Who we are
Hirelit is operated by Innomactic, based in Ontario, Canada. In this policy "we", "us" and "our" mean Innomactic, and "you" means the person using Hirelit. We are responsible for the personal information described here under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).
This policy covers the Hirelit web app, our server, the Hirelit Chrome extension and the Hirelit Android app. It should be read with our Terms of Service.
What we collect
What you give us
- Your account: your email address and sign-in details. Sign-in is run by Clerk (see "Who else handles your data"); we keep your Clerk user ID and email address.
- Your profile: name, email, phone number, postal address, links (LinkedIn, GitHub, portfolio), the roles, places and pay you are looking for, your skills, a summary of your experience, deal-breakers, the companies you follow and your job search goal.
- Your resume: the text of your resume and the original file you uploaded (PDF or Word), kept in our database. Uploading a new file replaces the old one. Tailored versions written for particular jobs are kept too.
- Your answers: the answers you save for application questions, including standard answers such as whether you are authorized to work, whether you need sponsorship, your salary expectation, notice period and willingness to relocate.
- Self-identification (optional): if you choose to, you can store answers to the voluntary demographic questions employers ask (for example gender, race or ethnicity, veteran status, disability status, sexual orientation). This is off until you turn it on, we record when you agreed, and these answers are only ever taken from what you stored. They are never guessed or written by AI.
- Corrections and problem reports: when you correct an answer we filled and press Save, we keep the question, the options, our answer and yours, so we fill it better next time. When you report a problem, we keep your note, the field it was about, the address of the page (without the part after "?" or "#"), the form's structure with its values removed, and the app version. A screenshot, and on the Android app a set of technical diagnostics (the app's views, recent taps, drawing health, versions and the apply browser's log), are attached only if you tick the box to include them.
- Payment details: if you subscribe, payment is handled by Stripe. We never see or store your card number. We keep your Stripe customer and subscription IDs, your plan and your credit balance.
What we create while working for you
- Jobs and scores: jobs we found for you, how well each fits your resume, and your notes.
- Applications: the cover letters and tailored resumes we drafted, the answers filled in, and the record of what was sent.
- Receipts: for each application sent, a record of every question and answer, the names, sizes and fingerprints of the files attached (not the files themselves), the time and the employer's confirmation. A receipt cannot be edited once written and is deleted only with your account.
- Prepared answers, briefings, reviews, interview prep and practice: drafts and summaries we write to help you.
- Activity and notifications: a timeline of what Hirelit did for you, and the short notifications we show you.
- Usage records: for each AI request, the provider, model, number of tokens, cost, which feature asked and who paid for it. These records do not contain the text that was sent.
What we collect automatically
- Server logs: our server logs what it does (for example "scan finished" or an error), tagged with your user ID. Email addresses are shortened (for example
m***@gmail.com) and keys, tokens and signed links are removed before anything is logged. Logs are used to run and fix the service; see "How long we keep it". - On your device: the web app keeps a few settings in your browser's local storage (your theme, display density, which tips you have seen, a few view preferences). Clerk uses cookies to keep you signed in. We use no advertising or analytics cookies, and no third-party analytics or tracking tools of any kind.
Information about other people
If your resume, answers or notes mention other people (for example a reference), make sure you are allowed to share it. Emails we read from Gmail contain the sender's name and address.
Connected accounts
Gmail
Connecting Gmail is optional. It lets replies from employers update your applications.
- Permission: we ask Google for read-only access (
gmail.readonly). We cannot send, delete or change your email. - What we look at: only messages received since your last check (the first check looks back 14 days), not sent by you, that come from application systems (such as Greenhouse, Lever, Ashby, Workday, SmartRecruiters, iCIMS, Workable or LinkedIn's job emails) or are to or from an employer you applied to. Attachments are never opened. We read at most 300 messages a day.
- What we do with them: we read the message to decide whether it is an acknowledgement, a rejection, an interview invitation, an offer or something else. When our rules cannot tell, the first 4,000 characters of the message are sent to the AI provider (see "AI providers") to classify it. During an application, we may also look for an employer's security-code email so the form can be finished.
- What we store: for messages about your applications, the subject, sender, date, Gmail's short snippet and the message ID. We never store the body of an email, and messages that are not about your applications leave no trace. Security codes are never stored. We keep your Gmail address and a refresh token, encrypted.
- Disconnecting: Settings > Connected accounts > Disconnect revokes our access with Google and deletes the token. Replies already recorded stay with your applications until you delete them or your account (their snippets are removed after 12 months; see "How long we keep it"). You can also remove access from your Google Account at any time.
Hirelit's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Gmail data for advertising, do not sell it, do not let people read it except where you ask us to for support, security or the law requires it, and do not use it to train AI models.
Connecting LinkedIn to our server is optional.
