Privacy Policy

Cass exists to get you hired, not to monetise your data. We collect what the product needs to work — your account, your CVs, your job activity — and nothing for advertising. We don’t sell your data, we don’t run ad trackers, and we don’t use your CVs to train AI models.

• Account data — your email address and password (or your Google account identity if you sign in with Google).
• Your documents — CVs you upload or paste, and the tailored CVs and cover letters Cass generates for you.
• Job-search data — your preferences (location, languages, salary floor, seniority, company size), job matches and their AI fit scores, and applications you track.
• Messages — anything you send through the contact form.

A CV is personal data by nature — it can include your name, phone number, photo, work history, and sometimes nationality or date of birth. Upload only what you’re comfortable storing, and prefer CVs without highly sensitive details you wouldn’t put in front of an employer anyway.

• to run the product: score job fits, rewrite CVs, draft cover letters and outreach;
• to email you a weekly digest of matches — only if you turn it on, and you can turn it off any time;
• to respond when you contact us;
• to keep the service secure and debug problems.

That’s the list. No advertising, no profiling beyond your own job search, no selling.

Cass is built on established cloud services. Each one processes only what its job requires:

• Supabase — our database and sign-in. Your account, CVs, and job data live here.
• Vercel — hosts the application.
• AI model providers (via our AI gateway) — receive CV text and job descriptions to produce fit scores, rewrites, and drafts. These calls are for processing only; your CV is not used to train their models.
• Apify — fetches public job listings from job boards. It receives search terms (job titles, city/country), never your CV.
• Apollo.io — only when you click “Find the recruiter” on a tracked application, we look up publicly listed recruiter contacts at that company. It receives the company name and role context, not your CV.
• Resend — sends the emails you asked for (digest, contact replies).

These providers store data on infrastructure that may be located outside the UAE (typically the US or EU). We choose providers with serious security practices and share the minimum each needs.

Your data stays as long as your account does. Delete a CV and it’s removed from our database; delete your account (or ask us to) and your CVs, matches, preferences, and tracked applications go with it. Operational logs are kept briefly for debugging and security, then age out.

You can ask us for a copy of your data, ask us to correct it, or ask us to delete it — under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, where it applies to you, the GDPR. Most of it you can already see and delete directly in the app (Library, Preferences, Tracker). For anything else, use the contact page and we’ll respond within 30 days.

We use only what’s needed to keep you signed in and remember your choices — no advertising or analytics cookies. Details in the Cookie Policy.

If this policy changes in a way that matters — new data collected, a new processor, a new purpose — we’ll flag it in the app rather than silently editing this page.