Privacy Policy

SpotApply LLC, an Ohio limited liability company ("SpotApply", "we", "us", "our"), operates SpotApply and is committed to protecting your personal data. This Privacy Policy explains what data we collect, how we use it, and your rights.

1. What data we collect

• Account data: Email address and name provided at sign-up via Supabase Auth or Google OAuth.
• Resume data: The resume file you upload and the structured profile fields extracted from it (name, skills, experience, education, etc.).
• Application data: Job listings discovered, matching scores, tailored documents generated, and application statuses.
• Work-authorisation and preference data (only what you enter): your work-authorisation status, visa status, EAD end date, whether you expect to need sponsorship, your preferred country and locations, and — if you turn it on — the places you are willing to relocate to and by when. You enter these yourself; none of them is inferred from your resume. We use them to filter out jobs you are not eligible for, and to prepare answers to the work-authorisation questions application forms ask. Where the answer depends on something we do not hold, the product asks you to confirm rather than answering for you. You can clear any of these fields from your profile at any time.
• Usage data and security logs: API request logs, pipeline run timestamps and error events used for debugging and improving the service. When a request is refused — for example a failed sign-in or too many requests — our servers also log the IP address and browser type to protect accounts from abuse; these logs are kept by our hosting provider for a limited period.
• Activity data: the time of your last meaningful action in the app (for example uploading a resume, opening or tailoring a job, or pressing Resume). Background polling by an open tab does not count. We use it only to decide whether to keep running your automatic job search: after a period with no activity it pauses, and you can resume it at any time.
• Product analytics: whether you reached steps such as signing up or uploading a resume, recorded under a one-way coded identifier instead of your name or email. A few operational records (for example that a document was downloaded, that your profile was completed, or why a job was or was not placed on your board) are stored with your account ID so we can investigate problems. None of them contains resume text, job text or work-authorisation data, and we use them only in aggregate or to fix your account.
• Job emails (only when you click Sync Job Emails): on Gmail or Outlook in your browser, the SpotApply extension shows a "Sync Job Emails" button. Nothing is read until you click it. When you do, it reads the messages listed in your inbox — sender, subject, date and the short preview text — and sends job-related ones to SpotApply. We use them to detect employer replies, rejections and interview invitations and to add applications you made outside SpotApply; a message we cannot match to an application is saved as a new application record with that preview. We never connect to your mailbox account and never read full messages.
• Your LinkedIn profile (only if you import it): on a LinkedIn profile page the extension shows an Import button, meant for your own profile. When you click it, the extension reads the profile text already shown in that tab and sends it to SpotApply, where we add the work history, education and skills to your profile. You can paste the text or upload LinkedIn's PDF export instead. The extension never logs in to LinkedIn, never opens or visits profiles itself and reads nothing until you click Import.
• Voluntary self-identification (only if you enter it): gender, race/ethnicity, veteran status and disability status, which some employers ask about. Each field defaults to "Decline to self-identify". We use what you save only to answer the same voluntary questions on application forms you fill with SpotApply, never for matching or scoring, and you can clear it at any time.
• Public profile (only if you turn it on): your profile is private by default. If you switch on "Public profile", a shareable page and our recruiter search show your name, title, city, skills, availability, work authorisation, whether you need sponsorship, salary range and LinkedIn/GitHub links — never your email or phone. Switch it off and the page and search listing disappear.
• Reviews: if you write a review, we store it. It is shown publicly, with your first name only, if you tick the box that allows it.
• On your device: the browser extension keeps your sign-in token, the application you are filling and your extension settings in Chrome's extension storage on your computer. See our Cookie Policy for what the website stores in your browser.

2. How we use your data

• To discover, rank, and match job listings to your profile.
• To generate tailored resumes and cover letters for each application.
• To auto-fill job application forms on your behalf.
• To send you notifications about new matches and your job search: in the app, and by email to your sign-in address unless you turn email notifications off (Settings → Email notifications, or the unsubscribe link in any of these emails). We send at most a few a day.
• To maintain your application history and pipeline state.

Your data is never sold, licensed, or shared with third parties for advertising purposes.

3. Data storage

Your data is stored in Supabase (PostgreSQL database and file storage) on AWS infrastructure in the United States (us-east-1), and the application runs on Railway. If you are outside the United States, using SpotApply means your data is transferred to and processed there. Resume files are stored in Supabase Storage and are accessible only to your account; application data is stored in a private PostgreSQL database.

4. Third-party services

• Supabase (US) — authentication, database and resume file storage.
• Railway (US) — hosting for the application itself.
• Anthropic (Claude) (US) — the model that scores jobs against your resume and writes your tailored resume and cover letters. It receives your resume text and the job posting. Governed by Anthropic's data processing terms.
• OpenAI (US) — the cheap first-pass model that pre-screens jobs before Claude sees them, and a fallback for one fact-checking step. It receives an extract of your resume (about the first 4,000 characters) and the job title, company and description. Governed by OpenAI's API data policy. This runs on essentially every job we score for you, so in practice your resume text reaches both providers.
• Stripe (US) — payment processing. Payments are on hold while Pro features are free for everyone; when they are open, Stripe receives only what is needed to take a payment, and we never see or store your card details.
• Google Workspace (US) — sends our account emails, such as password-reset and sign-up confirmation messages, and receives mail sent to our @spotapply.ai addresses. It receives your email address and the message we send you.
• Resend (US) — delivers our notification emails (new job matches and updates about your search) while email notifications are on. It receives your email address and the content of each email.

None of these providers is permitted to use your data to train their models under the API terms we use. We do not sell or license your data, and we do not share it for advertising.

5. Where job listings come from

We read job postings from public sources only: company applicant-tracking boards that publish an open API or feed (Greenhouse, Lever, Ashby, Workday, SmartRecruiters, Workable and similar), public job-board feeds and APIs, and licensed aggregators. We respect robots.txt.

We do not scrape LinkedIn or Indeed and we never log in to them on your behalf. Listings that originate there reach us through a paid third-party aggregator API or a public feed, and we show them to you as a link you open yourself. Auto-fill runs only on the application form you choose to open, and nothing is ever submitted without you clicking Submit.

6. Your rights (GDPR / CCPA)

You have the right to:

• Access your data — request a copy of all data we hold about you.
• Correct your data — update your profile at any time from the dashboard.
• Delete your data — request full account deletion from Settings → "Delete my account". This permanently removes all your jobs, applications, profile data, and uploaded files.
• Export your data — download your application history as CSV from the dashboard.

To exercise any of these rights, email us at privacy@spotapply.ai or use the in-app delete flow.

7. Data retention

We retain your data for as long as your account is active. If you delete your account, all data is permanently removed within 30 days.

8. Cookies

SpotApply uses no tracking, analytics or advertising cookies. We use one strictly necessary cookie (sb_token) and browser storage to keep you signed in and remember your settings, and our pages load no third-party trackers, fonts or scripts. The full list is in our Cookie Policy.

8a. Children

SpotApply is for adults looking for work. You must be at least 18 to create an account, and we do not knowingly collect personal data from anyone under 18 (or under 13, the age covered by the U.S. Children's Online Privacy Protection Act). If you believe someone under 18 has given us personal data, email privacy@spotapply.ai and we will delete it.

9. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you via email or an in-app notice for material changes.

10. Who is responsible for your data

SpotApply LLC, an Ohio limited liability company located at 3227 Bishop Street, Unit 7, Cincinnati, OH 45220, United States, is the data controller for the personal data described in this policy. For any privacy question, or to exercise the rights in section 6, email privacy@spotapply.ai or call (513) 400-3765, and we will respond within 30 days.