sensitive details in a resume, instruction or support message. Resume and instruction text can be sent to model providers as described below. ## Google user data You can sign in to Job Envoy with your Google account. This is the only way Job Envoy uses Google user data, and the only Google permissions it asks for are the basic sign-in ones: openid, email and profile. - **What we access.** Your name, your email address, whether Google has verified that address, your profile picture and an identifier for your Google account. We ask for nothing else: not your Gmail, contacts, calendar, Drive files or any other Google data. - **How we use it.** To create your Job Envoy account, sign you in, show your name in the app and email you about your account. Nothing else. - **How we store it.** Our sign-in provider, WorkOS, receives it from Google and keeps your name and email address with your account. We keep them only as part of your account, as What we collect describes, and we do not keep your profile picture. - **Who we share it with.** No one but WorkOS, which handles sign-in for us under data-processing terms. We do not sell Google user data, use it for advertising, give it to Google Ads, send it to a model provider, or use it to train or improve AI models. - **How to remove it.** Delete your account from your account page, or write to support@jobenvoy.ai, and we delete it as How long we keep it describes. You can also remove Job Envoy's access at any time from your Google account's security settings (myaccount.google.com/connections). Job Envoy's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. ## Sensitive data and your saved answers Some of what you may save is sensitive under the law: racial or ethnic origin, sexual orientation, gender identity, disability, veteran status, citizenship and immigration status. We handle it like this: - These answers are optional. Processing special-category answers on the basis of consent requires your explicit, specific agreement to their storage and use for filling matching application questions. Merely using Job Envoy or accepting its terms is not that consent. You can withdraw by resetting an answer to "I choose not to disclose", deleting it, or contacting us. Withdrawing does not recall an answer already received by an employer. - It is used for exactly one thing: filling the matching question on an application form when you press Fill this form, so that you do not have to type it each time. No matching, fit score, tailoring or model prompt ever reads it, and it is never sent to a model provider. - Access to saved answers is restricted to your account and the service that provides them for filling, with hosting and authorised operational access as described below. During a fill, the extension receives the needed answers in memory and writes them into the form you chose. It does not persist those answers in extension storage. - We do not use these saved answers for matching, tailoring, analytics or model training. They are processed by the infrastructure needed to store and deliver them, and disclosed to the employer and its form provider when you request a fill. Their handling of filled fields is governed by their policies, and collection may begin before submission. The safeguards for saved self-identification answers do not automatically remove sensitive information from a resume or free-text instruction. If you include a health condition, religious or union affiliation, or other sensitive information there, it may reach a model provider during import or tailoring. Avoid including it unless necessary. Any such processing must have an applicable legal basis and, where required, a separate special-category condition; your upload alone is not a substitute for explicit consent. ## What we use it for, and on what legal basis Where the law requires a legal basis for each use, as it does in the European Economic Area, the United Kingdom and Switzerland, these are ours: - **To provide the service you asked for (performance of our contract with you).** To create your account, search and compare jobs, maintain saved jobs and lists, prepare resumes and form answers, fill forms at your request, show your history and usage, manage purchases, and send necessary account messages and the job rollups you select or have not turned off. Standing instructions can cause your envoy to queue and prepare jobs automatically within your settings. - **Sensitive answers (your explicit consent).** To store optional sensitive answers and use them for matching form questions at your request. Where explicit consent is required, we must obtain it separately from acceptance of the terms. It can be withdrawn without losing access to unrelated features. - **Product news emails (your consent).** Sent only if you opt in. You can turn product news off again at any time. - **To run, secure and improve the service (our legitimate interests).** To protect accounts and service availability, prevent fraud and abuse, answer support requests, reconcile costs and payments, and establish or defend legal claims where appropriate. These interests must be balanced against your rights. Analytics is addressed separately below; a legitimate interest does not replace consent required for device storage or access. - **Optional analytics.** To understand use of the service and improve it. Where device-storage or data-protection law requires consent, consent is required before the relevant capture begins. Where consent is not required, processing must be supported by an applicable lawful basis, such as legitimate interests balanced against your rights. You may object to processing based on legitimate interests. - **Ad measurement.** To learn which of our ads lead to sign-ups and purchases, so we spend on the ones that work. It runs only where we do not ask first about analytics, and on our legitimate interest in measuring our own advertising. Turning analytics off or enabling Global Privacy Control stops it. Do Not Track alone does not stop ad measurement. - **To meet our legal obligations.