Privacy Policy

This policy explains what FindAJobAI collects, why, who processes it, how long we keep it and how you can export or delete it. FindAJobAI is operated by IE Tornike Shioshvili (Individual Entrepreneur registered in Georgia) ("we", "us"), the controller of the personal data described here. You can reach us about anything in this policy at support@findajobai.com.

FindAJobAI is built for job seekers in the United States and Europe. This policy covers the rights you have under the EU and UK General Data Protection Regulation (GDPR) and under US state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA); see Your rights and US state privacy rights.

What we collect

• Account: you sign in either with a username and password (the password is stored only as a salted hash) or with Google. With Google we receive your name, email address, profile picture and a Google account ID; we don't get your Google password or access to your mailbox. A username account holds no email address unless you choose an email as your username.
• CV / resume: the PDF or DOCX file you upload, the text extracted from it and the structured profile built from it (experience, education, skills and any contact details you included).
• Job preferences: your onboarding answers, such as target roles, locations, remote preference and salary.
• Matches and documents: match scores for jobs, jobs you like, save, hide or skip, the tailored resumes and cover letters generated for you, and ATS keyword reports.
• Application tracking: the status and notes of each application in your tracker.
• Inbox: emails that companies send to your private FindAJobAI inbox address, and your replies. See Inbox below.
• Browser extension: the address of the application pages it works on and, if you allow it, the answers you type into application forms. See Browser extension below.
• Billing: your plan, subscription status and payment history (dates, amounts, tax, refunds) and the customer, subscription and transaction IDs that Creem, our merchant of record, assigns to your purchase. Your name, billing address and card or other payment details are entered on Creem's checkout and never reach our servers; we don't receive your card number.
• Technical and security data: IP address, browser type, requested pages and timestamps in server logs, and short-lived hashed counters of sign-in and API requests used for rate limiting and abuse protection.

FindAJobAI is not meant for children: you must be at least 16 to use it, and we don't knowingly collect data from anyone younger. If you believe a child has created an account, contact us and we will delete it.

Inbox

Every account gets a private address such as [email protected]. If you turn on “Use my FindAJobAI inbox address on applications” (on by default for new accounts), the extension puts this address on application forms instead of your own email, so employers' replies come to FindAJobAI.

• What we store: each email sent to your address (sender, recipients, subject, date, the text, the HTML with scripts and tracking removed, technical headers used for threading and spam checks) and its attachments up to 10 MB each and 25 MB per email. Executable and script files are never stored. We also store the replies you send from the inbox and the timeline of automatic status changes.
• How it is used: free rules sort each email (received, interview, assessment, rejection, offer, recruiter outreach) and link it to the matching application, whose status is updated automatically (you can undo it). Only when the rules can't tell, the subject and the first ~1,200 characters of the email are sent to Anthropic (see below) to classify it; this stays within your daily AI budget. Interview times and deadlines found in an email are added to your calendar.
• Forwarding: a copy of each email is forwarded to your confirmed email address (your recovery email, or your Google sign-in address) so you never miss anything; you can turn this off in Settings. Emails you forward to the inbox from your own mailbox, and forwarding-confirmation emails, are never sent back. Without a confirmed address, emails stay in the app only.
• Receiving: mail for inbox.findajobai.com is received by our email provider (Resend, or Cloudflare Email Routing) and passed to our server. Obvious spam and mail for unknown addresses is dropped without being stored.
• Retention: inbox emails and attachments are deleted automatically 12 months after they arrive. You can delete a conversation at any time, and getting a new address in Settings stops the old one from receiving mail. Deleting your account deletes the inbox, and the data export includes it.

Browser extension

The FindAJobAI Autofill extension for Chrome, Microsoft Edge and other Chromium browsers runs only on the job application sites listed in its permissions (Greenhouse, Lever, Ashby, Workable, SmartRecruiters, Workday and iCIMS, including their EU sites) and on other pages only when you click its toolbar button there. It talks only to FindAJobAI, using the token created when you connect it.

