Privacy Policy

Last updated [DATE]

[ENTITY NAME] is the controller of the personal data described here. This policy explains what we hold, why, who else sees it, and how to get it back or get rid of it.

Slothpilot handles a CV and a job search, which is unusually personal material, so this is written to be read rather than to be technically sufficient.

What we collect

• Account — your email address, display name and profile photo, as provided by Google or by you at sign-up.
• Your CV files, and the text extracted from them.
• Profile details you enter or confirm: name, email, phone number, city, years of experience, skills, work authorisation, and any career notes you add.
• Target roles: job titles, locations, salary floor, priority, and companies to avoid.
• Application history: the job title, company, link, outcome and date for each application, plus any cover letter written for it.
• Answers you save for screening questions.
• Usage: how many applications you have sent, and the processing consumed, so we can apply your plan’s limits.
• Billing status: your plan, whether it is active, and identifiers from our payment provider. We never receive your card details.
• Technical: server logs, and a hashed identifier for each computer you connect. The token that computer uses is stored only as a hash — a copy of our database could not be used to impersonate it.

What stays on your computer and never reaches us

This matters more than the list above:

• Your job board passwords. You sign into Indeed or JobStreet in your own browser. We never see those credentials.
• Your browser session. The signed-in browser profile the software uses lives on your machine and is never uploaded.
• The browsing itself. Pages are opened on your computer, over your connection. We receive the record of what was applied to, not a copy of your browsing.

Why we hold it

To provide the service you signed up for: to fill in application forms as you, to show you what has been sent, to apply the limits of your plan, and to bill you. We also use it to keep the service working and secure. We do not sell it, and we do not use your CV to train anything.

Who else sees it

• Google Firebase — sign-in. They hold your login credential; we never do.
• Paddle — payments. Paddle is the merchant of record and collects your billing details directly. We receive only your subscription status and their identifiers for it.
• Anthropic — where AI answering is enabled, the text of a screening question, the job title and company, and the relevant parts of your CV are sent to generate an answer or a cover letter. This is what allows an application to be written for a specific post rather than copy-pasted.
• Fly.io — hosting. Our servers and database are in [REGION — currently Singapore].

Each of these processes data on our instructions for the purposes above. Nobody else receives your data, and it is not shared with employers beyond what is contained in the applications you send.

How long we keep it

While your account exists. If you delete your account, we delete your CVs, profile, roles and application history within [30] days, except where we must keep records of transactions for tax or accounting purposes. Backups are overwritten on their own cycle.

Your rights

Under the Data Privacy Act of 2012 (Republic Act No. 10173) and, where it applies to you, other data protection law, you may:

• ask what we hold about you and get a copy;
• have it corrected if it is wrong;
• have it erased, and close your account;
• object to a particular use, or ask us to restrict it;
• receive it in a portable form.

Email [CONTACT EMAIL] and we will respond within [15] days. If you are unhappy with how we handle it, you may complain to the National Privacy Commission (privacy.gov.ph).

Security

Traffic is encrypted in transit. Runner tokens are stored only as hashes. Access to the production database is limited to those who need it. No system is perfectly secure, and we will tell affected users promptly if a breach occurs that puts their data at risk.

Children

Slothpilot is not for anyone under 18, and we do not knowingly collect data from them.

Changes

If we change this policy in a way that matters, we will tell you by email or in the dashboard before it takes effect.

Contact

[ENTITY NAME] · [REGISTERED ADDRESS] · [CONTACT EMAIL]