** To keep records required by accounting and tax law and comply with binding legal duties or lawful authority requests. Keeping records for a possible legal claim is not automatically a legal obligation; the relevant lawful basis and necessity must be assessed. We do not sell your data, show ads, or use it for other companies' marketing. We send sign-up, paid plan and pack events to our advertising partners, as described under Advertising measurement, to measure our own ads. Some laws treat that as sharing for cross-context behavioural advertising. You can turn it off with the Analytics switch or Global Privacy Control. We do not use your resume, saved answers, instructions or tailored output to train models. We never press Submit for you. An employer's site may nevertheless receive filled fields or attachments before you submit, as the extension section explains. ## Automated processing and AI Job Envoy is automated by nature, and you should know exactly what is automated: - Personal keyword comparisons and matching rules are computed in our own code from resume information and your preferences. Some attributes used to describe and filter public postings, such as job family and seniority, are read using AI. Suggestions may rank or filter jobs and your standing instructions may queue or prepare them automatically. You can change those instructions or pause your envoy. A match is not a decision about your eligibility or a prediction of a hiring outcome. - Tailoring sends a version of your resume with specified identity and contact fields replaced by placeholders, your instructions, and the job description to Anthropic or OpenAI through our model gateway. Form questions may also be sent, and generated answers normally use a lower-cost model of the same provider. Work history, education, skills and relevant prose remain in the request. The resume service restores your details when preparing the PDF. Validation rejects certain unsupported changes but cannot guarantee that output is accurate or complete. - Importing an uploaded resume also uses a model. Before sending extracted text, we replace confirmed identity and contact details and detected email addresses, phone numbers and LinkedIn profile links with placeholders. These measures reduce direct identifiers; they do not guarantee removal of every identifying detail or make the remaining text anonymous. Free-text instructions and details in work or education history can still identify you. - We do not make hiring decisions or send employers a decision about your eligibility. Our matching and preparation tools support your own job search. Employers decide whether to interview or hire using their own processes and policies. This does not limit any rights that apply to profiling or automated decision-making in your jurisdiction. We use commercial APIs under our own credentials. OpenAI and Anthropic state that API inputs and outputs are not used for model training by default, subject to their terms and any permitted opt-in arrangements. We do not authorise training on your content. Their default API retention generally includes periods of up to 30 days, with differences by provider, endpoint, feature and account arrangement. Longer retention can apply for safety, policy enforcement or legal requirements, and some features retain application state. We do not promise zero retention. These provider practices do not remove our own data-protection responsibilities. ## Who else handles it The providers below handle data to deliver the listed functions. Where they act as our processors, they must handle it under applicable data-processing terms. Some also act as independent controllers for their own purposes, such as payment fraud prevention and legal compliance. Employers and their application providers are separate recipients when you fill or submit their forms. - **WorkOS (United States)** sign-in, including Google sign-in and any email sign-in link it sends: your name, your email address and your sign-in sessions. - **Stripe (United States)** payments, subscriptions, invoices, the billing portal and tax: your name, email, billing history and payment details supplied directly to Stripe. We do not receive your full card number. Stripe acts as a processor for some payment services and as an independent controller for activities such as its own fraud prevention and legal compliance. - **Anthropic and OpenAI (United States)** resume import, tailoring and generated form answers: the relevant resume text after the reductions described above, instructions, job text and questions. Protected saved self-identification answers are not included in model requests; sensitive data written separately into resume or instruction text can still be included. - **Amazon Web Services (United States, us-east-1)** backend hosting, databases, resume files and exports. Files are kept in private storage and accessed through authenticated services or temporary signed links. Anyone who obtains a valid signed link may be able to use it until it expires, so keep it private. - **Cloudflare (global network)** site delivery and network security, approximate location derived from network information, bot protection, Cloudflare Web Analytics and email delivery. This can include IP addresses, request routes, page addresses, referrers, performance measurements and other technical data, and email recipient addresses and message contents. - **Advertising measurement partners (United States)** ad measurement, outside the European Economic Area, the United Kingdom and Switzerland, only while analytics is on: the click reference of the ad you came from, your sign-up with a one-way hash of your account id, each paid plan or pack, for the partners that count that kind of event, with its price and Stripe's checkout id (and, for a paid plan, possibly which plan it is), and your IP address and browser details, and each partner may also receive the address of the page you are on and its own cookies where your browser allows them. Where a partner offers them, we turn ad personalisation off and its limited or restricted data mode on. Ad measurement names them. - **PostHog (European Union)** our EU analytics project, including page patterns, events, performance, errors and masked session recordings. Signed-in activity is associated with your account id; other activity can use browser or session identifiers. Hosting