• To fill a form it sends us the address (URL) of the application page, so we can find the job, and receives your profile, resume file, cover letter and saved answers. It doesn't send us the page's contents.
• Learned answers (“learn once”): when you type or choose an answer to a question on an application form (text boxes, text areas, drop-downs, radio buttons, groups of checkboxes and similar choice widgets), the extension can send us the question text, your answer, the options the question offered, the kind of field and the page address and host. We store them in your account and fill them in the next time a form asks the same question. It never ticks consent boxes, and it doesn't save contact fields your profile already covers.
• Never collected, even if you type them into a form: passwords, card numbers, CVV and expiry dates, bank, account, IBAN, routing and sort-code numbers, social security, national ID, passport and tax numbers, one-time codes and captchas, file uploads and hidden fields. Diversity answers (gender, race or ethnicity, veteran status, disability, sexual orientation, pronouns) are kept only if you turn on “Include diversity answers”.
• You choose. The first time you type an answer on an application form, the extension asks “Remember answers you type on application forms?” and sends nothing until you clickYes. If you click No, the setting is turned off. You can change it at any time with “Remember my answers automatically” in Profile → Application answers. With it off, answers are saved only when you click “Save answers from this page” in the extension.
• See and delete them in Profile → Application answers: edit or delete any answer there, and deleting your account deletes all of them. Turning “Include diversity answers” off deletes the diversity answers already learned.
• On your device the extension keeps its settings, the connection token, your answer to the prompt above and a short queue of answers waiting to be sent (usually for a few seconds) in the browser's extension storage.

Learned answers are used only to fill in your own applications. They are not sold, not used for advertising, not shared with employers until you submit a form yourself, and not sent to AI models.

The use of information received through the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements, and to the Microsoft Edge Add-ons policies. We use it only to provide the extension's single purpose (filling in and tracking your own job applications), we don't transfer it to third parties except the hosting providers that run FindAJobAI, and no person reads it unless you ask us to (for support), it's needed for security or the law requires it.

How we use it and why (legal bases under the GDPR)

• to create and secure your account and keep you signed in (performance of our contract with you);
• to find and score jobs that fit your profile (contract);
• to generate tailored resumes, cover letters and ATS reports when you ask for them (contract);
• to fill in application forms through the extension when you ask it to; you always review and submit yourself (contract);
• to send optional email notifications about new matches, where email sending is enabled and your account has an email address; you can turn them off at any time (contract, or your consent where required);
• to take payments, keep billing records and meet tax and accounting duties (contract and legal obligation);
• to keep the Service secure and working: rate limiting, abuse prevention, logs and backups (our legitimate interest in running a safe service).

We do not sell your data, use your CV or profile for advertising, or use your CV to train AI models. The optional Meta Pixel (see Advertising cookies) measures our own ads. Where we rely on your consent (for example the extension's “remember my answers” setting), you can withdraw it at any time without affecting what was done before.

Automated scoring and profiling

FindAJobAI uses automated processing, including AI models, to compare your profile with job postings and give each job a 0–100 match score with reasons, and to score how well your CV fits a job description (ATS report). This is profiling in the GDPR sense. It only ranks and explains jobs for you: it does not decide anything about you, isn't shared with employers and has no legal or similarly significant effect. Employers never see your scores. You can ignore any score, edit your profile to change the inputs, or object by emailing us.

Who processes your data

We use these service providers (processors), each only for the purpose listed:

