Privacy Policy

Account data. When you create an account: your email address and, if you sign in via a third-party provider (Google, LinkedIn), your name and profile picture as provided by that provider.

CV data. The CV or CVs you upload. We parse and index this content to understand your experience, skills, and writing style so that application materials can be tailored to sound like you.

Search preferences. The criteria you set for each automation: target roles, locations, salary expectations, deal-breakers, and search schedule.

Behavioural signals. Your decisions within the product — which matches you approve, skip, or flag, and which applications lead to interviews. We use this to improve the fit scoring and ranking for your automations over time.

Generated content. The cover letters, CV adaptations, and screener answers we generate on your behalf. These are stored in your account so you can review and retrieve them.

Payment data. If you subscribe to a paid plan, payment is handled by Stripe. We store your subscription status and plan tier; we do not store your card details.

Usage data. Standard server logs: IP address, browser type, pages visited, and timestamps. Used for security monitoring and debugging.

We use your data only to provide and improve the Legworker service:

• To run your automations, search job boards, and score matches against your criteria.
• To generate tailored application packages when you request them.
• To improve the accuracy of fit scoring based on your approval and skip history.
• To manage your subscription and process payments via Stripe.
• To send transactional emails (new matches, account notifications). We do not send marketing email without your explicit opt-in.
• To investigate security incidents and prevent abuse.

We do not sell your data. We do not share your CV or application materials with employers. We do not use your data to train AI models beyond what is necessary to provide the service to you.

Under UK GDPR, we rely on the following legal bases:

• Contract. Processing your CV, running automations, and generating application packages is necessary to deliver the service you signed up for.
• Legitimate interests. Usage logging for security monitoring and improving our matching algorithms — balanced against your privacy interests.
• Legal obligation. Retaining records as required by applicable law.
• Consent. Marketing communications, where applicable.

Your data is stored on servers located within the European Union, using Supabase as our database provider. Supabase uses row-level security (RLS), which means your data is isolated at the database level — queries from one account cannot access another.

All data in transit is encrypted via TLS. Data at rest is encrypted by the storage provider. We conduct periodic reviews of access controls and limit internal access to personal data to those who need it to provide the service.

No security system is infallible. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within the timeframe required by law.

We share your data with a limited set of processors who help us deliver the service. Each is bound by data processing agreements:

• Supabase — database and authentication (EU servers).
• Anthropic— AI model provider used to generate cover letters, CV adaptations, and screener answers. Content you generate is processed by Anthropic's API. Anthropic's privacy policy governs their handling of this data.
• Stripe — payment processing. Stripe is PCI-DSS compliant.
• AWS — hosting infrastructure (EU region).

We do not use your data with any advertising networks or data brokers.

We retain your data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or compliance purposes (for example, records of transactions).

You can request deletion of specific data (such as a particular CV or generated cover letter) at any time from within your account settings, without closing your account.

Under UK GDPR you have the right to:

• Access. Request a copy of the personal data we hold about you.
• Rectification. Ask us to correct inaccurate data.
• Erasure. Ask us to delete your data, subject to legal retention requirements.
• Restriction. Ask us to limit how we process your data in certain circumstances.
• Portability. Receive your data in a machine-readable format.
• Object. Object to processing based on legitimate interests.
• Withdraw consent. Where processing is based on consent, withdraw it at any time.

To exercise any of these rights, email us at privacy@legworker.app. We will respond within 30 days.

If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

We use a minimal set of cookies necessary to operate the service: session authentication cookies and preference storage. We do not use advertising or tracking cookies. We do not use third-party analytics services that track you across other websites.

We may update this policy as the service evolves. If we make material changes, we will notify you by email and update the effective date above. Continued use of the service after changes take effect constitutes acceptance of the updated policy.

Questions about this policy or how we handle your data: privacy@legworker.app