- What happens: when you press Connect LinkedIn, the Chrome extension (or, in the Android app, the in-app browser after you sign in to linkedin.com) reads the cookies for linkedin.com, and only for linkedin.com, and sends them to our server. We keep at most 60 of them, and require LinkedIn's sign-in cookie. We never see your LinkedIn password.
- Where they are kept: in a private browser profile for your account on our server's disk, not in our database. They are protected by access controls on our server, not by an extra layer of encryption of our own.
- What they are used for: to search LinkedIn for jobs and to fill LinkedIn Easy Apply forms from our server for you, while Automate LinkedIn is on.
- Risk: LinkedIn's User Agreement bans automation tools, and accounts that use them can be restricted. See our Terms of Service and switch Automate LinkedIn off if you do not accept that risk.
- Removing it: signing out of LinkedIn everywhere ends the session we hold. Deleting your account deletes the browser profile.
The Chrome extension and the Android app
The Chrome extension fills application forms in your own browser, where you are already signed in.
- It is loaded on the pages you visit so it can recognise an application form, but it only acts on pages Hirelit opened, on known application systems (for example Greenhouse, Lever, Ashby, Workday, iCIMS, Workable and LinkedIn), and, only if you switch on Offer on every site, on other pages with a form of three or more fields. Ordinary browsing sends nothing to Hirelit.
- On a page it acts on, it sends the form's visible questions and options to our server to find your answers, and, after you submit, the answers that were sent, the page address and the job title and company, so we can keep your receipt. It never presses Submit for you.
- It reads cookies only for linkedin.com, and only when you press Connect LinkedIn.
The Android app shows the same web app and fills employer forms in its own in-app browser in the same way. It reads LinkedIn cookies only when you press Connect LinkedIn, and only for linkedin.com. It checks for notifications from our server while it is open; it does not include any analytics or crash-reporting tools. If Android backup is on for your phone, Android may back up the app's settings to your Google account.
How we use your information
We use your information to:
- find and score jobs for you, draft answers, cover letters and tailored resumes, and fill and track applications;
- run Autopilot, if you turn it on, within the limits you set;
- read replies from employers, if you connect Gmail;
- show you notifications and, if email notifications are set up, email you about applications that need you;
- keep receipts of what was sent on your behalf;
- run billing and enforce plan limits;
- keep the service secure, prevent abuse, and fix problems you report;
- meet our legal obligations.
We use what we learn about application forms (which questions a site asks and how reliably it fills) to improve Hirelit for everyone, but that shared record contains no personal information. Your answers are never used to fill anyone else's applications.
We do not sell or rent your personal information, we do not use it for advertising, and we do not use it to train AI models.
AI providers
Hirelit uses AI models to score jobs, write drafts (answers, cover letters, tailored resumes, interview prep) and classify emails. For each task we send only what that task needs: for example your resume and a job posting to score a job, or a question, your saved answers and your profile facts to draft an answer.
- Your own key: in Settings > Your AI you can add your own key for Anthropic (Claude), Google (Gemini), OpenAI, OpenRouter or another compatible service. Your requests then go to that provider under your agreement with them. Keys are encrypted when stored and are never shown again or sent to the extension or the app.
- Our key: without your own key, requests go to the provider we choose, currently Google's Gemini API, under our account. Our server's own agents (which help diagnose and finish applications that went wrong) always run on our key, currently with Anthropic's Claude.
Each provider processes this data under its own API terms and privacy policy. Everything AI writes is a draft; see the Terms of Service for your responsibility for what you send.
Who else handles your data
We share personal information only with the service providers below, only for running Hirelit, and only as much as each needs:
- Fly.io hosts our server and database in its Ashburn, Virginia (USA) region.
- Vercel hosts the web app's pages (they contain no personal data until you sign in).
- Clerk runs sign-in and holds your email address and sign-in details.
- Stripe processes payments and holds your billing details, if you subscribe.
- Google provides Gmail access, if you connect it, and the Gemini API.
- AI providers (Anthropic, Google, OpenAI, OpenRouter or the one you choose) process the text described in "AI providers".
- An email delivery service, if email notifications are set up, delivers our emails to you.
We also share information:
- with employers, when you apply: the answers, resume and documents in an application go to the employer and its application system when the application is sent. What happens to them then is governed by the employer's own privacy policy, and we cannot recall them;
- with LinkedIn and job sites: when our server searches or applies for you, those sites see the activity as coming from your account;
- when the law requires it, or to protect people, our users or the service;
- if the business changes hands, with the new owner, who must respect this policy.
Where your data is stored
Your data is stored and processed in the United States (Fly.io in Virginia), and some of the providers above may process it in other countries. If you are in Canada, this means your information leaves Canada and may be accessible to courts, law enforcement and national security authorities of those countries under their laws. Each provider is bound by its service terms to protect it and to use it only to provide its service to us.