• Anthropic (Claude), USA: AI features. To score matches, parse your CV and write tailored documents and ATS reports, the text of your CV and profile, your preferences and the job descriptions involved are sent to Anthropic's API. Anthropic processes it on our behalf under its commercial terms and does not use API data to train its models. Search embeddings are computed on our own server and not sent to any AI provider.
• Cloudflare, USA / global network: DNS, content delivery and security. All traffic to FindAJobAIpasses through Cloudflare, which therefore sees IP addresses, request details and page content in transit, and may set strictly necessary security cookies (for example __cf_bm). Cloudflare Email Routing also forwards messages sent to our @findajobai.com addresses.
• Resend, USA: email sending and receiving. When email sending is enabled, Resend receives your email address and the content of the service emails and notifications we send you (including inbox copies and your replies), in order to deliver them. When inbox receiving runs on Resend, it also receives the emails sent to your inbox address.
• Google, USA: sign-in. If you choose “Continue with Google”, Google authenticates you and shares the profile details listed above with us. Google processes your data under its own privacy policy.
• Creem (Armitage Labs OÜ, registered in Estonia): payments, as an independent controller. When you buy a plan you complete the purchase on Creem's checkout. Creem is our reseller and merchant of record: it sells the plan to you, takes the payment, calculates and remits VAT or sales tax, issues invoices, handles refunds and disputes and prevents fraud. For that it collects your name, email address, billing address and payment details, and we pass it your account ID, the plan you chose, your email address (if your account has one) and, if you arrived through a partner link, the referral code, so the payment can be matched to your account. Creem processes this data as an independent controller under its own Privacy Notice, together with its payment providers and the card networks. We receive from Creem the payment result, the amounts, tax and refunds, the subscription status and dates, and Creem's customer, subscription and transaction IDs; we never receive your full card number.
• Google Ireland Limited (Google Analytics), Ireland / USA: site analytics. See Analytics cookies. Google receives the pages visited on our site (without personal query parameters), the referring site, device and browser details, the IP address (used for an approximate location and not stored by Google Analytics) and the sign-up, checkout, purchase and extension install events listed there, and processes them on our behalf under its data processing terms.
• Microsoft Corporation (Microsoft Clarity), USA / Ireland: heatmaps and session replays. See Microsoft Clarity. Microsoft receives clicks, scrolls and other page interactions, the pages visited, device and browser details and the IP address (for an approximate location), as heatmaps and masked session replays: form inputs and everything inside the signed-in app are masked in your browser before upload. It processes them on our behalf.
• Meta Platforms (Meta Platforms Ireland in the EU/EEA/UK/Switzerland), USA / Ireland: ad measurement, only if the Meta Pixel runs for you. See Advertising cookies. Meta receives page visits and sign-up, checkout and purchase events (with the plan price) together with its own cookie and browser details, and processes them under its own terms and privacy policy.
• Hosting provider: servers. FindAJobAI's application, database, file storage and backups run on a virtual private server (VPS) rented from a hosting provider, which stores the data on our behalf and has no right to use it.

Job sources (public job boards and career-page APIs) receive no personal data: we fetch listings with generic queries only. Employers receive your information only when you submit an application to them yourself.

International transfers

Some of the providers above (Anthropic, Cloudflare, Resend, Google, including Google Analytics, Microsoft (Clarity) and, if the Meta Pixel runs for you, Meta) are based in the United States or process data worldwide, and FindAJobAI itself is operated from outside the European Economic Area, so your data may be transferred outside the EEA and the UK. Creem is established in the EU (Estonia); the payment providers it uses may process payment data in other countries under their own safeguards. We only use providers that protect such transfers with recognised safeguards, such as the European Commission's Standard Contractual Clauses (and the UK Addendum) or the EU–US Data Privacy Framework (and its UK Extension) where the provider is certified. You can ask us for more information about these safeguards and for a copy of them.

Launch waitlist and referral links

Waitlist. If you ask to be notified when paid plans launch (on the pricing page), we store your email address, the plan you said you were interested in (if any), which page you signed up on, the referral code you arrived with (if any), and the time and wording of your consent: "Email me once when paid plans launch. I can unsubscribe or ask for my email to be deleted at any time." The legal basis is your consent. We use it only to send one launch email; we don't send anything before then and we don't share the list with anyone. We delete the list once the launch email has been sent, and in any case no later than 12 months after you signed up. You can withdraw consent and have your entry deleted at any time by writing to support@findajobai.com.

