Privacy Policy

JMV Labs LLC("Company," "we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use HiredFast ("the Service").

We collect the information needed to create your account, operate the product, generate application materials, provide support, prevent abuse, and process billing. This may include:

• Account and authentication information: Name, email address, account identifiers, authentication status, session metadata, confirmation and password-reset events, account settings, referral codes, referred-by relationships, bonus generation balances, marketing email opt-out status, and lifecycle or onboarding email stage.
• Profile and career data: Professional headline, location, phone number, portfolio and LinkedIn URLs, professional summary, skills, work experience, bullets, education, GPA, certifications, uploaded resume files, extracted resume text, uploaded file type and size validation metadata, pasted LinkedIn profile text, and structured profile information extracted from those sources.
• Job and application content: Job descriptions, target roles and companies, job URLs, generated resumes, cover letters, interview prep, application answers, outreach drafts, match scores, ATS scores, keyword analysis, gap-fix plans, resume labels, favorite status, template choices, customization settings, public share-card fields, tracker entries, notes, recruiter or contact names, contact emails, salary ranges, statuses, and follow-up dates.
• Billing and usage records: Stripe customer, subscription, checkout, portal, invoice, plan, cancellation, refund, consent, webhook, monthly usage, top-up balance, billing policy acceptance, checkout consent evidence, client IP address, and user agent metadata. Full card numbers and payment credentials are handled by Stripe and are not stored on our servers.
• Support, feedback, and communications: Support form name, reply email, account email, topic, message, in-app product feedback, usefulness rating, feedback notes, IP address, email metadata, transactional email delivery events, unsubscribe or opt-out events, application follow-up reminders, onboarding messages, and related communications with us.
• Technical, security, and reliability data: IP address, user agent, device/browser information, request path and method, request metadata, rate-limit keys, error logs, abuse-prevention logs, account deletion audit records, admin security logs, and operational logs needed to secure, debug, monitor, and improve the Service.
• Analytics and preference data: Cookie consent choice, anonymous analytics ID, session ID, account-linked product events, page paths, source, plan context, event names, feature usage, sanitized event metadata, Vercel Analytics data when accepted, theme preference, review acknowledgments, and dismissed in-app notices, depending on your consent and authentication state.
• Browser-stored drafts and workflow state: Your browser may store unsent drafts such as pasted resume text, job descriptions, job titles, company names, resume-checker drafts, referral codes, and LinkedIn import preview data so workflows do not disappear on refresh. This data stays in your browser until cleared or submitted, except when you send it to HiredFast by using the related feature.
• Sample Preview: Our public sample Apply Pack uses static sample data and does not process your resume, job description, or personal information.

Do not submit Social Security numbers, government identification numbers, financial account numbers, health information, immigration documents, or other highly sensitive personal data unless we specifically request it for a supported feature. HiredFast is not designed to store those categories of information.

We use the information we collect to:

• Provide, maintain, and improve the Service
• Generate tailored resumes and application materials based on your profile and job descriptions
• Process and complete transactions
• Send you technical notices and support messages
• Respond to your comments and questions
• Analyze usage patterns to improve user experience
• Detect, prevent, and address technical issues
• Send you transactional and lifecycle emails, such as application follow-up reminders, if you have opted in or such communications are necessary to provide the Service
• Operate referrals, bonus generations, public share cards, product feedback, account deletion, unsubscribe, and data-rights workflows

Our Service uses artificial intelligence providers, including OpenAI API services, to process your data and generate editable drafts. When you use AI features:

• We send the uploaded or pasted resume text, profile, imported LinkedIn text, job description, generated context, and instructions needed for the feature you run.
• AI-generated resumes, letters, answers, scores, summaries, and recommendations are created from your inputs and should be reviewed before use.
• Where implemented, we replace common personal identifiers with placeholders before sending career text to AI providers, then restore the placeholders in the response.
• We do not use your personal data to train HiredFast models.
• OpenAI states that API inputs and outputs are not used to train or improve OpenAI models by default unless the API customer opts in.
• OpenAI may generate and retain abuse-monitoring logs for API usage, which may include prompts, responses, and metadata, for up to 30 days by default unless legal requirements or configured retention controls require otherwise.
• HiredFast may retain operational metadata such as model name, token usage, pipeline step status, request timing, errors, and audit signals so we can debug, secure, support, and improve the Service.

Review OpenAI's data controls documentation and business data privacy page for details about OpenAI's processing, retention, and training commitments.

We may share your information in the following situations:

• Service Providers: With third-party vendors who perform services on our behalf, including hosting, authentication, database, AI processing, payments, email delivery, analytics, rate limiting, and error monitoring.
• Public share cards: If you use or share a resume share-card link, anyone with the share-card identifier may be able to view the limited display fields returned by that feature, currently job title, company name, and match score.
• Referral features: We may store and process the relationship between a referrer and referred user to generate links, award bonuses, and show referral stats.
• Legal Requirements: If required by law or in response to valid legal requests
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• With Your Consent: When you have given us permission to share your information

We do not sell your personal information to third parties. We do not share personal information for cross-context behavioral advertising.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

We retain your personal data for as long as your account is active or as needed to provide you with the Service, comply with legal obligations, resolve disputes, prevent abuse, process payments, and enforce our agreements. You may delete your account and associated data at any time through your account settings. Upon deletion, we remove your profile, resumes, applications, and related records from active systems within 24 hours. Specific retention periods:

