The short version
Tailr tailors your résumé to a job posting. By default we run the AI for you (the Free, Go, and Pro plans). You can instead use the bring-your-own-key (BYOK) plan, where your own AI key is stored on your account, encrypted at rest, and used only to run your requests — never logged and never in plaintext. Either way, we build the product to hold as little as possible: uploads are parsed in memory, generated files are dropped within about half an hour, and we don't sell your data and don't train any AI model on your résumé content. You can delete your account and everything tied to it yourself, at any time.
Who we are & what this covers
This policy explains how Tailr ("we," "us," or "our") handles personal information when you use the Tailr website and app (the "Service"). It applies to visitors, people who create an account, and paying subscribers. It doesn't cover the third-party services we integrate with — your AI provider, Stripe, or the external job-posting sites you ask us to read — each of which has its own privacy policy. For questions or to exercise your rights, contact [email protected].
Information we collect
Account information
To tailor a résumé you need a Tailr account. When you sign up we collect your email address and authentication details, handled through our accounts provider, Supabase. We do not store your password ourselves.
Résumé content & uploads
The résumé you upload (PDF or DOCX) is received and parsed in memory into structured fields — it is not written to disk during processing. The parsed data, the tailored résumé HTML, and the rendered PDF/DOCX are held transiently so you can preview and download them (see retention below). If you are signed in, a copy of these artifacts may be stored against your account so your dashboard works, and is purged on the schedule described below.
Job postings you add
When you add a job-posting link, our crawler fetches that page to extract requirements and keywords. The crawler refuses internal and private network addresses and enforces size and time limits, so it only reaches the public posting you pointed it at.
Your AI API key (BYOK only)
On the managed plans (Free, Go, Pro) you don't supply a key at all — we run the AI for you. On the BYOK plan, the key you provide for your chosen provider (Tailr supports OpenAI, Anthropic, Google, and many other major providers, plus any OpenAI-compatible endpoint you configure) is stored on your account, encrypted at rest using AES-256-GCM — never in plaintext and never written to our logs. We use it only to run your tailoring requests on our server, and you can remove or replace it at any time.
Dashboard history
To power your dashboard, we store a small record per generated résumé — the job link, company, role, résumé file name, ATS score, and a timestamp. If you're signed in, it's tied to your account; if you're not, it's keyed to an anonymous device id (tailr_cid) kept in your browser's local storage, which contains no personal information.
Cover letters (Pro & BYOK)
When you generate a cover letter, we store the letter text and the job, company, and role it was written for, along with your chosen formatting, so you can revisit and download it.
Gamification data (Pro)
If you're on Pro, we store a small set of progress figures tied to your account — experience points, current and longest streak, remaining streak freezes, your last active date, and which badges you've earned. These are counts, dates, and identifiers and contain no additional personal information.
Payment information
Paid plans are processed by Stripe. Stripe collects and handles your payment details directly under its own privacy policy; we do not receive or store your full card number. We keep a minimal record of your plan and subscription status so we can give you the access you paid for.
Technical & usage data
Like any web service, we process standard request metadata — for example your IP address, used for rate-limiting and abuse prevention — and keep minimal server logs to operate and secure the Service. We do not log API keys or full résumé contents.
How we use your information
- To provide the core Service — parse your upload, read the posting, tailor and score your résumé, and render your PDF/DOCX.
- To run your AI requests (using our managed AI, or your BYOK key) and return the result to you.
- To maintain your account and dashboard history.
- To process payments and manage your subscription (via Stripe).
- To secure the Service — rate-limiting, abuse prevention, and troubleshooting.
- To communicate with you about the Service, such as important account or billing notices.
- To comply with legal obligations.
How your résumé & AI requests are processed
When you tailor a résumé, Tailr assembles a request from your résumé content and the job posting and sends it to an AI provider on our server. On the managed plans we use our own provider access; on BYOK we use your stored key. The provider processes that request under its own terms to generate the tailored text, which we return to you. We never use your résumé content to train any AI model. On the managed plans, we rely on our providers' standard API terms, which generally do not use API inputs to train their models; on BYOK, your usage is governed by your own account's terms with that provider. Providers may retain request data briefly for their own abuse-monitoring under their policies.
What we never do
- Sell or rent your personal data.
- Train AI models on your résumé or job data.
- Log your BYOK API key, or store it in plaintext.