Referral links. Some links to findajobai.com carry a referral code (for example ?ref=partner) so we can tell how many people a partner sent us. We count visits per code and day without storing IP addresses or anything else about the visitor. If you create an account, the code you first arrived with is saved on your account. Partners only ever see totals for their code (visits, sign-ups, completed onboarding, paying customers and revenue), never who you are.

Interview helper

The extension's interview helper is optional and off until you start it yourself for one interview (you can also turn it off completely in Settings). Before the first use it shows a short notice, and we record when you accepted it.

• No audio is stored. The sound of the interview tab is turned into text while you use the helper and is never saved by us or sent to FindAJobAI's servers.
• Speech-to-text. Where we have enabled it, the audio is streamed directly from your browser to Deepgram, Inc. (USA), which transcribes it on our behalf as a processor using a short-lived access token; otherwise your browser's built-in speech recognition is used, which may be provided by your browser vendor (for example Google for Chrome) under its own terms.
• Questions and suggestions. When a question is detected, its text (and up to three earlier questions) is sent to our server and, unless we already prepared points for the same question, to Anthropic to draft short talking points from your own CV, profile, the linked job and your saved answers. We don't store the transcript or the question text: we keep a one-way fingerprint of the question with the talking points for up to 30 days so the same question doesn't cost another AI call, plus session statistics (start and end time, minutes, number of questions, cost).
• Notes. Only if you choose “Save notes” at the end do we keep the questions and talking points of that session. They are included in your data download and deleted with your account.
• Interview stories. Stories you build or write under Interview prep are kept until you delete them. Building them from your CV sends your CV's work experience to Anthropic once per click. To match a question to your approved stories, the question is turned into a numeric fingerprint (embedding) on our own server; it is only cached in the server's memory and never written to the database. Stories are included in your data download and deleted with your account.
• Your responsibility. You use the helper for your own interviews. Recording or transcribing a conversation can require the other participants' consent depending on where you and they are; it's up to you to tell them and to follow those rules and the interviewer's instructions. Questions: support@findajobai.com.

How long we keep it

• Account data (profile, CVs, documents, matches, applications, saved answers) is kept while your account exists.
• Inbox emails and their attachments are deleted 12 months after they arrive (or earlier, when you delete them or your account).
• Sessions expire after 30 days of inactivity or when you sign out. Rate-limiting counters are hashed and deleted about a day after their window ends.
• Google Analytics data is kept for 14 months and then deleted automatically by Google.
• Microsoft Clarity session recordings are kept for 30 days and heatmap and usage data for 13 months, then deleted automatically by Microsoft.
• Server logs are rotated automatically and normally overwritten within a few weeks.
• Backups of the database are kept for 14 days and then deleted, so data you delete disappears from backups within 14 days.
• Billing records (date, amount, plan, masked card, payment reference) are kept for as long as applicable tax and accounting law requires, even after you delete your account; Creem, as merchant of record, keeps its own sales and tax records under its legal obligations.
• When you delete your account, your data and files are removed from our live database and storage immediately, any subscription is cancelled at Creem; the copies in backups expire within 14 days.

Your rights

Under the GDPR (for users in the EU/EEA and the UK) and other applicable data protection laws, you have the right to access your data, correct it, have it deleted, restrict or object to its processing (including the profiling described above), receive it in a portable format, and withdraw any consent you gave. Two of these you can use yourself in Settings:

• Download my data gives you a JSON file with your profile, preferences, CV text, matches, applications, documents and ATS reports (access and portability).
• Delete account permanently deletes your account and associated data and files, and cancels any subscription (erasure).

For anything else, email support@findajobai.com; we reply within 30 days. You also have the right to complain to a data protection authority: if you live in the EU/EEA, the supervisory authority of your country; in the UK, the Information Commissioner's Office (ico.org.uk). We'd appreciate the chance to sort out your concern first.

