Swiffit believes in transparency, privacy, and your right to control your data.

1. What We Collect

We collect only the information necessary to provide and improve the Service:

• Account information: Email address, name, and avatar (from Google OAuth if used).
• Resume data: The files you upload and the text we extract from them. This data is used solely to provide the enhancement service.
• Job descriptions: URLs and text you provide for matching and tailoring.
• Job discovery and matching data: Target roles, filters, eligibility facts you confirm, matching-search settings, ranked-feed delivery and view history, and explicit Save, Pass, correction, calibration, and preference-reset events. Imported job URLs and files are included when you use the import tools.
• Usage data: Enhancement counts, feature usage, and product analytics to improve the product. Analytics are anonymous while you're signed out; once you log in or sign up, events are tied to your account ID (pseudonymous, not anonymous — see §2 for the full breakdown).
• Payment information: Processed entirely by Stripe. We never see or store your full card number, CVC, or billing address.
• Device data: Browser type, operating system, and IP address collected automatically for security and abuse prevention. When you change a consent choice, the audit event also records the consent-copy version, time, and request IP address.

2. How We Use Your Data

• To parse, analyze, and enhance your resume against job descriptions.
• To build an explainable personal job feed from the roles, filters, and eligibility facts you provide; preserve your Save, Pass, undo, calibration, and reset choices; and keep feed pagination and freshness consistent.
• To generate ATS compatibility scores and recruiter heatmaps.
• To generate downloadable PDF and DOCX documents.
• To manage your account and subscription.
• To send transactional emails (password resets, receipts, subscription updates).
• To detect and prevent fraud, abuse, and security incidents.
• To improve the Service through usage analytics — anonymous while you're signed out, tied to your account once you log in (see Legal basis below for the full breakdown).

Legal basis (GDPR Article 6)

For EU and EEA users, we process your personal data under the following legal bases under Article 6 of the GDPR:

• Contract (Art. 6(1)(b)): Processing necessary to deliver the Service you signed up for — account management, resume parsing and enhancement, job discovery and personal matching, subscription billing, and transactional email.
• Legitimate interest (Art. 6(1)(f)): Fraud and abuse prevention and security monitoring. Where we rely on legitimate interest, we have balanced our interest against your rights. (Product analytics' legal bases and exactly what data each flow carries are covered in the two bullets below, not here.)
• Consent (Art. 6(1)(a)): Non-essential, client-side (browser) analytics (PostHog) and error reporting (Sentry). One cookie-banner choice governs both — there is no separate category for each. Client-side analytics use a randomly generated anonymous ID while you're signed out; once you log in or sign up, events are tied to your account ID (pseudonymous, not anonymous). You can accept or decline and change your preference at any time.
• Consent (Art. 6(1)(a)), optional matching uses: Reading behavior for personal ranking, de-identified explicit match choices for population-level improvement, and de-identified job-and-label pairs for matching research each have a separate control in Matching settings. Every purpose starts off, core matching works without it, and the same switch withdraws consent. We keep a versioned consent event and withdrawal record so the change can be audited and propagated to any derived-data consumer.
• Legitimate interest (Art. 6(1)(f)), server-side: Server-side product analytics (PostHog) and server- and edge-side error monitoring (Sentry) run independently of the cookie banner, because they happen on our servers, not in your browser. Server-side analytics events are tied to your account ID so we can debug and improve the specific feature you used; they are not linked to your email or name in the event itself. Error monitoring strips email and IP before an event leaves our servers.
• Legal obligation (Art. 6(1)(c)): Retention of billing records and responses to lawful requests from public authorities where required.

3. AI Processing

We use Anthropic's Claude API to process your resume and job descriptions. Key facts about our AI processing:

• No Swiffit-owned model training: Swiffit does not use resume or job-search data to train Swiffit-owned models.
• Third-party processing terms: Anthropic's processing follows our configured commercial API terms; commercial API inputs and outputs are not used for model training by default, and retention depends on the API features and account configuration in use.
• Designed never to fabricate: Our AI is designed to enhance the presentation of your existing experience, not invent it — anything it can't trace to your resume or job description is flagged for your review rather than presented as fact.
• Confidence flagging: Changes the AI is less certain about are flagged with a “Verify” label so you can review them.

See Anthropic's Privacy Policy for more details on their data handling practices.

When qualified dense job retrieval is enabled, Voyage AI receives public job-posting text and a bounded query made from your target roles plus user-confirmed skill and relevant experience terms. That matching query excludes your identity and raw resume text. The separate ATS skills scorer may send resume bullet-point text and job-description skill text to Voyage AI when its hosted backend is active.

4. Data Storage & Security

Your data is stored securely using industry-standard protections:

• Encryption: All data is encrypted at rest (AES-256) and in transit (TLS 1.3).
• Infrastructure: Hosted on Supabase (AWS) with row-level security (RLS) ensuring only you can access your own data.
• File storage: Uploaded files are stored in encrypted cloud storage with per-user isolation.
• Access control: Internal access to user data is restricted, logged, and requires multi-factor authentication.