in the EU does not by itself rule out international access or transfers. We may also disclose your data: - to the employer and its application provider when you fill or submit a form. Filled fields and attachments may be received before submission. Those recipients determine their own purposes and retention under their policies; this does not exclude our responsibility for the processing we carry out; - to comply with the law, a court order, a subpoena or a lawful request by a public authority, where we believe in good faith we must. We will tell you before we do, unless the law forbids it or the request concerns fraud, abuse or an emergency; - to protect the rights, property or safety of us, our users or the public, to enforce our terms, or to investigate fraud, abuse or security incidents; - to a successor if we are part of a merger, acquisition, financing, reorganisation, bankruptcy or sale of assets, in which case your data may be transferred as part of it, under this policy or one at least as protective, and we will tell you; - to professional advisers, such as lawyers, accountants and insurers, under a duty of confidence; - with your consent, or at your direction. We may replace a processor with another that does the same job; we will update this list when we do. We do not use data brokers. The advertising partners named in Ad measurement are the only advertising services we use, and only to measure our own ads. ## The browser extension At installation, the extension asks for access to every HTTPS site, because an application form can be on any site, and to jobenvoy.ai for its app connection. On each page a small detector looks for an application form; it reads no values you have typed and sends nothing about the page. Where it finds a form, it displays the filling panel, which, if you are signed in, asks Job Envoy whether you have an application prepared for that page by sending the page's address. We use the address for that lookup and do not store it. You can restrict or revoke website permissions in your browser; on a site you have withheld, the extension looks at a page only when you open it from the toolbar. It does not request browsing-history permission or download executable code from the internet. Its popup uses active-tab information to communicate with the form panel; that is different from access to your browsing history. - You sign in to it in your browser's own sign-in window, through WorkOS, as you do to the web app. It keeps your sign-in in the browser's extension storage: a refresh token and your id, name and email, so you stay signed in until you sign out, and a short-lived access token in session storage, which the browser clears when it closes. Signing out deletes both. No page can read them, and no page ever hands the extension a token. - When you request a basic fill, the extension sends form-field descriptions and choices to Job Envoy to identify the saved details needed. It obtains the relevant resume and saved answers and fills supported fields, leaving other fields for you. Basic filling uses no model and no tailor. Answers are held in memory for the fill rather than saved in extension storage. The extension never presses Submit or completes a CAPTCHA. - When you request tailoring, the extension sends the application form's questions to Job Envoy as it reads them on the page: each question's label, its kind and the choices it offers, never what you have typed. This happens for jobs in our catalogue as well as for other pages. We keep the questions with your account, as a new copy only when they change, and use them to prepare that application's answers, including in model requests. They are deleted with your account. - When you request tailoring for a page outside the catalogue, the extension also sends its URL, job title, company, location and description. We retain a snapshot for your preparation history and use relevant material in model requests. Page URLs can retain job-identifying query parameters; recognised tracking and sensitive parameters are removed. This is separate from confirmation records, whose stored URLs omit the query string entirely. - The extension uses our API, WorkOS and temporary resume-file links. Filling fields or attaching a file also makes data available to the employer's page and its scripts, which may transmit it before you press Submit. Undo cannot recall information already received by that site. After submission, the extension may send confirmation text to Job Envoy to produce the limited record described above. ## Cookies and similar technologies Our advertising technologies are our advertising partners' tags, to measure our own ads, described below. We also use third-party services and analytics identifiers. The following storage and access technologies have different purposes: - **Strictly necessary.** Storage used for authentication, security and functions you request. Disabling required session storage may prevent sign-in or the requested function. Optional analytics is not required to use the service. - **Product analytics (PostHog).** PostHog uses browser identifiers and the capture described in Product analytics. Where applicable law requires consent, optional storage, capture and session recording require your prior consent. Masking inputs or relying on a legitimate interest does not replace that requirement. We ask first in the European Economic Area, the United Kingdom and Switzerland, and wherever we cannot tell from your connection where you are: PostHog captures nothing until you say yes. Elsewhere analytics is on until you turn it off, on your account page or with Analytics at the foot of the page. Session recording starts only after you say yes, wherever you are. Do Not Track disables PostHog capture. You can also use browser settings or a content blocker; Job Envoy works without analytics. - **Ad measurement.** Each advertising partner's tag keeps a reference to the ad you arrived from and a browser identifier in first-party cookies. They last from 30 to 365 days, depending on the partner. The tags report a sign-up, a paid plan or a pack back, as Ad measurement describes. They load only outside the European Economic Area, the United Kingdom and Switzerland, only while analytics is on, and never with Global Privacy Control. Turning analytics off stops them on the same page. Nothing from our advertising partners loads otherwise. - **Cloudflare Web Analytics.