LEGAL
Privacy Policy
Last updated: April 2026
1. What We Collect
- Account information: details such as your email address, display name, authentication identifiers, verification state, and basic profile settings.
- Resume and job-search content: uploaded resume files, parsed resume data, optimization history, job descriptions, application-tracking information, and related outputs you choose to save or generate through the service.
- Usage and technical data: feature usage, timestamps, request metadata, rate-limit and security signals, device/browser information, and server/application logs.
- Payment and billing data: subscription, transaction, order, and billing records. Payment-card details are handled by the processor used at checkout; we do not intentionally store full card numbers or CVV data on our own systems.
- Support and communications: emails, support requests, export/deletion requests, and related correspondence.
2. How We Use Your Data
- To provide ATS scoring, parsing, optimization, export, storage, application-tracking, and other account features.
- To authenticate users, secure the service, prevent abuse, debug failures, enforce limits, and maintain system integrity.
- To send transactional communications such as verification emails, account notices, exports, billing messages, and support replies.
- To understand product performance and usage trends using internal telemetry and approved vendors.
- We do not sell your personal data to recruiters, employers, or data brokers.
- We do not use your content to train our own models. When third-party providers are involved, their handling of prompts, files, inputs, and outputs is governed by their own terms, settings, and data controls.
3. Your Review & Consent
Some features of PassTheBot use automated processing to generate suggestions, summaries, rewrites, and scores based on the information you provide. By using those features, you consent to that processing and acknowledge that the output may need correction, editing, or removal before you rely on it.
We encourage careful review and minimal disclosure. Please do not upload information you are not allowed to share, and do not rely on our output as a substitute for professional legal, employment, or privacy advice. You remain responsible for the accuracy of the data you submit and for the final content you choose to use.
4. Lawful Basis for Processing
Under the GDPR and similar regulations, we process your personal data on the following lawful bases:
| Processing Activity | Lawful Basis |
|---|---|
| Account creation and management | Contract (Art. 6(1)(b)) |
| Resume upload and real-time parsing | Contract (Art. 6(1)(b)) |
| ATS scoring and AI optimization | Legitimate Interest (Art. 6(1)(f)) |
| Job description analysis | Legitimate Interest (Art. 6(1)(f)) |
| Email verification and transactional emails | Contract (Art. 6(1)(b)) |
| Marketing emails | Consent (Art. 6(1)(a)) |
| Analytics and service improvement | Legitimate Interest (Art. 6(1)(f)) |
| Security and fraud prevention | Legitimate Interest (Art. 6(1)(f)) |
4. Data Retention
We retain personal data for as long as reasonably necessary to provide the service, operate the platform, comply with legal obligations, resolve disputes, enforce agreements, and protect against abuse. Exact periods may vary by data type, account status, and operational need.
| Data Type | Retention Period | Typical Handling |
|---|---|---|
| Account and profile data | Until account closure, plus any recovery, compliance, dispute, or audit period that applies | Deletion or anonymization, depending on the record |
| Uploaded resume files and parsed resume data | Until you delete them, your account is removed, or operational/legal retention is no longer required | Deletion from active systems and scheduled cleanup from supporting systems where applicable |
| Optimization history, exports, and generated artifacts | Until removed by you, expired by design, or deleted during account cleanup | Deletion from active storage and temporary-storage cleanup |
| Account deletion requests | Deletion requests may trigger a soft-delete window of up to 6 months before permanent purge/anonymization | Account access disabled during the recovery window, then permanent cleanup/anonymization |
| Export download files | Temporary; links are currently intended to expire after about 60 minutes | Single-use token plus scheduled cleanup of temporary files |
| Logs, security records, and caches | Variable and generally temporary | Rotation, expiry, overwrite, or deletion according to system settings |
5. AI Processing Disclosure
PassTheBot uses artificial intelligence and related automation, including large language models, to process resume and job-description data. We use these systems to assist you, not to replace your judgment. When you use those features:
- We may send the relevant portions of your resume, job description, and surrounding prompt context to third-party AI providers through APIs.
- The output may be used to generate summaries, rewrites, structured data, scoring explanations, or related product features.
- AI-generated content should be reviewed by you before use, as automated outputs may contain inaccuracies, omissions, or wording that does not reflect your actual experience.
