LEGAL
Privacy Policy
Last updated: October 2026
1. What We Collect
- Account information: details such as your email address, display name, authentication identifiers, verification state, and basic profile settings.
- Resume and job-search content: uploaded resume files, parsed resume data, optimization history, job descriptions, application-tracking information, and related outputs you choose to save or generate through the service.
- Usage and technical data: feature usage, timestamps, request metadata, rate-limit and security signals, device/browser information, and server/application logs.
- Payment and billing data: subscription, transaction, order, and billing records. Payment-card details are handled by the processor used at checkout; we do not intentionally store full card numbers or CVV data on our own systems.
- Support and communications: emails, support requests, export/deletion requests, and related correspondence.
2. How We Use Your Data
- To provide ATS scoring, parsing, optimization, export, storage, application-tracking, and other account features.
- To authenticate users, secure the service, prevent abuse, debug failures, enforce limits, and maintain system integrity.
- To send transactional communications such as verification emails, account notices, exports, billing messages, and support replies.
- To understand product performance and usage trends using internal telemetry and approved vendors.
- We do not sell your personal data to recruiters, employers, or data brokers.
- We do not use your content to train our own models. When third-party providers are involved, their handling of prompts, files, inputs, and outputs is governed by their own terms, settings, and data controls.
3. Your Review & Consent
Some features of PassTheBot use automated processing to generate suggestions, summaries, rewrites, and scores based on the information you provide. By using those features, you consent to that processing and acknowledge that the output may need correction, editing, or removal before you rely on it.
We encourage careful review and minimal disclosure. Please do not upload information you are not allowed to share, and do not rely on our output as a substitute for professional legal, employment, or privacy advice. You remain responsible for the accuracy of the data you submit and for the final content you choose to use.
4. Lawful Basis for Processing
Under the GDPR and similar regulations, we process your personal data on the following lawful bases:
| Processing Activity | Lawful Basis |
|---|---|
| Account creation and management | Contract (Art. 6(1)(b)) |
| Resume upload and real-time parsing | Contract (Art. 6(1)(b)) |
| ATS scoring and AI optimization | Legitimate Interest (Art. 6(1)(f)) |
| Job description analysis | Legitimate Interest (Art. 6(1)(f)) |
| Email verification and transactional emails | Contract (Art. 6(1)(b)) |
| Marketing emails | Consent (Art. 6(1)(a)) |
| Analytics and service improvement | Legitimate Interest (Art. 6(1)(f)) |
| Security and fraud prevention | Legitimate Interest (Art. 6(1)(f)) |
4. Data Retention
We retain personal data for as long as reasonably necessary to provide the service, operate the platform, comply with legal obligations, resolve disputes, enforce agreements, and protect against abuse. Exact periods may vary by data type, account status, and operational need.
| Data Type | Retention Period | Typical Handling |
|---|---|---|
| Account and profile data | Until account closure, plus any recovery, compliance, dispute, or audit period that applies | Deletion or anonymization, depending on the record |
| Uploaded resume files and parsed resume data | Until you delete them, your account is removed, or operational/legal retention is no longer required | Deletion from active systems and scheduled cleanup from supporting systems where applicable |
| Optimization history, exports, and generated artifacts | Until removed by you, expired by design, or deleted during account cleanup | Deletion from active storage and temporary-storage cleanup |
| Account deletion requests | Deletion requests may trigger a soft-delete window of up to 6 months before permanent purge/anonymization | Account access disabled during the recovery window, then permanent cleanup/anonymization |
| Export download files | Temporary; links are currently intended to expire after about 60 minutes | Single-use token plus scheduled cleanup of temporary files |
| Product analytics events (usage counts and buckets, see section 10b) | 180 days | Automatic nightly batched deletion of raw events; account ID is detached on account deletion |
| Logs, security records, and caches | Variable and generally temporary | Rotation, expiry, overwrite, or deletion according to system settings |
5. AI Processing Disclosure
PassTheBot uses artificial intelligence and related automation, including large language models, to process resume and job-description data. We use these systems to assist you, not to replace your judgment. When you use those features:
- We may send the relevant portions of your resume, job description, and surrounding prompt context to third-party AI providers through APIs.
- The output may be used to generate summaries, rewrites, structured data, scoring explanations, or related product features.
- AI-generated content should be reviewed by you before use, as automated outputs may contain inaccuracies, omissions, or wording that does not reflect your actual experience.
- Current provider flows may involve Groq, OpenRouter, Google Gemini, Mistral, and downstream model providers made available through those services. Providers, routing order, and fallback behavior may change over time.