** The performance beacon loads from static.cloudflareinsights.com/beacon.min.js and sends measurements to Cloudflare. It does not use cookies or local storage. Our Analytics switch controls PostHog and ad measurement; it does not control this separately loaded beacon. A browser content blocker can block it. - **Bot protection.** Cloudflare's Turnstile on the contact form, which may set a cookie to tell your browser from a robot. Where applicable, we treat Global Privacy Control as an opt-out of sale or sharing for targeted advertising. When your browser sends it, our ad measurement is off, whatever you chose in the banner. Do Not Track and Global Privacy Control are different signals. Where analytics would otherwise be on until you turn it off, Global Privacy Control turns it off, unless you turned analytics on yourself in the banner or on your account page. You can contact us to exercise applicable opt-out or objection rights. ## Where your data is, and international transfers We operate from the United States. Backend data and files are hosted there, while our PostHog project is in the EU, and Cloudflare, Google, OpenAI and our advertising partners operate globally. Providers may process or access data in other countries. Where transfer restrictions apply, transfers must use an applicable legal mechanism, such as approved contractual clauses, the UK addendum or another recognised safeguard. A provider certification can support a transfer only where it is valid and covers the recipient and processing concerned, including any required UK or Swiss coverage. Contact us for information about the safeguards applicable to your data and copies where available, subject to necessary redactions. This policy is not consent to an otherwise unlawful transfer. ## How long we keep it We keep account content and history while needed to provide the account and features you request, subject to deletion requests and applicable law. Purpose, legal requirements and the exceptions below determine retention; an account remaining open does not justify keeping unrelated data indefinitely. - **When you delete your account.** An account-deletion request starts removal across our services and sign-in provider. Processing is asynchronous, and interrupted service deletions are retried. It covers your envoy, applications and prepared material, saved jobs and lists, retained job-page snapshots, resumes and files, optional saved answers and exports. The notification service retains the address needed to send deletion confirmation, then removes it as part of its deletion process. The exceptions below apply. - **What stays after deletion.** Payment and accounting records are retained for the applicable statutory period, typically seven years; Stripe has its own legal retention duties. Model-usage records and tailored-resume metadata can remain to reconcile costs, resolve payment disputes and meet legal obligations, only for as long as necessary for those purposes. They may include account and record ids, model names, token counts, costs, file locations, hashes and sizes, but not resume contents. Account ids and linked metadata can still be personal data. Operational logs age out within 14 days. A specific legal hold may require relevant records to be kept until the matter and applicable retention duty end. - **Consent records.** The records of what you agreed to and consented to (the terms and this policy, your age, analytics, and keeping self-identification answers) are kept after you delete your account, as the evidence of what was agreed and when. Each holds your account id, the version of the text, the time and the control you used. Never your answers, your name or your email. - **Backups.** We keep seven daily database snapshots and archive database changes to support recovery over 7 days. The recovery files in object storage are scheduled to expire after 9 days; deletion can take longer while storage lifecycle processing completes. Deleted data can remain in these backups until they expire. Backups are restored only to recover from a failure, in which case the deletion is applied again. - **Data exports.** An export you request is kept for seven days, then deleted for good. - **Proof of an application.** Kept with your record while your account is open, and deleted with it. - **Analytics.** Analytics events and recordings are held by PostHog. Account-linked analytics can be requested for deletion when you delete your account or by contacting us. An account deletion is not a representation that every vendor copy disappears instantly. Retention must be limited to what is needed for the stated analytics purpose; identifying and deleting activity held only under a browser identifier may require additional information. - **Ad measurement.** Each advertising partner keeps these reports under its own retention for conversion data. The cookies in your browser expire after 30 to 365 days, depending on the partner. - **Contact form messages.** Kept in our inbox for as long as needed to answer you and keep a record of the correspondence, and no more than two years. - **Inactive accounts.** We may delete an account that has not been used for 24 months, after emailing you first, and everything above then applies. ## Your choices and your rights Wherever you live, you can: - **See and download it.** Request an export from your account page or by writing to support@jobenvoy.ai. The account export includes your account, resume files and versions, saved answers, envoy and application records. Contact us for access to other personal data covered by an applicable access right, including provider-held data not included in the self-service export, subject to lawful exceptions. - **Correct it.** Edit your resume, saved answers and envoy at any time, and your name and email from your account page. - **Delete it.** Delete your account from your account page, or by writing to support@jobenvoy.ai. The section above says what happens and what stays. - **Stop emails.