Privacy Policy
Last updated:
In short
- We use what you tell Alex — your CV, profile, job preferences and chats — only to run your job search assistant.
- We never sell your data, never show you ads, and do not use your data to train AI models.
- To answer you, your content is processed by the AI providers and other service providers listed below.
- You can see and edit your profile in the app, and export or delete all your data at any time from Your data in the account menu.
- Candidate Ally recommends; you decide. It never applies to jobs or contacts employers for you.
1. Who we are
Candidate Ally (https://candidateally.com) is operated by SecreLab Limited, a company registered in Ireland (company number 790816), with its registered office at 77 Camden Street Lower, Dublin, D02 XE80, Ireland ("we", "us"). We are the controller of the personal data described in this policy under the EU General Data Protection Regulation (GDPR). You can reach us about anything in this policy at contact@candidateally.com.
This policy covers the Candidate Ally website and app, including Alex, the AI career assistant inside the app, and the optional Telegram channel.
2. Personal data we collect
Data you give us
- Account data. Your email address and a hashed password if you create an account. If you start without one, we create a guest account with no email address.
- Your profile. What you tell Alex about your career: current role, experience, education, skills, target roles, location and relocation preferences, work preferences, salary expectations, work authorization, notice period, contact details you choose to add (such as a phone number, LinkedIn or portfolio link), and the jobs, sectors, companies and skills you want to avoid.
- Documents and pasted text. Your CV and any text you paste or upload, such as a profile exported from another AI assistant or a job description. We store the text extracted from your CV.
- Conversations. The messages you exchange with Alex, in the app or on Telegram.
- Job search activity. Jobs you save, mark as applied or dismiss, interview dates, and notes.
- Messages to us. What you send when you email us or report a problem.
Please don't share sensitive information (such as health, religion, or ethnic origin) or other people's personal data that isn't needed for your job search. Alex doesn't need it.
Data we create from your use of the service
- Job matches. Job listings found for you, the score and fit evaluation for each one, and why a job was excluded.
- Generated content. Tailored CVs, draft emails, interview preparation, chat titles and summaries.
- Notes from past chats. After a session, Alex reviews it and keeps short dated notes (for example, that you applied somewhere or prefer plain wording) so it doesn't ask you the same things again. Suggested profile changes are only saved if you accept them.
- Your writing voice. To make tailored CVs and emails sound like you, we keep a small number of short messages you wrote yourself and a style summary built from them. You can clear them at any time from your profile.
- Technical and usage data. Your IP address and request data (for security, rate limiting and bot protection), the date of your visits, records of background tasks, and the amount of AI processing used per account (to control costs).
Telegram
If you link Telegram, we store your Telegram user and chat IDs so we can send and receive messages there. Telegram processes those messages under its own privacy policy.
3. How we use your data and our legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the service: your account, chats with Alex, your profile, job searches, fit evaluations, tailored CVs and interview preparation | Performance of our contract with you (6(1)(b)) |
| Running scheduled job searches and evaluations in the background, and showing you a briefing of what's new | Performance of contract (6(1)(b)) |
| Keeping notes from past chats and your writing voice to personalise future answers | Our legitimate interest in providing a useful, personalised assistant (6(1)(f)). You can object or clear your writing samples at any time. |
| Monitoring the quality and reliability of AI responses, fixing errors and measuring costs | Legitimate interests (6(1)(f)) |
| Keeping the service secure: preventing abuse, bots, prompt injection and misuse, and rate limiting | Legitimate interests (6(1)(f)) |
| Answering your messages and requests | Contract (6(1)(b)) or legitimate interests (6(1)(f)) |
| Complying with the law, responding to lawful requests, and establishing or defending legal claims | Legal obligation (6(1)(c)) and legitimate interests (6(1)(f)) |
Where we rely on legitimate interests, we have balanced them against your rights; you can ask us for details. We do not use your data for advertising and we do not sell it.
4. AI processing and automated decisions
Candidate Ally uses large language models to understand your messages, score and evaluate jobs against your profile, and draft content. AI output can be wrong or incomplete, so always check it — especially anything you send to an employer.