- Free features may use lower-cost or shared routes. Paid plans may receive different routing or prioritization, but we do not promise exclusive use of any single provider or model unless we state that expressly in writing.
- Third-party providers process data under their own privacy terms, usage rules, and retention settings. We do not control every aspect of how those providers operate, so we disclose that dependency clearly.
Data Transfers: AI-related processing may involve providers or infrastructure located outside your country, including in the United States.
6. International Data Transfers
Your personal data may be transferred to and processed in countries outside your country of residence, depending on the vendors, infrastructure, and processors involved in delivering the service.
- Our infrastructure and vendors may operate in India, the United States, and other jurisdictions.
- AI providers may process requests in the United States or other regions they support.
- Email, analytics, storage, and payment providers may process data in their own operating regions.
Where required by applicable law, we rely on contractual, organizational, technical, or other lawful transfer mechanisms that we determine are appropriate for the relevant transfer.
7. Who We Share Data With
We share data with third parties only when reasonably necessary to operate, secure, support, or improve the service, comply with law, or complete a transaction you request. Categories of recipients may include:
- AI providers and AI routing vendors: to process prompts, resume/job data, and outputs for AI features.
- Payment processors and billing vendors: to collect and process subscription payments and related records.
- Email and notification providers: to deliver verification, billing, export, support, and service emails.
- Infrastructure, storage, and security vendors: to host files, databases, caching, logging, and system operations.
- Analytics and monitoring vendors: to help us understand usage, diagnose errors, and maintain reliability.
- Legal, compliance, and law-enforcement recipients: where disclosure is required or reasonably necessary to protect rights, safety, users, or the integrity of the service.
A more detailed vendor list may be published separately and may change over time as our infrastructure evolves. When we make those changes, our goal is to keep the disclosure current and understandable.
8. Data Storage & Security
- We use administrative, technical, and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or destruction.
- Security controls may include encryption in transit, access controls, password hashing, rate limiting, monitoring, logging, and vendor-managed infrastructure safeguards.
- No method of transmission, storage, or processing is completely secure, so we cannot guarantee absolute security. What we can do is apply reasonable safeguards and continue improving them.
- You are responsible for maintaining the confidentiality of your account credentials and for reviewing any AI-generated content before relying on it.
9. Your Rights
- Access: you may request a copy of the personal data we hold about you.
- Deletion: you may request account deletion. Our current workflow may place the account into a soft-delete period before permanent purge or anonymization.
- Correction: you may update certain profile information in-product and request corrections to data we control.
- Portability: where applicable, you may request export of the data we maintain for your account, subject to security checks, rate limits, and temporary download windows.
- Restrict or object: you may ask us to restrict or object to certain processing where the law gives you that right.
- Automated processing: AI-generated content is presented for your review and is not intended to make legally binding decisions about you.
Learn more about all your data subject rights →
For any privacy request: privacy@passthebot.dev
10. Cookies
- Essential cookies: used for login, session continuity, CSRF protection, and core product operation.
- Functional preferences: some user choices are stored in cookies or local browser storage to remember settings such as theme or UI preferences.
- Analytics and marketing technologies: these may be added, changed, or removed over time. Where required by law, we will seek consent before enabling non-essential tracking technologies.
- You can manage cookies through your browser settings and, where available, our in-product consent controls. See our Cookie Policy for more detail.
10a. Browser Extension & Auto-Apply
The PassTheBot browser extension (Chrome, Edge, Brave) scans job pages, tracks your applications and, if you turn on Auto-Apply, fills application forms for jobs you chose to apply to. It works in your own browser, with your own sign-in sessions.
- Where it works: from installation only on PassTheBot and the job sites it supports (LinkedIn, Naukri, Workday, Greenhouse, Lever, Ashby, Workable and the other job boards it can track). It works on other sites only if you choose “Allow all sites” in its side panel, and you can take that back at any time.
- What it does not do: it never submits an application for you (you press the site’s own Submit), never solves captchas, and never stores or sends your LinkedIn or Naukri password. It loads no remote code.
- What we store on our servers for Auto-Apply: your apply profile (for example phone, notice period, work authorization and any equal-opportunity answers you choose to give), your saved answers, the resume and cover letter prepared for each job, and a log of each run’s steps. Optional screenshots of a run have phone numbers, emails, addresses and equal-opportunity answers covered before they are taken, are kept for 30 days and are deleted with your account.