** Every email links to your choices, with one button to stop them all. Emails about the account itself, such as a change to it, an export being ready, or its deletion, are always sent. - **Stop analytics.** Turn analytics off on your account page, or with Analytics at the foot of the page. You can also turn on Do Not Track to disable PostHog capture, block analytics services in your browser, or contact us to object to processing or withdraw consent where applicable. These controls are distinct from deletion of activity already collected. - **Withdraw consent.** Where we rely on your consent, you can withdraw it at any time, without affecting what was done before, by changing or deleting the data or the choice concerned. Where EEA, UK or Swiss data-protection law applies, you may have rights to access, correction, erasure, restriction, objection, portability, and protection against certain automated decisions. These rights have legal conditions and exceptions. You may complain directly to your competent data-protection authority, including the UK Information Commissioner's Office; contacting us first is not required. Where the California Consumer Privacy Act applies, rights include knowing, accessing, correcting and deleting personal information; opting out of sale or sharing; limiting certain uses of sensitive information; and freedom from discrimination for exercising rights. We offer the account access, correction and deletion choices above regardless of whether statutory thresholds apply. Categories collected can include identifiers; contact and personal records; professional and education information; protected characteristics and sensitive information you provide; purchases; internet activity and masked recordings; approximate geolocation; and inferences such as job-match indicators. Sources, purposes, recipients and retention criteria appear in the corresponding sections. We do not sell personal information. The ad measurement events described under Advertising measurement may count as sharing for cross-context behavioural advertising under some laws. You can opt out with the Analytics switch or Global Privacy Control. We do not disclose it for third parties' own direct marketing. Other applicable state privacy laws may provide rights to access, correct, delete and obtain data, and to opt out of targeted advertising, sale or certain profiling. Scope, thresholds and exceptions vary by state. You can appeal a refusal by replying to our response. We will review the appeal within the applicable deadline and explain the result and any available route to your state regulator. We aim to answer appeals within 45 days, or sooner where required. To exercise any right, use your account page or write to support@jobenvoy.ai from the email address on your account, or tell us how to verify that you are you; we may ask for more if we cannot tell. An authorised agent may act for you with your signed permission, and we may still confirm with you directly. We answer within 30 days, or 45 where a law allows and we tell you why, and we never charge for a request unless the law allows it for one that is unfounded or excessive. We will not treat you differently for exercising a right. ## Security How we protect your data: - We use account-level authorisation and database row-level controls for personal records to restrict access. Privileged services and authorised operators have access needed for their functions; these controls are not a guarantee that unauthorised access is impossible. - Resume files and exports are kept in private storage. Temporary signed links allow downloads until they expire. A signed link is a bearer credential and may be used by someone who obtains it; do not forward it to someone you do not want to have the file. Stored tailored-resume files are checked against recorded hashes when read. - Public service connections use TLS. WorkOS handles sign-in; we do not receive your sign-in password. Access tokens expire, and refresh credentials can keep you signed in until revoked or expired. - Model calls pass through a dedicated gateway. Internal permissions restrict service access, and secrets are managed separately from application source code. - Protected saved answers are excluded from model prompts and application logs. They are processed in the browser when you view them or request a fill, including being written into the form. The extension does not persist them in its storage. - Access to production is limited to the people who run the service, over authenticated channels. No system is perfectly secure, and we cannot guarantee that yours or ours will not be breached. If a breach affects your data, we will tell you and any authority the law requires without undue delay, and in any event within the time the law sets. Please keep your email account secure, since it is how you sign in. ## Children Job Envoy is for adults aged 18 and over. We do not knowingly offer accounts to children. If you believe someone under 18 has provided personal data, write to support@jobenvoy.ai so we can investigate, close the account and delete the data as required by law. ## Other sites and services Employers, job boards and other linked services have their own privacy practices. Read their notices before filling or submitting a form. We do not control their independent processing; this does not remove our responsibility for our own processing or for providers acting on our behalf. ## Changes to this policy We will post revisions with their effective date and email you at least 14 days before a change affects how we use your data or reduces your rights, with any additional notice required by law. Where a new use requires consent, we must obtain it before beginning that use. Continuing to use Job Envoy does not waive your privacy rights or supply consent that the law requires separately. Existing commitments remain applicable to data already collected unless a change is lawfully made. This version takes effect on 22 October 2026. ## Contact Anthid LLC, a Delaware limited liability company doing business as Job Envoy, located in Seattle, Washington, United States. Email support@jobenvoy.ai for anything about your data, this policy or your rights. We answer within 30 days.