- Use advertising or cross-site tracking.
Legal bases for processing
Where the GDPR or similar laws apply, we rely on: performance of a contract (to provide the Service you asked for); legitimate interests (to secure the Service, prevent abuse, and improve reliability, balanced against your rights); consent where we ask for it; and legal obligation where the law requires us to process or retain data.
Who we share with
We don't sell your data. We share it only with the service providers ("subprocessors") needed to run Tailr, each handling only what its function requires:
- Supabase — accounts and authentication, and storage of the data tied to your account.
- Stripe — payment processing and subscription management for paid plans.
- AI provider — processes the content of each tailoring request to generate the result. On the managed plans this is the provider Tailr uses; on BYOK it is the provider whose key you supplied — which may be OpenAI, Anthropic, Google, another supported provider, or any custom OpenAI-compatible endpoint you configure. Each operates under its own terms and privacy policy.
- Cloudflare — content delivery, network security, and privacy-first, cookieless Web Analytics (aggregate page views and referrers; no cookies, no cross-site tracking, no personal profile).
We may also disclose information if required by law, to enforce our Terms, or to protect the rights, safety, and security of Tailr and its users. If Tailr is ever involved in a merger, acquisition, or sale of assets, data may transfer as part of that transaction, subject to this policy.
International data transfers
Our providers may process data in countries other than yours, including the United States. Where personal data is transferred across borders, we rely on appropriate safeguards (such as our providers' standard contractual clauses) to protect it consistent with this policy.
How long we keep things
- Generated résumés & PDFs (working copies): held transiently — about 30 minutes — so you can preview and download them, then automatically dropped.
- Stored résumé artifacts (signed-in): if you're signed in, the stored PDF, HTML, and parsed input attached to a generation are automatically purged after about 90 days; the dashboard metadata row (link, company, role, score, timestamp) is kept so your history stays intact.
- Dashboard history: your most recent entries (about 500). You can delete individual items at any time, or remove everything by deleting your account.
- Cover letters: the letter text and any personal details are redacted after about 90 days, the same retention schedule as generations, keeping only non-personal metadata.
- Gamification data: kept while your account is active and deleted when you delete your account.
- Account data: kept while your account is open, and removed when you delete your account.
- Server logs: kept briefly for security and troubleshooting, then rotated out.
Security
We aim to minimize what we hold in the first place, and to protect what we do. Traffic is served over HTTPS with hardened security headers. BYOK keys are stored encrypted at rest (AES-256-GCM) and are never logged. Uploads are parsed in memory rather than written to disk, and are size-limited. The job-posting crawler is guarded against server-side request forgery so it can't be steered at internal systems. No system is perfectly secure, but holding less, for less time, is our first line of defense.
Cookies & local storage
Tailr keeps browser storage minimal and uses no advertising or cross-site tracking. Sign-in is handled with token-based authentication rather than our own tracking cookies, and your dashboard link lives in a small anonymous local-storage id (tailr_cid). Our analytics (Cloudflare Web Analytics) is cookieless and sets nothing in your browser. For the full list, see our Cookie Policy.
Your rights & choices
Depending on where you live (for example under the GDPR or CCPA), you have rights over your personal data, including to access it, correct it, delete it, export a copy, and object to or restrict certain processing. You can exercise many of these directly: use BYOK to keep your key in your hands, remove individual dashboard items whenever you like, and delete your account and everything tied to it yourself. Because we do not sell personal data, there is nothing to opt out of on that front. To make any other request, email [email protected]; we'll respond within the timeframe the law requires. You also have the right to complain to your local data-protection authority.
Deleting your account & data
If you have an account, you can delete it yourself at any time: open the account menu (your avatar, top right) and choose Delete account. This permanently removes your profile, dashboard history, generated résumés, stored files, and your sign-in — everything tied to your account — from our servers. It's immediate and can't be undone.
Prefer we handle it, or don't have an account but want data tied to your device id removed? Email [email protected] and we'll erase everything we hold for you.
Children
Tailr isn't directed to children under 16, and we don't knowingly collect their personal data. If you believe a child has given us data, contact us and we'll delete it.
Changes to this policy
We'll post any changes here with a new "last updated" date, and for material changes we'll take reasonable steps to let you know. Your continued use of the Service after an update means you accept the revised policy.
Contact
Questions, requests, or concerns about your privacy? Email [email protected].