- What stays on your device: the Workday account logins the extension creates for you are kept in an encrypted vault protected by a passphrase only you know. They are never sent to us, never logged and cannot be recovered if you forget the passphrase.
- Your control: you can pause or stop Auto-Apply, withdraw consent, export your data and delete your account (see Your Rights); the Auto-Apply data above is included in export and deletion.
- Sharing: job and page text is untrusted input and is not sold. Answers to application questions are generated from your own resume and profile through our AI providers (see AI Processing) and are shown to you for review before you submit.
10b. Product Analytics (aggregate usage events)
To see which parts of PassTheBot work and which confuse people, we record a small, fixed set of usage events. Each event is a name, the time, your account ID (so we can count distinct people and steps, for example how many reach the end of onboarding) and a few coarse labels or numbers. Events never contain your resume, job titles or descriptions, company names, answers to application questions, phone number, email address, links, salary or CTC figures, or free text you typed. Scores and gaps are stored as buckets only (for example “60–79” or “within” / “stretch” / “far”), never as exact values. The admin dashboard reads daily totals built from these events and from job-source statistics, not individual people: the nightly roll-up tables hold counts, rates and medians only, with no account ID, email, phone number or free text, and they never contain a role or city that fewer than two people chose.
| Event | What it records |
|---|---|
Onboarding: onb_step_viewed, onb_step_completed, onb_completed, onb_abandoned | Which of the 11 setup steps (by name only, such as “roles” or “ctc”; never what you entered), whether the step was pre-filled and whether you accepted the suggestion, total seconds to finish, and the last step reached if you left. The viewed and abandoned events are sent from your browser. |
Discover: deck_served, card_flipped, deck_empty, deck_refill | How many cards were shown, the names of the job sources used (such as “linkedin”), whether the deck was refilling, how long a refill took in milliseconds, and a generic hint label when the deck ran out. card_flipped carries nothing besides the event name. It is sent from your browser. |
Discover: swipe | Like or pass, the job source name, the position in the deck, and three buckets: match score band, how far the posting’s experience requirement sits above yours (within / stretch / far), and title fit (none / low / mid / high). No job text and no exact score. |
Discover: eligibility_filtered | Which filter rule removed jobs (for example seniority or work mode) and how many. Recorded for about 1 in 10 occurrences only. |
Auto-Apply: autoapply_transition, needs_input, tailor_pressed, cover_letter_generated, truth_guard_rejected | The step a run moved from and to, the job site name (such as “greenhouse”), the reason code when a run needed you to take over, seconds taken, and a count. When the form asks something we cannot answer, only a short one-way hash of the question and a generic label are kept; never the question wording and never your answer. The other three record only that a button was used or a check ran. |
Match feedback: pass_reason, not_a_fit | If you tell us why you passed on a job (too senior, too junior, wrong role, wrong location, salary, not interested) or flag a liked job as “not a fit”, we record which reason from that short list, or that the flag was set or cleared. The reason and the flag are also stored with that one decision on your account (and are included in your data export), and are used only to measure how well matches fit; they do not change your results. No job text. |
Plans: limit_hit, paywall_viewed, checkout_started, checkout_paid, cancel_renewal | Which feature limit was reached and your plan name, where a plan prompt was shown and which test variant (“A” or “B”) you saw, which plan you started or completed checkout for, and, if you choose one, the cancellation reason from a short list. No card or payment details. The paywall-viewed event is sent from your browser. |
- Retention: raw events are deleted automatically after 180 days. Daily totals that contain no account ID, email or other personal data may be kept longer.
- Your control: events are tied to your account only through its ID and are removed or detached from it when your account is deleted. Ask privacy@passthebot.dev if you want them removed sooner.
- Sharing: these events stay in our own database. They are not sold or shared with advertisers or recruiters.
11. Children
This service is not directed at anyone under 16. We do not knowingly collect personal data from children under 16. If you believe a minor has created an account, contact privacy@passthebot.dev and we will delete it immediately.
12. Right to Lodge a Complaint
You have the right to lodge a complaint with your local data protection authority if you believe your personal data is being processed unlawfully or your rights have been violated:
- EU: Your national data protection authority (see EDPB list)
- UK: Information Commissioner's Office — ico.org.uk
- India: Data Protection Board of India
13. Changes to This Policy
We may update this policy from time to time. Changes become effective when posted or on the stated effective date. Where required by law, or where we consider a change material, we may also provide additional notice by email, in-product notice, or another reasonable method.
14. Contact
privacy@passthebot.dev
PassTheBot, Pune, Maharashtra, India