Job scores and fit evaluations are recommendations to help you decide where to spend your time. Candidate Ally makes no decision that has a legal or similarly significant effect on you within the meaning of Article 22 GDPR: it never applies to jobs, contacts employers, or shares your evaluations with anyone. Jobs are only filtered out according to exclusions you set yourself, and you can change them at any time.
We do not use your content to train AI models. The AI providers that process your content on our behalf handle it under their own terms, which may include keeping it for a limited time for abuse and safety monitoring.
5. Who we share your data with
We share personal data only with service providers that process it on our behalf (processors), and only as needed to run the service:
| Provider | What for | Location |
|---|---|---|
| Vercel | Hosting the website and app; bot protection | USA / global |
| Neon | Database that stores your account, profile and chats | USA (AWS us-east-1) |
| OpenAI, through OpenRouter | Generating Alex's replies, job scores and evaluations, drafts and notes. OpenRouter passes each request to OpenAI under our own OpenAI account; both receive your messages and the relevant parts of your profile and CV | USA |
| Langfuse | Monitoring AI requests and responses to find errors and measure quality and cost | EU |
| Inngest | Running scheduled and background tasks such as job searches | USA |
| Tavily | Web search for job listings and company research | USA |
| Jina AI | Reading a job posting page when you share a link | EU / USA |
| Telegram (only if you link it) | Delivering messages to and from Alex | Telegram's infrastructure |
To find jobs, we send search terms based on your profile (such as target roles and locations) to public job listing sites. We do not send them your name, contact details or CV.
We may also disclose personal data:
- When you choose to. If you make a chat public, anyone with the link can read the messages in it.
- For legal reasons. To comply with the law or a valid request from a public authority, or to protect the rights, safety and security of our users, us or others.
- In a business transfer. If our business is reorganised, sold or merged, your data may be transferred as part of that transaction, under this policy.
6. International transfers
Some of our providers are located outside the European Economic Area, mainly in the United States. When we transfer personal data there, we rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.
7. How long we keep your data
- We keep your account data, profile, chats and job search data for as long as your account exists.
- When you delete your account, we delete this data from our database straight away. Copies in database backups are overwritten within our providers' backup windows.
- Monitoring records (Langfuse) and background task logs (Inngest) are kept for a limited period under those services' retention settings. They are not removed the moment you delete your account; contact us if you want them deleted sooner.
- Guest accounts are kept like any other account until you delete them. If you lose access to a guest account (for example, by clearing your cookies), contact us and we will help where we can identify it.
- We keep emails you send us for as long as needed to handle your request, and longer only where the law requires it.
8. Your rights
Under the GDPR you have the right to:
- Access your personal data and get a copy of it;
- Rectify inaccurate data — most of your profile can be edited directly in the app;
- Erase your data;
- Restrict how we use it;
- Data portability — receive your data in a machine-readable format;
- Object to processing based on legitimate interests, including the notes and writing voice described above;
- Withdraw consent at any time, where we rely on it.
You can export all your data or delete your account yourself from Your data in the account menu. For anything else, email contact@candidateally.com. We reply within one month, and may need to confirm your identity first.
You also have the right to complain to a data protection authority. Our lead authority is the Irish Data Protection Commission (dataprotection.ie), and you can also contact the authority where you live or work.
9. Cookies and local storage
We only use cookies and browser storage that are strictly necessary for the service to work, so we don't ask for cookie consent:
- Session and security cookies that keep you signed in and protect sign-in forms (about 30 days).
- Preference storage that remembers things like your theme, sidebar and panel layout, and unsent drafts on your device.
- Bot protection signals checked when you send a message, to block automated abuse.
We don't use advertising or third-party tracking cookies. If we add product analytics in the future, we will ask for your consent first and update this policy.
10. Security
We use encryption in transit (HTTPS), access controls that keep each user's data separate, hashed passwords, and providers with industry-standard security. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as the law requires.
11. Age requirement
Candidate Ally is for people aged 18 or over. We do not knowingly collect data from anyone younger. If you believe a minor has used the service, contact us and we will delete their data.
12. Changes to this policy
We may update this policy as the service changes. We will change the date at the top, and if the changes are significant we will tell you in the app or by email before they take effect.
13. Contact us
SecreLab Limited, 77 Camden Street Lower, Dublin, D02 XE80, Ireland. Email: contact@candidateally.com. See also our Terms of Use.