US state privacy rights (including California)

If you live in California or another US state with a consumer privacy law (for example Colorado, Connecticut, Virginia, Utah, Texas or Oregon), you have these rights, to the extent the law applies to us:

• Know and access: the categories and specific pieces of personal information we hold about you, where it comes from, why we use it and who we disclose it to (Settings → Download my data gives you a copy);
• Delete your personal information (Settings → Delete account), and correct inaccurate information (edit your profile, or ask us);
• Opt out of the sale or sharing of personal information, of targeted advertising and of profiling with legal or similarly significant effects;
• Limit the use of sensitive personal information, and not to be discriminated against for using any of these rights.

Do not sell or share my personal information: we do not sell your personal information. The Meta Pixel (see Advertising cookies) sends Meta the pages you visit on our site and sign-up and purchase events to measure our ads, which some state laws treat as “sharing” for cross-context behavioral advertising. You can opt out at any time: click Cookie settings and choose “Reject”. We honor Global Privacy Control (GPC) browser signals as an opt-out request: with GPC on, the pixel never loads. Our match scores have no legal or similarly significant effect on you (see Automated scoring and profiling). Google Analytics (see Analytics cookies) runs as our processor with Google signals and ad personalisation off, and Microsoft Clarity (see Microsoft Clarity) runs as our processor with advertising storage denied, only to measure and improve our own site; neither is used for advertising. We don't knowingly sell or share data of anyone under 16.

What we collect, in CCPA terms: identifiers (name, email address, account ID, IP address); professional or employment-related information (your CV, work history, job preferences and applications); education information (from your CV); commercial information (your plan and payment history); internet or network activity (server logs and extension activity described above); and inferences (match scores). Sensitive personal information is limited to your account password (stored only as a hash) and, if you choose to save them, diversity answers; we use it only to provide the Service. The sources, purposes, recipients and retention periods are described in the sections above.

How to make a request: use Settings, or email support@findajobai.com from the address on your account. We verify requests by matching them to your signed-in account or its email address, and reply within 45 days. You may use an authorized agent; we may ask the agent for proof of your authorization and ask you to confirm your identity. If we decline a request, you can appeal by replying to our answer; if we still decline, you may contact your state attorney general.

Cookies

We use strictly necessary cookies: the session cookie that keeps you signed in, short-lived security cookies set during sign-in (CSRF protection and the page to return to), and Cloudflare's security cookies. The Service can't work without them. The only other cookie is a first-party referral attribution cookie, set only when you arrive through a partner's referral link and used only to credit that partner if you sign up (details below); in the EU, EEA, UK and Switzerland we set it only if you allow it. It does no cross-site tracking. Apart from Google Analytics, Microsoft Clarity and the optional advertising cookies of the Meta Pixel, all described below, we use no other third-party trackers. In the EU, EEA, UK and Switzerland one cookie banner asks about all of these, and you can change your answers at any time with “Cookie settings” in the footer.

If you arrive through a referral link, we store the referral code and the time of your first visit in a first-party cookie (ap_ref) and in your browser's local storage for 90 days. It contains no identifier of you or your device, only the partner's code, and is used solely to credit that partner if you sign up. You can delete it at any time in your browser settings.

Visitors in the EU, EEA, UK and Switzerland. We ask first, with a small bar: "We use one cookie to credit the person who referred you." We decide whether to ask from the country Cloudflare reports for your connection (the country code only; it is not stored) or, if that is missing, your browser's time zone; when we can't tell, we ask (in the same cookie banner as our other optional cookies, if they are asked about too). Until you choose, and if you choose "No thanks" (or "Reject"), the code is kept only in this browser tab's session storage, which your browser deletes when you close the tab, so a partner can still be credited if you sign up during that visit. If you choose "Allow" (or "Accept all"), we store ap_ref as described above. Either way we remember your choice for 12 months in a strictly necessary cookie (ap_consent, value ref:1 or ref:0); delete it to be asked again. Visits through referral links are counted per code and day for everyone, without storing anything about you.

