FlintApply — Legal

Privacy Policy

Last updated:

This Privacy Policy explains how FlintApply ("we", "us") collects, uses, shares, and protects your information.FlintApply is operated by The Flint AI (Alireza Barzin Zanganeh). Our Data Protection Officer (DPO) can be reached at privacy@flintapply.com.

1. Lawful Bases (GDPR Art. 6)

  • Performance of contract — running your subscription, building tailored résumés / cover letters, and answering support tickets.
  • Consent — marketing emails, optional analytics, and opt-in features. You can withdraw consent at any time without affecting prior processing.
  • Legitimate interest — security audit logs, fraud prevention, and platform abuse mitigation. These are minimised and balanced against your rights.
  • Legal obligation — financial / tax record-keeping for paid transactions.

2. Categories of Data We Process

  • Account & identity: email, display name, authentication provider (email / Google / GitHub / Microsoft / LinkedIn), TOTP secret (encrypted), recovery code hashes.
  • Profile & résumé content: master résumé, chunks, generated tailored versions, cover letters, fit scores, embeddings.
  • Job-search activity: saved searches, cached job rows, application tracker entries.
  • Security & fraud prevention: signup IP address, hashed device/browser fingerprint (never raw fingerprint inputs), Turnstile signals, and auth audit metadata. Processed under legitimate interest (GDPR Art. 6(1)(f)) to prevent free-tier abuse. Under EU ePrivacy rules, reading device characteristics for this purpose is disclosed here rather than via a separate cookie banner.
  • Billing: Stripe customer / subscription IDs, payment-failure timestamps, refund records. Card data never touches our servers.
  • Usage telemetry: minimised structured logs (no plaintext secrets, no full PII bodies) for security and reliability.

2a. Chrome browser extension

The optional FlintApply browser extension (Chrome Web Store) connects to the same account and API as the web app. It does not run in the background to monitor your browsing.

  • What we collect via the extension: when you click Save job or use Autofill, job description text and form field values you choose to fill are sent to our API (api.flintapply.com) over HTTPS to tailor or pre-fill applications. We do not collect page content unless you trigger those actions on a supported job or application page.
  • Local storage: access and refresh tokens, token expiry metadata, and extension UI preferences are stored in chrome.storage.local on your device. Passwords are never stored in the extension; email/password sign-in sends credentials directly to our API for authentication.
  • Sign-in: Google, GitHub, or Microsoft sign-in opens the provider's authorization page. OAuth authorization codes are exchanged with our API; we do not receive your provider password.
  • What we do not collect: audio, video, screen recordings, keystroke logging, or your full browsing history.
  • Sharing: extension traffic uses the same sub-processors as the web app (see §4). OAuth providers process sign-in according to their own policies during authentication only.

3. Retention

The following retention windows apply:

  • Account & profile data — for the lifetime of your account.
  • Generated résumé / cover-letter outputs — kept readable for 90 days after subscription ends; archived 1 year cold; then purged.
  • AdminAuditLog — 7 years (financial / compliance).
  • AuthAuditLog — 1 year.
  • Signup IP and hashed device fingerprint — retained while the account is active and for up to 90 days after closure, then deleted with other account metadata (aligned with auth audit retention).
  • Notification rows — 90 days hot, then archived 1 year.
  • Application logs (structlog) — 30 days hot in CloudWatch, 1 year cold in S3, then deleted.
  • Account closure — soft-delete with a 30-day grace; backups purged within 60 days of grace expiry. Résumé chunks and vector embeddings are removed when closure executes.

4. Sub-processors

We share data with the sub-processors listed at /legal/sub-processors. Material changes are announced with at least 30 days' notice in line with the §19.9 contract.

5. Your Rights

  • Access — export your data at any time via POST /api/account/export; the resulting ZIP includes machine-readable JSON + CSV.
  • Erasure — close your account via POST /api/account/close; soft-deleted with a 30-day grace, backups purged within 60 days of grace expiry. Master-résumé chunks, user-corpus fragments, and their pgvector embeddings are hard-deleted when closure executes (GDPR Art. 17).
  • Rectification — update profile data via the settings UI or the /api/profile/resume endpoint.
  • Data portability — the export ZIP is machine-readable.
  • Object / restrict processing — pause your subscription (§19.8) or opt out of marketing.
  • Lodge a complaint — you may complain to your national data protection authority.

6. Children

FlintApply is not directed at users under 16. Registration requires a self-attestation checkbox. If you believe a minor has registered, contact us and we will close the account.

7. International Transfers

Our infrastructure runs on AWS in the United States. Where data leaves the EEA / UK we rely on Standard Contractual Clauses with our sub-processors. See the sub-processor page for region details.

8. Security

  • Secrets at rest encrypted with AES-256-GCM. We do not accept or store customer-supplied LLM API keys.
  • TOTP secrets encrypted; recovery codes stored hashed only.
  • Strict CORS allowlist, signed Stripe webhooks, audited admin actions.
  • 15-minute access tokens, 7-day rotating refresh tokens with reuse detection.

9. CCPA / California Residents

See /legal/ccpa for our "Do Not Sell My Personal Information" statement: we do not sell user data.

10. Contact & SLA

Reach our DPO at privacy@flintapply.com or via the contact form. We respond to formal data-subject requests within 30 days.