Privacy Policy
Internal review draft v0.3 — revised 22 October 2026; not effective or ready for publication. Bracketed fields must be completed. Proposed features and controls must be implemented and verified before they are promised to customers. Operator: [LEGAL ENTITY NAME], Beijing, China. Address: [REGISTERED ADDRESS]. Support: [SUPPORT EMAIL]. Effective date: [DATE]. These drafts concern the desktop Chrome extension only.
1. Who is responsible
[LEGAL ENTITY NAME], located at [ADDRESS] in Beijing, China, is responsible for the processing described here. Contact [PRIVACY EMAIL]. [Complete representative or data-protection officer details where legally required.] This notice covers the desktop Chrome extension and its supporting API; it does not replace the separate Web App notice. Shared account records must be handled consistently with their actual purposes.
2. Information, sources and purposes
| Category | Source and intended purpose |
|---|---|
| Account and authentication records | You and the selected identity provider; account access, session security and recovery |
| Resume content, versions and confirmations | Materials you provide; resume management, requested comparison and optimization |
| Job descriptions, links and necessary page metadata | Supported pages you authorize or a disclosed job-data source; requested job analysis and saving |
| Saved jobs, application states and notes | Your actions; application organization and history |
| Orders, subscription status and usage records | You, our billing system and payment provider; billing, benefits, refunds and dispute resolution |
| Policy acknowledgements and preferences | Your choices; evidence of the version and permissions presented |
| Limited security and error records | Service operation; reliability, abuse prevention and investigation |
[Verify exact fields and whether IP addresses, device characteristics or diagnostic events are actually collected.] We do not need general browsing history, unrelated page contents, keystroke monitoring or invasive device fingerprinting for ordinary job assistance. Any additional collection must be necessary, disclosed and appropriately authorized before it begins.
2.1 How requested features process your materials
You provide a resume for parsing, review and confirmation. Confirmed resume information and generated resume versions are associated with your account on our supporting service; this is not a device-only product. Comparing jobs uses the confirmed resume and job information obtained through supported official APIs or browser reading initiated by you. Where supported, a requested search can collect subsequent pages or load additional listings and retrieve job details for comparison. It is not limited to the text initially visible on screen. Selected job content, analysis results, saved jobs and application records may be processed or stored by our service for the requested features.
AI assistance is a separate, explicit request. The AI preparation path selects relevant resume source lines and structured professional information, together with job title and description content. It applies filters for detected identity/contact information and certain sensitive eligibility fields before sending this payload to the configured model service. These filters are not a guarantee that every identifier is removed: professional experience and job text may still identify a person. This processing must not be described as anonymous or as never sharing resume content externally. The output and proposed changes are checked against source facts; the final material reuses the reviewed changes rather than requiring a fresh model rewrite when you confirm or export it.
Application assistance writes supported information into the application page at your request. It does not itself submit the application or automatically attach your resume file. Your subsequent submission sends information to the recruiting site under that site's policies. Downloaded PDFs are also subject to your own device and sharing choices. Disconnecting, uninstalling, cancellation, refund and server-side deletion have different effects.
Internal release note: the above describes implemented development paths. Production AI is not enabled. DeepSeek is the development generation route; GLM generation fallback remains disabled, and glm-5.3-flash is a separately evaluated moderation candidate, not a deployed production processor. Before publication, align this description and the provider table with the actual enabled release. Source:
services/extension-api/src/ai/semantic.ts, AI launch and content-safety checkpoints. Do not imply all matching uses AI.
3. Permissions and optional choices
The extension requests website access for the relevant supported features, not unrestricted access by virtue of a subscription. Google connection is requested through its own permission flow. Disconnecting an integration stops future access as applicable but is not the same as deleting previously stored records or canceling a subscription.
Marketing messages, non-essential analytics or tracking, and any optional research participation require separate choices where applicable. They are not bundled into payment or required to receive core contracted features. Necessary service and security communications are distinguished from marketing. Launch design excludes use of identifiable resumes for general-purpose model training; this claim cannot be published until provider contracts and settings also support it.
4. Legal grounds
Where a legal-basis framework applies, we map each purpose to its actual basis: necessary contract performance for requested features; legal obligations for required records; proportionate legitimate interests where available for security and service operation after a balancing assessment; and consent for relevant optional purposes. [Complete purpose-by-purpose basis and balancing assessment.] Acknowledging this notice is not consent to every possible data use. You may withdraw an optional consent without losing unrelated paid features.
5. Service providers and other disclosures
The release provider register must identify the following roles separately. A candidate or development integration is not a production processor designation.
| Role | Data involved | Current preparation and publication condition |
|---|---|---|
| Identity and transactional email | Sign-in identity, email address, authentication/service messages | Identify enabled Google sign-in and actual OTP/email operator, locations and terms before release; never send resumes in login emails. |
| API hosting, database and backups | Account records, confirmed resumes/versions, job and application records, results and operational metadata | Shared existing account/business facts; development storage does not establish production hosting region or backup schedule. Complete actual operators, regions and deletion procedures. |
| Requested AI generation and factual review | Filtered professional resume evidence, relevant job content and generated edits | Development DeepSeek route only. Production provider-specific retention, training use and transfer safeguards remain unverified; do not publish zero-retention/no-training claims. |
| Optional production content-safety processing | The input/output text actually subject to that processing | GLM candidate tested only with fictional texts. Not currently mounted as production processing; disclose actual scope/provider before enabling. |
| Payments and customer billing | Checkout contact, purchase/order/subscription/refund facts | Pancake test integration completed; live approval and production enablement pending. Career materials are not needed for ordinary checkout. |
| Customer support and privacy requests | Sender address, request text and necessary verification/order reference | Proposed domain alias forwarding to operator-controlled Outlook; alias/delivery verification still pending. Namecheap forwarding and Microsoft mailbox handling must be disclosed if this route is deployed. Do not request whole resumes for ordinary billing questions. |
[Before publication: complete legal processor names, relevant policy links, processing/access countries, retention and contractual safeguards for each enabled role.] Payment card details are handled through the selected provider; we do not request full card details through support or store raw card credentials in the extension.