• Active account data: Retained until you delete your account or the relevant item.
• Backups after account deletion: Purged within 30 days of account deletion.
• Billing and payment records: Retained for up to 7 years as required by tax and financial regulations.
• Support, feedback, and communications: Retained as long as needed to resolve the request, improve the product, maintain business records, and defend legal claims.
• Referral records: Retained while the related accounts exist, unless earlier deletion is required by law or needed for abuse prevention.
• Browser-stored drafts and preferences: Remain in your browser until you clear them, overwrite them, submit the related workflow, or clear browser storage for HiredFast.
• Public share-card data: Available while the underlying saved resume exists or until the sharing feature or saved resume is removed.
• Security and abuse-prevention logs: Retained for up to 90 days, then purged.
• Error monitoring logs (Sentry): Retained for up to 90 days per Sentry's default retention.
• Rate-limit keys (Upstash): Expire automatically within 1-60 minutes depending on the rate-limit window.
• AI provider abuse-monitoring logs (OpenAI): Retained by OpenAI for up to 30 days per their API data retention policy, then automatically deleted. These cannot be individually deleted before expiry.
• Account deletion audit records: Retained for up to 2 years for legal compliance and dispute resolution.

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data
• Portability: Request a copy of your data in a machine-readable format
• Objection: Object to certain processing of your data
• Consent Withdrawal: Withdraw consent for data processing at any time

You can exercise most of these rights directly from your account:

• Export your data from your dashboard (JSON format)
• Edit your profile to correct any information
• Delete your account from your dashboard settings, which permanently removes all your data

For any rights not covered by self-serve options, contact us at privacy@hiredfast.io and we will respond within 30 days.

HiredFast does not sell your personal information. We do not share personal information for cross-context behavioral advertising. We do not use advertising cookies, tracking pixels, or third-party ad networks.

If you are a California resident and wish to exercise rights under the California Consumer Privacy Act (CCPA) or California Privacy Rights Act (CPRA), including the right to know, delete, correct, or opt out of sale or sharing, you may do so through the Data Rights page or by emailing privacy@hiredfast.io. We will not discriminate against you for exercising your privacy rights.

We use the following types of browser storage:

• Essential Cookies: Required for authentication and maintaining your session. These cannot be disabled without breaking the Service.
• Local Storage: Used to store your cookie consent choice, optional anonymous analytics ID, theme preference, review acknowledgment, dismissed notices, and workflow drafts such as job descriptions, job titles, company names, or resume-checker text.
• Session Storage: Used for temporary session tracking, referral-code handoff after signup, and LinkedIn import preview data. Cleared when you close your browser or when the workflow completes, depending on browser behavior.
• Analytics (Optional): We collect usage events such as page views, signup funnel events, feature usage, source, plan context, and sanitized metadata to improve the product. You can opt out by selecting "Essential Only" in the cookie consent banner.

We do not use advertising cookies, tracking pixels, or third-party ad networks.

See the Cookie Policy for more detail about browser storage and consent controls.

Our Service integrates with third-party services, including:

• Supabase: For database and authentication services
• OpenAI: For AI-powered resume generation, profile import, resume checking, cover letters, interview prep, application answers, outreach, scoring support, and quality review. Your relevant resume, profile, imported text, job descriptions, generated context, prompts, outputs, and request metadata may be transmitted to OpenAI for processing. OpenAI states that API inputs and outputs are not used to train or improve OpenAI models by default unless the API customer opts in.
• Stripe: For payment processing and subscription management. Your payment details are handled directly by Stripe and never stored on our servers.
• Amazon Web Services (SES): For transactional email delivery.
• Vercel Analytics: For optional product analytics when you accept analytics cookies.
• Upstash (Redis): For temporary rate-limiting data. IP addresses used for rate-limiting are stored briefly and not linked to personal accounts.
• Sentry: For error monitoring and crash reporting. Error logs may incidentally capture request metadata. We configure Sentry to minimize personal data in error payloads.
• AWS S3 and MongoDB: For optional public blog and marketing-content automation when configured. These systems are not used as the primary storage location for your resumes, profile, or application materials.

These services have their own privacy policies, and we encourage you to review them.

The Service is not intended for children under 18 years of age. We do not knowingly collect personal information from children under 18. If we learn we have collected such information, we will take steps to delete it.

If you are in the European Economic Area or United Kingdom, we process your personal data under the following lawful bases:

• Contract performance (Art. 6(1)(b) GDPR): Processing necessary to provide the Service you signed up for — account creation, resume tailoring, AI generation, saved versions, exports, billing, and support.
• Consent (Art. 6(1)(a) GDPR): Optional analytics tracking, which you can accept or decline via the cookie consent banner and change at any time.
• Legitimate interest (Art. 6(1)(f) GDPR): Security measures, abuse prevention, rate limiting, error monitoring, and service reliability. Our legitimate interest is protecting users and maintaining uptime without requiring individual consent for each security measure.
• Legal obligation (Art. 6(1)(c) GDPR): Retaining billing records, tax documentation, and fraud-prevention data where required by applicable law.

You may withdraw consent for optional processing at any time. Withdrawing consent does not affect the lawfulness of processing performed before withdrawal. For AI processing of your resume and profile data, the lawful basis is contract performance — this processing is necessary to deliver the resume tailoring and application kit features you use.

Your information may be transferred to and processed in the United States and other countries where our service providers operate. These countries may have different data protection laws than your country of residence. For transfers from the EEA/UK to countries without an adequacy decision, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other appropriate transfer mechanisms as required by applicable law.

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy on this page with a new "Last updated" date. We encourage you to review this policy periodically.

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:

JMV Labs LLC
Email: privacy@hiredfast.io