5. Data Sharing

We do not sell, rent, or share your personal data with third parties for marketing purposes. Period.

We share data only with the following service providers, solely to operate the Service (web app and desktop coach app):

• Anthropic — AI processing for resume enhancement, ATS scoring, and diagnostics on the web app.
• OpenAI — Real-time voice transcription and live chat coaching during active Swiffit Coach (desktop) sessions.
• Voyage AI — Text embeddings for ATS skills coverage and personal job retrieval on the web app. The older ATS scorer may use a local fallback; the qualified Phase II retrieval model has no local substitute.
• Stripe — Payment processing and subscription management.
• Supabase — Database hosting, authentication, and file storage for the web app; session-token verification for desktop/backend auth.
• Google Cloud (Firestore) — License, device-entitlement, and usage-metering store for the swiffit-api backend that powers the desktop coach app.
• Vercel — Hosting and edge delivery for the swiff.it web application.
• Resend — Transactional email delivery — account, billing, reminder, and onboarding emails.
• Upstash — Rate limiting and usage-metering counters for the web app's API routes, so one account or IP can't overwhelm the service.
• Cloudflare (Turnstile) — Bot and abuse protection (CAPTCHA alternative) on public forms — contact, newsletter signup, and coach waitlist.
• PostHog — Optional product analytics. Browser and server-side analytics both require the separate analytics purpose. Browser capture starts on a random anonymous ID and switches to the account UUID after authentication; server capture reads the current database consent immediately before dispatch. Both paths enforce fixed event-property allowlists.
• Sentry — Application error and crash reporting. Browser capture requires the analytics purpose, shuts down on withdrawal, and has session replay disabled. Server and edge error capture remains operationally necessary and applies an aggressive payload scrubber.

We may also disclose data if required by law, court order, or to protect the safety and security of the Service or its users.

6. Cookies

We use essential cookies for authentication sessions and remembering your preferences (theme, dismissed banners). Optional analytics cookies are only set if you accept them in the cookie banner. We do not use advertising cookies, retargeting pixels, or social media trackers.

7. Your Rights

You have the following rights regarding your personal data:

• Access: View all your data in the app at any time.
• Portability: Export a structured JSON copy of your account data from Settings, and download your enhanced resumes in PDF or DOCX format. Matching settings also provide a dedicated export of your matching searches and feedback history.
• Correction: Update your profile information at any time.
• Deletion: Delete your account and all associated data from Settings. This is permanent and irreversible.
• Objection: Object to specific data processing activities.
• Restriction: Request that we limit how we use your data.
• Optional matching consent: Grant or withdraw each optional matching purpose from Matching settings. Withdrawing an optional purpose does not remove the Save, Pass, and correction history used to provide your own feed; you can clear those learned effects separately or delete your account.

If you are in the EU/EEA, these rights include those granted under the General Data Protection Regulation (GDPR). If you are in California, you have additional rights under the CCPA. For any data requests, contact us at hello@swiff.it. We will respond within 30 days.

8. Children's Privacy

Swiffit is not intended for use by anyone under the age of 16. We do not knowingly collect personal information from children. If we learn that we have collected data from a child under 16, we will delete it promptly.

9. Data Retention

We retain your data for as long as your account is active. When you delete your account, we delete your personal data from our production systems immediately. This includes your profile, uploaded resumes, enhancement history, cover letters, application tracker, reminders, notifications, matching searches and feedback, consent history, usage events, and tool history. Clearing learned matching preferences stops prior feedback from affecting future ranking but retains that history in your export; deleting the account removes it. Backups that contain your data are overwritten on our standard rolling 30-day backup rotation, after which no copy of your personal data remains. Anonymized, aggregated analytics that cannot be linked back to you may be retained indefinitely.

10. International Transfers

Your data may be processed in the United States and other countries where our service providers operate. We ensure appropriate safeguards are in place for any international data transfers, including standard contractual clauses where required by applicable law.

11. Changes to This Policy

We may update this policy from time to time. Significant changes will be communicated via email or in-app notification at least 30 days before they take effect. Continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or how we handle your data, please contact us:

• Email: hello@swiff.it
• Contact page: swiff.it/contact

Data Protection Officer

For data-protection inquiries, including GDPR data-subject requests (access, portability, erasure, rectification, objection, restriction), reach our Data Protection Officer at privacy@swiff.it. Please include the email address on your Swiffit account so we can verify your identity. We respond within 30 days as required by GDPR Article 12(3).

EU representative

Swiffit is based in the United States and does not currently maintain an establishment in the EU. We serve EU users directly and respond to data-protection inquiries through the DPO email above. If you are an EU data subject and prefer to contact a supervisory authority, you may contact the data protection authority in your EU member state; a directory is maintained by the European Data Protection Board.

Breach notification

If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users without undue delay and, where feasible, within 72 hours of becoming aware, as required by GDPR Articles 33 and 34. Notifications will include the nature of the breach, the approximate categories and number of data subjects and records affected, likely consequences, and the measures we have taken or propose to take in response. Where the breach is unlikely to result in such risk, we will still log it internally for audit purposes and notify supervisory authorities as required by law.