1. Information we collect
- Account and security: name, email, authentication provider, password hash for legacy email accounts, sessions, IP address, user agent, and security/rate-limit events.
- Resume and profile: contact details, education, work history, skills, confirmed facts, preferences, work authorization, answers you save, and optional self-identification information.
- Applications: jobs selected, job descriptions, tailored drafts and PDFs, form questions, application states, receipts, redacted command diagnostics, and your corrections.
- Agent and device: paired-device identifier, app version, platform, last-seen time, command status, and redacted diagnostics. Chrome cookies, browser history, page HTML, and your Keychain token remain on your Mac and are not uploaded as browser history.
- Usage and purchases: point grants and ledger events, model/token/cost measurements, referral status, plan, amount, currency, Stripe Checkout and payment-intent identifiers, and refund status.
Source resume files are read to extract profile data and are not kept after that upload request. Generated drafts and exact PDFs are kept so you can review what was prepared and sent.
2. Shared form-question observations
To improve form coverage, we maintain a cross-user corpus called question observations. It stores the normalized question text, field type, available choices, whether the field was required, employer/company name, applicant-tracking-system type, observation counts, and whether the question was resolved locally, by drafting, manually, or not at all. It does notstore the answer, user ID, email, resume, page HTML, or application ID. Because these rows are deliberately not linked to an account, account deletion does not remove aggregate question-observation rows. Do not put personal information into a form’s question label.
3. How we use information
- provide authentication, resume tailoring, applications, receipts, support, referrals, and purchases;
- operate the local Agent, synchronize status, and stop on ambiguous or unsafe work;
- secure accounts, prevent fraud and point abuse, diagnose failures, and enforce our Terms;
- measure model cost and product reliability and improve form-question coverage;
- comply with law, resolve disputes, and maintain transaction records.
Depending on where you live, our legal bases are performance of our contract, your consent where the law requires it, our legitimate interests in operating and securing the Service, and compliance with legal obligations. Optional demographic, disability, veteran, and similar answers are used only as you direct for applications. We do not use them to make hiring or eligibility decisions.
4. When information is disclosed
- Employers and application platforms: when the Agent fills or submits an application you selected.
- Service providers: Railway and other hosting, authentication, model, email, observability, and support providers receive only what they need for their function.
- Stripe: receives purchase and account contact data and directly handles payment details. We do not store full card or Alipay credentials.
- Legal and safety: when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or complete a corporate transaction subject to appropriate safeguards.
We do not sell personal information, share it for cross-context behavioral advertising, or use advertising SDKs.
5. Retention and security
Account content is retained while your account is active and until you delete it, subject to limited backups, fraud/security records, transaction records, and other information we must retain for legal obligations or disputes. Expired sessions and operational data are removed or aggregated as they are no longer needed. Question observations follow the separate, answer-free rule described above.
We use access controls, HTTPS, revocable device credentials, Keychain storage on the Mac, encryption at rest for sensitive saved answers, and least-data diagnostics. No security measure is perfect; contact us immediately if you suspect unauthorized access.
6. Your choices and privacy rights
Profile settings let you correct information, download an account export, revoke devices, and delete your account. You may also contact us to request access, correction, deletion, portability, restriction, or objection where applicable. We may verify the request and retain information when the law permits or requires it. We will not discriminate against you for exercising a privacy right.
California residents may have rights to know/access, correct, delete, limit certain uses of sensitive personal information, opt out of sale or sharing, and receive equal service. Because we do not sell or share personal information for behavioral advertising, there is no sale/share opt-out needed for the current Service.
7. International use and children
The Service is operated from the United States. If information is transferred from another country, we use safeguards required by applicable law. TailorOffer is for adults and is not directed to children under 18; contact us if you believe a child created an account.
8. Changes and contact
We will post updates here with a revised effective date and provide additional notice for material changes when appropriate. Questions or requests: support@tailoroffer.com.