Privacy Policy

1. Who we are

Hyrable (“Hyrable”, “we”, “us”, “our”) is a job-search automation service operated as an independent product. For questions about this policy, contact us at privacy@hyrable.co.

2. What data we collect

We collect the following categories of personal data:

• Account data: Your email address, collected when you sign up via Supabase Auth.
• Profile data: Name, phone, LinkedIn URL, right-to-work status, salary expectations, target job titles and industries - provided by you in the Profile section.
• CV data: Your CV text and/or PDF, uploaded by you. This is the most sensitive data we hold.
• Application data: Job applications you create, including tailored CVs, cover letters, and application answers generated by AI from your CV.
• Usage data: Number of AI operations performed (tokens consumed, estimated cost) - used only to enforce daily fair-use quotas.
• Technical data: Server logs, error traces - retained for up to 30 days and used only to diagnose technical issues.

3. How we use your data

• To operate the service: match jobs to your profile, tailor CVs, track applications
• To send transactional emails: daily job digests, quota notifications, follow-up reminders
• To enforce fair-use quotas and process subscription payments (via Stripe)
• To improve the service - aggregate, anonymised analytics only; never individual-level data sold or shared

We do not sell your personal data to any third party.

4. AI processing - Anthropic Claude

Hyrable uses Anthropic's Claude API to score jobs, tailor CVs, draft cover letters, and power the mock interview feature. When AI features are used, your CV text and the relevant job description are sent to Anthropic's servers.

Anthropic's data processing is governed by their Privacy Policy. Anthropic does not use API-submitted data to train their models by default (as of the date of this policy - please verify with Anthropic's current terms).

5. Where your data is stored

Your data is stored in Supabase, hosted on AWS in the EU (eu-west-2 / London or eu-central-1 / Frankfurt) region. Supabase is SOC 2 Type II certified. All data is encrypted at rest and in transit.

CV files (PDFs) are stored in Supabase Storage (private S3-backed bucket). Files are accessible only via short-lived signed URLs generated for your session.

6. Legal basis (GDPR / UK GDPR)

• Contract performance: Processing your CV, profile, and applications is necessary to provide the service you signed up for.
• Legitimate interests: Service security, fraud prevention, aggregate analytics.
• Consent: Marketing communications (if applicable in future). You may withdraw consent at any time.

7. Your rights

Under UK GDPR and EU GDPR, you have the right to:

• Access - request a copy of all personal data we hold about you
• Rectification - correct inaccurate data (much of this you can do directly in the app)
• Erasure - request deletion of your account and all associated data
• Portability - receive your data in a machine-readable format
• Restriction / Objection - limit or object to certain processing

To exercise any of these rights, email privacy@hyrable.co. We will respond within 30 days.

You also have the right to lodge a complaint with the ICO (UK) or your local supervisory authority.

8. Data retention

• Account and profile data: retained until you delete your account
• Job and application data: retained for 12 months after last activity, then deleted
• Stripe billing data: governed by Stripe's retention policies (typically 7 years for financial records)
• Server logs: 30 days

9. Cookies

Hyrable uses only essential cookies necessary for authentication (Supabase session cookie). We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

10. Third-party services

11. California residents (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you the following rights in addition to those described above:

• Right to know - request disclosure of the categories and specific pieces of personal information we have collected, the sources, the business purpose, and any third parties we share it with.
• Right to delete - request deletion of your personal information (subject to certain exceptions). You can exercise this directly via Settings → Delete account, or by emailing us.
• Right to opt out of sale - we do not sell, rent, or share your personal information with third parties for their own marketing purposes. There is nothing to opt out of.
• Right to non-discrimination - we will not discriminate against you for exercising any of these rights.
• Right to correct - request correction of inaccurate personal information (most of this you can do directly in the app).

To exercise your California rights, email privacy@hyrable.co with the subject line “CCPA Request”. We will respond within 45 days.

We collect the following categories of personal information: identifiers (name, email), professional information (CV, work history), usage data, and billing information. Full details are in sections 2–3 above.

12. Changes to this policy

We may update this policy when we add new features or processors. Material changes will be communicated by email before they take effect. The date at the top of this page always reflects the most recent version.

13. Contact

Email: privacy@hyrable.co