We do not sell personal career materials or disclose them to employers merely because you use matching. Submission remains your decision. Legal requests, security investigations or business transfers are handled only on an appropriate basis with necessary safeguards and notices where required. A business transfer does not create an unrestricted new use of your resumes.
6. International processing
Operating from Beijing does not mean that all data remains in China. [List actual processing and access countries.] Where EU/EEA or UK transfer rules apply, complete the applicable adequacy or safeguard assessment, contracts, transfer-risk review and supplementary measures before transfer. Do not rely on one generic checkbox as a routine substitute for required safeguards. You may request information about applicable safeguards through [PRIVACY EMAIL]. European country coverage and UK rules must be assessed separately.
7. Retention and deletion
| Record | Verified boundary and remaining release requirement |
|---|---|
| Account, confirmed resume versions, saved/generated materials and application records | Persistent account facts, not automatically erased by cancellation, refund, sign-out or uninstall. Complete deletion scope, implementation, verification and fulfillment deadline before promising a fixed period. Shared records require coordinated handling across products. |
| AI computation cache | Implemented encrypted cache has a 24-hour reuse lifetime. Reads exclude expired entries; expired eligible rows are cleaned during subsequent computation claims. This is not a promise of physical deletion precisely at 24 hours, and it does not govern saved resumes, artifacts or provider copies. |
| Provider prompts/outputs | Provider-specific API retention, training use and deletion terms remain unresolved for production. No zero-retention promise. |
| Matching analyses and generated artifacts | Distinguish reusable computation from persistent user-visible results. Input/version invalidation is not proof that historical records or backups were erased. Complete actual purge and backup propagation. |
| Billing, consent, enforcement and security evidence | May require separate retention after career-material deletion for legal obligations and disputes. Set justified periods by record/category and market, rather than retaining all resume text with billing evidence. |
| Logs and backups | Verify actual redaction, access and rotation. Complete production retention and delayed-deletion schedule; no instant all-backup erasure promise. |
7.1 Deletion requests and limits
The published policy must provide a working privacy contact for access, correction and deletion requests. Until an end-to-end account/material deletion process is verified, this draft does not claim a self-service delete-account button or completion within a specific number of days. Support intake alone is not proof of deletion capability. The operator must verify ownership proportionately, coordinate shared records, remove applicable live data and caches, address provider copies where required, and explain legally retained records and backup expiry. Cancellation or a refund must not be represented as a deletion request.
Internal release checks: test deletion with a fictional account, including confirmed resume versions, generated artifacts, saved jobs/application notes, caches, sessions and sharing/ownership relations; separately verify billing/security exceptions and backup rotation. Do not delete another product's lawful shared facts without a coordinated process. Downloads and copies already sent by the user to third parties are outside direct server deletion control.
We retain only records needed for the stated purpose, a legal requirement or a justified dispute/security need. Deletion may not immediately remove lawful billing evidence or rotated backups; applicable time frames must be explained. Deleting an account, banning extension access and stopping renewal are different actions and must be coordinated so billing is not left active unintentionally. Uninstalling the extension does not itself delete server records.
8. Security and incidents
Our release controls must include appropriate access restrictions, secure transport, account isolation and restricted operational access. No absolute guarantee of security is made. We investigate incidents and provide notices to affected people and authorities where required. Resume contents should not be copied into unrestricted diagnostic logs.
9. Your rights and requests
Depending on applicable law, you may request access, correction, deletion, restriction or portability, object to certain processing, withdraw consent and complain to the relevant regulator. Contact [PRIVACY EMAIL] or [REQUEST URL]. Verification is proportionate; we do not routinely ask for identity documents where a less intrusive method suffices. [Complete applicable response periods, exceptions, appeals and regulator contacts.] No fee is imposed unless legally permitted.
Where relevant US state privacy laws apply, complete a separate applicability assessment and supplement covering required disclosures and request mechanisms. Do not claim every US resident has an identical set of rights. EU/UK rights and representatives are added where their requirements apply.
10. Age, changes and contact
The approved age rule is [AGE RULE]. We do not knowingly solicit children's information inconsistent with it; if discovered, we assess removal and necessary safeguards. Major purpose or provider changes are notified before the affected processing and require fresh consent where applicable. Contact details, effective date and previous versions remain accessible.
Internal revision evidence — 22 October 2026
This revision completes product-specific processing descriptions, candidate/production distinctions and verified cache semantics. It does not create new retention periods, provider guarantees, customer rights interfaces or production authorization. Remaining publication gates: legal operator/contact; enabled production providers and regions; provider retention/training/transfer terms; tested deletion and backup schedules; applicable market/age/legal-basis review. See AI-PRODUCTION-DATA-CONDITIONS-2026-10-12.md, AI launch checkpoint, content-safety validation and services/extension-api/src/ai/state.ts.