How long we keep it
While your account is open, we keep your profile, resumes, answers, jobs, applications, receipts, interviews and settings so Hirelit keeps working, until you delete them or your account. Data that is only useful for a while is deleted automatically, once a day, on these periods:
- A copy of your data you asked for: 7 days after it is ready; deleted within a day after that. A copy that failed is deleted after 1 day.
- Screenshots and diagnostics attached to a problem report: 180 days. The written report is kept for 2 years.
- Notifications: 90 days.
- Reply suggestions from Gmail you dismissed or never confirmed: 12 months.
- The snippet of an email that updated an application: 12 months. The outcome, subject, sender and date stay with the application.
- Per-request AI usage records: 13 months; after that only monthly totals (cost, tokens and number of requests per model and feature) are kept.
- Answers drafted ahead of an application: 60 days, or until the job is archived.
- Jobs Hirelit archived for you (closed, duplicate or dead link) that you never saved, applied to or practised for: 180 days. Jobs you dismissed are kept so they stay hidden.
- Step-by-step records of automated runs: 12 months. What was sent is kept on your receipt.
- Morning briefings: 90 days (the newest is always kept).
- Time spent in the app per day: 13 months.
- Daily usage counters: 90 days.
- Our record of Stripe payment events: 18 months, with no link to you after your account is deleted.
- Temporary files (resume PDFs made for an upload or download): 3 days at most; normally deleted straight away.
- The activity history shown in the app: 24 hours, in our server's memory only.
- Server logs: a short period set by our hosting provider, Fly.io. We do not send logs to any other service.
When you delete your account (Settings > Privacy and data > Delete your account): we cancel any subscription at once with no further charge, delete your customer record at Stripe, revoke Gmail access, close and delete your LinkedIn browser profile and temporary files, delete every row of your data in one step, and then delete your sign-in at Clerk. Deleting the Stripe customer removes your email and saved card from Stripe; Stripe keeps the invoices and payment records already made (with the name, email and card summary on them) because the law requires it to keep financial records. Our record of past Stripe events keeps no link to you.
Backups: copies of our server's disks are kept for a short time (currently 5 days) and then replaced. We do not restore deleted accounts from them.
What employers received from your applications stays with them.
How we protect it
- Everything travels over encrypted connections (HTTPS).
- AI keys, your Gmail refresh token and other access tokens are encrypted at rest (AES-256-GCM) and are never sent back to any app.
- The extension's connection to your account is stored only as a fingerprint (a hash), not the token itself.
- Every request is checked against your account, and each person's data is kept separate from everyone else's.
No system is perfectly secure. If a breach of your information creates a real risk of significant harm, we will tell you and the Office of the Privacy Commissioner of Canada as the law requires.
Your rights and choices
You can, at any time:
- see and download your data: Settings > Privacy and data > Download your data gives you a file with all of it, plus the resume you uploaded (secrets such as keys and tokens are left out);
- correct it in your profile, answers and settings;
- delete it, item by item or all at once by deleting your account;
- withdraw consent for optional features: turn off self-identification, disconnect Gmail, switch off Automate LinkedIn or Autopilot, or change notifications;
- ask us about how we handle your information, or for anything above that you cannot do yourself, at support@innomactic.com. We answer within 30 days.
If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.
In Quebec, under Law 25 you also have the right to be told about decisions made only by automated processing and to have them reviewed by a person, and to have your information given to you or another organisation in a structured, commonly used format. Hirelit does not make decisions about you by automated processing alone: job scores and drafts are suggestions you act on. You can contact the Commission d'accès à l'information du Québec.
Outside Canada, Hirelit is run from Canada, but we honour requests from people elsewhere. If you are in the European Economic Area, the United Kingdom or Switzerland, you can ask us to access, correct, delete, restrict or port your data, or object to how we use it, and you may complain to your local data protection authority. Our legal bases are performing our contract with you (running the service), your consent (optional features such as Gmail and self-identification, which you can withdraw), and our legitimate interest in keeping the service secure. If you are in California or another US state with a privacy law, you can ask to know, correct and delete your information; we do not sell or share it for targeted advertising, and we will not treat you differently for using your rights. Write to support@innomactic.com.
Children
Hirelit is not for anyone under 16, and we do not knowingly collect information from them. If you believe someone under 16 has an account, write to support@innomactic.com and we will delete it.
Changes to this policy
When we change this policy we update the date at the top. If a change materially affects how we use your information, we will tell you in the app or by email before it takes effect. If you would like an earlier version, ask us at support@innomactic.com.
Contact
Innomactic, Ontario, Canada. Email: support@innomactic.com. Our privacy contact reads every message sent to this address.