Analytics cookies (Google Analytics)

We use Google Analytics 4, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) as our processor, to understand how our site is used: which pages are visited, where visitors come from (for example a search engine or a campaign link), the device, browser and approximate location derived from the IP address, and a few events: that someone created an account, started a checkout, paid (with the plan and price), upgraded to Pro or clicked to install the browser extension. Google Analytics doesn't log or store full IP addresses. We never send your name, email address, CV, profile, account ID or the content of your pages: the web address we send contains no query parameters other than campaign tags (utm_*) and the referral code, and record IDs in app addresses are removed. Google signals and ad personalisation are off, and Google Analytics never loads on admin pages or on pages with secure links (password reset, email verification).

Consent. We use Google Consent Mode. In the EU, EEA, UK and Switzerland (and wherever we can't tell your location) analytics cookies (such as _ga) are off until you click “Accept analytics” on our cookie banner; until then, and if you choose “Reject”, Google Analytics receives only cookieless pings without any identifier, and the legal basis for any analytics cookies is your consent. Elsewhere analytics cookies are on by default, on the basis of our legitimate interest in understanding and improving the site. Everyone can change their choice at any time: click Cookie settings (also in the footer of every page). We remember your choice for about 12 months in the ap_analytics_consent cookie. Google Analytics data is kept for 14 months and then deleted automatically. You can also install Google's opt-out browser add-on (tools.google.com/dlpage/gaoptout).

Analytics cookies (Microsoft Clarity)

We use Microsoft Clarity, provided by Microsoft Corporation (One Microsoft Way, Redmond, WA 98052, USA; Microsoft Ireland Operations Limited in the EU/EEA) as our processor, to see how pages are used so we can fix confusing screens: clicks, taps, scrolling, mouse movement, the pages visited, the device, browser, screen size and approximate location, combined into heatmaps and masked session replays. Clarity masks everything typed into form fields, and the whole signed-in app (your CVs, documents, inbox, application answers, settings and profile) is masked too, so its text is replaced before anything leaves your browser. We never send your name, email address, account ID or other personal details to Clarity. Clarity never loads on admin pages or on pages with secure links (password reset, email verification).

Cookies and consent. Clarity uses the first-party cookies _clck (keeps the same anonymous visitor ID, 1 year) and _clsk (joins page views into one session, 1 day). In the EU, EEA, UK and Switzerland (and wherever we can't tell your location) we tell Clarity, through its consent interface, that analytics storage is denied until you click “Accept analytics” on our cookie banner (one choice covers Google Analytics and Clarity); until then, and if you reject, Clarity sets no cookies and can't link your page views across visits. Elsewhere these cookies are on by default, on the basis of our legitimate interest in understanding and improving the site. Advertising storage is always denied for Clarity. Change your choice at any time with Cookie settings; rejecting deletes Clarity's cookies. Session recordings are kept for 30 days and heatmap and usage data for 13 months, then deleted by Microsoft. Microsoft processes this data under its own terms and privacy statement (privacy.microsoft.com).

Advertising cookies (Meta Pixel)

We use the Meta (Facebook) Pixel to measure how well our ads on Facebook and Instagram work. When it runs, your browser loads a script from Meta, and Meta sets its own cookies (such as _fbp) and receives the pages you visit on our site and a few events: that you created an account, started a checkout or paid, with the plan price. We never send your name, email address, CV or profile to Meta. Meta may combine this with what it already knows about you under its own privacy policy. The pixel never runs on admin pages or on pages with secure links (password reset, email verification).

In the EU, EEA, UK and Switzerland (and wherever we can't tell your location) the pixel loads only after you click “Accept” (or “Accept all”) on our cookie banner; the legal basis is your consent. Elsewhere it loads by default. Everyone can turn it off: click Cookie settings and choose “Reject” (or “Accept analytics” only). If your browser sends a Global Privacy Control signal, the pixel never loads. We remember your choice for about 6 months in the ap_ads_consent cookie, and a session cookie (ap_geo) stores only whether your region needs this consent, not your country.

Security

Data is sent over HTTPS, passwords and extension tokens are stored only as hashes, card tokens are encrypted, uploads are checked for file type and size, and requests are rate limited. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the law requires.

Changes and contact

We will announce material changes to this policy by email or in the app before they take effect. Questions or requests: support@findajobai.com.