Privacy Policy

SleepApply is a job-search tool that helps you find roles, score and tailor your CV, and prepare and submit applications. This policy explains what personal data we process and the choices you have. It applies to job seekers worldwide, including the EU/EEA and UK (GDPR) and California (CCPA/CPRA).

• Account data: email address and a hashed password.
• Profile data you enter: name, target roles, target countries and cities, education, skills, work experience, links, phone, salary expectations, work authorization.
• CV files you upload and the AI analyses generated from them.
• Job activity: searches you run, jobs you save, applications you track, Career Coach requests (metadata only — never your questions, the AI answers, or CV/profile content), and outreach drafts you generate.
• Public business contact details we discover so we can suggest who to write to: emails in job postings and on company websites, public LinkedIn profile URLs from Google search, Hunter.io enrichment when configured, company-domain emails in public GitHub commit history, and pattern-inferred work addresses (labelled as unverified). We cache these company-level contacts for a short period so we do not recrawl or re-query the same company for every user.
• Technical data: IP-derived country (to pre-fill your search region), and a session cookie to keep you signed in.

• To run job searches, score and tailor your CV, and prepare applications on your behalf.
• To draft outreach messages and surface hiring contacts for jobs you have saved.
• To match jobs to your profile and send opportunity alerts if you enable them.
• To operate, secure, and improve the service.

Our legal bases (GDPR) are performance of our contract with you for the core features, and your consent for optional features such as email job alerts. We do not sell your personal information or share it for cross-context behavioural advertising (CCPA/CPRA).

Outreach looks at information already published on the open web: emails in a job posting (including mailto: apply links), emails on a company's own contact/careers pages, names a posting itself mentions, public LinkedIn profile URLs returned by Google search (via SerpAPI), company-domain emails in public GitHub commit history, and Hunter.io's published professional-email index when that integration is enabled. We may also construct a likely work address from a company's known email pattern and a person's name. Those inferred addresses are labelled "likely, unverified" and are never placed in a compose To field unless you copy them yourself. We do not scrape LinkedIn people profiles behind a login, guess personal (non-company) inboxes, or send outreach from SleepApply — you open a draft in your own mailbox. Cached company contacts are stored without tying them to your account and are refreshed on a short TTL.

We share data only with providers that process it on our behalf:

• Supabase — database and file storage.
• OpenAI — CV analysis, tailoring, Career Coach, Interview Agent, and Outreach drafts.
• SerpAPI — job listing search and Outreach LinkedIn-people lookup (your role, location, and company-name search terms are sent; your identity is not).
• Hunter.io — professional email enrichment for Outreach, when configured (company domain and, for email-finder, a name).
• Resend — transactional email (verification, password reset, alerts).
• Vercel — application hosting.
• Paddle — payment processing, once paid plans launch.

We keep your account and profile data for as long as your account is active. When you delete your account we permanently erase your profile, CVs, generated documents, saved jobs, applications, watchlists, search history, and Career Coach usage records, and remove your uploaded files from storage. Aggregated, non-identifying job-market data may be retained.

You can access, correct, export, and delete your data. Two controls are built into the app, under Profile → Account & Security:

• Export my data — downloads a JSON file of everything we hold about you.
• Delete my account — permanently erases your account and data.

EU/EEA and UK users may also lodge a complaint with their local data protection authority. To exercise any right or ask a question, contact us at privacy@sleepapply.org.

We will update this page and revise the date above when our practices change materially.