- Current provider flows may involve Groq, OpenRouter, Google Gemini, Mistral, and downstream model providers made available through those services. Providers, routing order, and fallback behavior may change over time.
- Free features may use lower-cost or shared routes. Paid plans may receive different routing or prioritization, but we do not promise exclusive use of any single provider or model unless we state that expressly in writing.
- Third-party providers process data under their own privacy terms, usage rules, and retention settings. We do not control every aspect of how those providers operate, so we disclose that dependency clearly.
Data Transfers: AI-related processing may involve providers or infrastructure located outside your country, including in the United States.
6. International Data Transfers
Your personal data may be transferred to and processed in countries outside your country of residence, depending on the vendors, infrastructure, and processors involved in delivering the service.
- Our infrastructure and vendors may operate in India, the United States, and other jurisdictions.
- AI providers may process requests in the United States or other regions they support.
- Email, analytics, storage, and payment providers may process data in their own operating regions.
Where required by applicable law, we rely on contractual, organizational, technical, or other lawful transfer mechanisms that we determine are appropriate for the relevant transfer.
7. Who We Share Data With
We share data with third parties only when reasonably necessary to operate, secure, support, or improve the service, comply with law, or complete a transaction you request. Categories of recipients may include:
- AI providers and AI routing vendors: to process prompts, resume/job data, and outputs for AI features.
- Payment processors and billing vendors: to collect and process subscription payments and related records.
- Email and notification providers: to deliver verification, billing, export, support, and service emails.
- Infrastructure, storage, and security vendors: to host files, databases, caching, logging, and system operations.
- Analytics and monitoring vendors: to help us understand usage, diagnose errors, and maintain reliability.
- Legal, compliance, and law-enforcement recipients: where disclosure is required or reasonably necessary to protect rights, safety, users, or the integrity of the service.
A more detailed vendor list may be published separately and may change over time as our infrastructure evolves. When we make those changes, our goal is to keep the disclosure current and understandable.
8. Data Storage & Security
- We use administrative, technical, and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or destruction.
- Security controls may include encryption in transit, access controls, password hashing, rate limiting, monitoring, logging, and vendor-managed infrastructure safeguards.
- No method of transmission, storage, or processing is completely secure, so we cannot guarantee absolute security. What we can do is apply reasonable safeguards and continue improving them.
- You are responsible for maintaining the confidentiality of your account credentials and for reviewing any AI-generated content before relying on it.
9. Your Rights
- Access: you may request a copy of the personal data we hold about you.
- Deletion: you may request account deletion. Our current workflow may place the account into a soft-delete period before permanent purge or anonymization.
- Correction: you may update certain profile information in-product and request corrections to data we control.
- Portability: where applicable, you may request export of the data we maintain for your account, subject to security checks, rate limits, and temporary download windows.
- Restrict or object: you may ask us to restrict or object to certain processing where the law gives you that right.
- Automated processing: AI-generated content is presented for your review and is not intended to make legally binding decisions about you.
Learn more about all your data subject rights →
For any privacy request: privacy@passthebot.dev
10. Cookies
- Essential cookies: used for login, session continuity, CSRF protection, and core product operation.
- Functional preferences: some user choices are stored in cookies or local browser storage to remember settings such as theme or UI preferences.
- Analytics and marketing technologies: these may be added, changed, or removed over time. Where required by law, we will seek consent before enabling non-essential tracking technologies.
- You can manage cookies through your browser settings and, where available, our in-product consent controls. See our Cookie Policy for more detail.
11. Children
This service is not directed at anyone under 16. We do not knowingly collect personal data from children under 16. If you believe a minor has created an account, contact privacy@passthebot.dev and we will delete it immediately.
12. Right to Lodge a Complaint
You have the right to lodge a complaint with your local data protection authority if you believe your personal data is being processed unlawfully or your rights have been violated:
- EU: Your national data protection authority (see EDPB list)
- UK: Information Commissioner's Office — ico.org.uk
- India: Data Protection Board of India
13. Changes to This Policy
We may update this policy from time to time. Changes become effective when posted or on the stated effective date. Where required by law, or where we consider a change material, we may also provide additional notice by email, in-product notice, or another reasonable method.
14. Contact
privacy@passthebot.dev
PassTheBot, Pune, Maharashtra, India