Privacy Policy

ThisJobFits.ai is operated by ThisJobFits, Inc., reachable at privacy@thisjobfits.ai and at the postal address in Section 14.

This policy describes what personal information we collect when you use ThisJobFits.ai (the “Service”), how we use it, who we share it with, and what rights you have over it. It covers the website, the product dashboard, our emails, and the worker process that scores jobs against your profile.

It does not cover job listings sourced from third-party public boards and aggregators. Those listings are published by employers and aggregators and are subject to their own terms.

We collect these categories of personal information:

Account and profile. Email address, password (hashed), first name, last name, location, job titles, salary expectations, non-negotiables, resume content you upload, and your stated preferences. You provide this when you sign up and update it in settings.

Scoring signals. Every rating (thumbs up or down) you give a match, every job you save, every match you click, every application status you set on your kanban board, and timestamps for each. We use these to train the per-user scoring model.

AI usage. Each time you use resume tailoring, cover letter generation, or the application assistant, we log the model used, the token counts, the cost, the listing ID, and the generated output. Outputs are tied to your account and remain stored for as long as your account exists. In-app access to those outputs requires an active paid subscription; on the free tier, the files are not accessible from the dashboard. You can request an export at any time under Section 10 regardless of tier.

Subscription. Your Stripe customer ID, subscription status, plan, renewal date, and cancellation state. We never store your card number.

Email activity. Which emails we sent you, which you opened, which links you clicked, whether you bounced or complained. This is collected from our email provider's webhooks.

Device and session. IP address, browser user agent, operating system, page URLs, referral source, UTM parameters, ad click IDs, and a session identifier. We use these to keep you signed in, detect abuse, debug product issues, measure analytics, and attribute signups or subscriptions to marketing campaigns.

Session replay. We may use PostHog session replay to see how people move through the marketing site and app. Form inputs, passwords, billing fields, and other sensitive inputs are masked before capture. Public job details and general UI text may appear in replay so we can debug the product.

Support. If you reply to one of our emails or write to support, we keep the message and our reply.

We get your account and profile information from you directly. Job listings are fetched from public job boards and aggregators. We do not buy personal information from data brokers. We do not enrich your profile with external sources.

We use your information to:

• Score jobs against your profile and show you the matches that clear our filter.
• Train a per-user scoring model from your thumbs-up and thumbs-down ratings.
• Run the AI features (resume tailoring, cover letters, application assistant) when you trigger them.
• Send you the emails you signed up for: onboarding, digest, weekly summary, billing, and account notifications.
• Process payments and manage subscriptions through Stripe.
• Detect and prevent abuse, debug problems, and improve the product.
• Meet legal obligations, including CAN-SPAM physical-address requirements and tax filings.

We do not sell your personal information. We do not send advertisers your resume, profile, ratings, name, or raw email address. We do use limited event data to measure whether our marketing leads to signups, onboarding completion, checkout starts, and paid subscriptions.

See our Cookie Policy. The short version: we use essential cookies to keep you signed in, analytics tools to understand product usage, and ad measurement pixels to understand whether campaigns work. We do not offer an in-app analytics opt-out control at launch, but we automatically honor Global Privacy Control (GPC) by not loading non-essential analytics or advertising scripts when your browser sends that signal.

We share your information with the following categories of third parties, limited to what each needs to do its job:

Supabase

Database and auth. Stores your account, profile, ratings, matches, AI outputs, and session tokens. Supabase is a sub-processor under their own terms.

Stripe

Payments. Processes your subscription and card data. We only send email, name, and subscription plan. Stripe's privacy policy applies to card handling.

Resend

Email delivery. Sends every email we send. Receives your email address, name, and the content of the email.

Anthropic and OpenAI

AI providers. We send job descriptions, your resume content, your profile fields, and your feedback ratings so they can score matches and generate outputs. We use their zero-retention API modes where available. We do not let them train their public models on your content.

Railway

Hosting. Runs the Next.js app and the Python worker. Has incidental access to logs and environment variables.

Google Tag Manager and Google Analytics 4

Analytics and ad measurement. Receives page views, events, device data, referral data, and click identifiers. We use Google Tag Manager to manage Google tags centrally.

PostHog

Product analytics and session replay. Receives product events, session identifiers, device data, and masked session replay data. We identify signed-in users by internal user ID, not by raw email or name.

Reddit Ads

Ad pixel and server-side conversion measurement. Receives page visits and primary conversion events such as signup, onboarding completion, checkout start, and subscription confirmation. Server-side events use click IDs, browser metadata, and hashed internal user IDs when available.

Legal and safety

If required by subpoena, court order, or to investigate fraud or abuse.

Business transfer

If we sell or merge the business, we may transfer data to the acquirer. We will tell you before that happens.

ThisJobFits.ai is operated from the United States. Supabase, Stripe, Resend, Anthropic, OpenAI, and Railway process data in the United States and other countries. If you use the Service from outside the United States, your information may be transferred, stored, and processed in the United States.

We rely on standard contractual clauses with our processors where cross-border transfers occur. If you are in the European Economic Area, United Kingdom, or Switzerland, see Section 10 for your rights.

We keep:

• Your account and profile for as long as your account exists.
• Ratings, saved jobs, and scoring history for as long as your account exists. These feed your per-user model, so deleting them resets your training.
• AI-generated outputs (tailored resumes, cover letters, Q&A answers) for as long as your account exists. In-app access requires an active paid subscription. On the free tier, outputs are retained but not accessible from the dashboard. You can request an export under Section 10 at any time, regardless of tier.
• Email activity for 2 years.
• Billing records for 7 years to meet tax and audit obligations.
• Support messages for 3 years.

When you delete your account (Section 10), we delete your profile, ratings, saved jobs, AI outputs, and email activity within 30 days. Billing records are retained for the legal minimum.

Regardless of where you live, you can:

• Access the personal information we hold about you.
• Correct inaccurate information by editing your profile or emailing privacy@thisjobfits.ai.
• Delete your account and associated personal information.
• Export your ratings, saved jobs, AI outputs, and profile as a machine-readable file.
• Unsubscribe from marketing emails at any time through the link in every marketing email.

To exercise these rights, email privacy@thisjobfits.ai with your request and the email address on your account. We will respond within 30 days.

If you are in the European Economic Area, United Kingdom, or Switzerland, you additionally have rights of access, rectification, erasure, restriction of processing, data portability, and objection under GDPR and the UK GDPR. You can lodge a complaint with your local supervisory authority.

Our posture. We are not actively targeting EEA or UK users. We do not have a DPO or an EU Representative. If you are in one of these regions and have signed up, we will honor the rights above. If handling these requests becomes disproportionate to our size, we may restrict access from these regions; we will tell you before that happens.

ThisJobFits.ai is for people 18 and older. We do not knowingly collect information from anyone under 18. If you believe a child has created an account, email privacy@thisjobfits.ai and we will delete it.

We update this policy when what we do with your data changes. When we do, we:

• Update the “Effective” date at the top.
• Prepend a changelog entry describing what changed.
• Email you through the address on your account if the change is material (for example, enabling a new tracking category or a new sub-processor).

We never make a material change retroactively. Material changes take effect 30 days after notice.

Privacy requests: privacy@thisjobfits.ai

General support: support@thisjobfits.ai

Postal address:
ThisJobFits, Inc.
508 Stony Brook Lane, Wyckoff, NJ 07481

If you are in the EEA or UK, you can also contact your local data protection authority.