Privacy Policy

1. Who is the controller

BoltHire is the personal information controller for data processed through the Service. We do not currently appoint an EU/UK representative; if that changes we will update this policy.

2. Personal data we collect

Depending on how you use BoltHire, we may process:

• Account data: name, email address, email verification status, profile image, password hash (for email/password accounts), and marketing email opt-out preference.
• Authentication data: Google OAuth tokens and related account identifiers when you sign in with Google.
• Profile and preferences: employment status, job titles, industry, work type, country, employment type, experience level, availability, relocation preferences, and related quiz answers.
• Resume and career data: uploaded resume files (stored in object storage), filename and file metadata, extracted raw text, display name, title, phone number, summary, location, years of experience, work history, education, skills, links (for example LinkedIn or GitHub), languages, and certifications.
• Application data: job titles and companies you track, match scores, cover letter text, tailored notes, application status, and related timestamps.
• Billing data mirrored from Lemon Squeezy: subscription status, plan tier, renewal and trial dates, customer/subscription identifiers, card brand and last four digits, and customer portal URLs. Full card numbers are processed by Lemon Squeezy, not stored by us.
• Support data: messages and identifiers you share via Crisp chat (such as email, nickname, user id, and plan).
• Technical and security data: session cookies, CSRF tokens, short-lived funnel cookies/local storage used before signup, and server logs needed to operate and secure the Service.
• Optional equal employment opportunity (EEO) answers: disability status, gender identity, veteran status, and security clearance — see Section 3.

Job listing content in our catalog is generally public or third-party sourced and is not treated as your personal data, except where it is linked to your applications.

3. Sensitive and special-category data (EEO)

Optional EEO fields (disability, gender identity, veteran status, security clearance) may constitute sensitive personal information under RA 10173 and special-category data under GDPR Article 9.

These answers are optional and collected only with your explicit consent. We do not share them with employers. We exclude them from profile embeddings and from AI prompts used for matching, resume structuring, and cover-letter generation.

You may leave these fields blank or ask us to erase them at any time using the contact details in this policy.

4. How we use personal data

We use personal data to:

• Create and secure your account, authenticate you, and reset passwords.
• Parse resumes, build your profile, compute match scores, and surface relevant listings.
• Generate draft cover letters, structured resume fields, and tailored notes using AI providers described below.
• Record Auto Apply actions and help you open listing URLs to complete applications yourself.
• Process subscriptions, trials, and entitlements via Lemon Squeezy.
• Send transactional email (for example password resets) and, where you have not opted out, lifecycle email such as welcome messages, abandoned-checkout reminders, and match digests.
• Provide in-app support via Crisp for entitled users.
• Maintain security, prevent abuse, debug issues, and comply with law.

Legal bases (where GDPR applies) typically include: contract performance (providing the Service you request), consent (marketing email opt-in/out, optional EEO), legitimate interests (securing and improving the Service, fraud prevention — balanced against your rights), and legal obligation where applicable.

5. AI and automated processing

We use OpenAI embedding models to create vector representations of your profile/resume text (excluding EEO and phone) and of job listings, to support matching.

We use DeepSeek chat models to structure resume content and to draft cover letters and tailored notes. Prompts may include resume text (subject to length limits), name, title, summary, skills, recent roles, and job descriptions. Phone numbers and EEO answers are excluded from these prompts.

AI outputs can be wrong or incomplete. You should review them before relying on them or sharing them with employers. Match scores are automated aids, not sole decisions about employment; hiring decisions are made by employers, not by BoltHire.

6. Who we share data with

We share personal data with service providers ("subprocessors") who process it on our instructions to run the Service:

• Google — authentication when you use Google sign-in (United States / global).
• PostgreSQL database host (as configured for our deployment) — primary application database.
• Cloudflare R2 — storage of resume files and avatar images.
• OpenAI — embeddings for matching (United States / global).
• DeepSeek — resume structuring and generation of cover letters and tailored notes (China).
• Lemon Squeezy — payments, subscriptions, and merchant-of-record billing.
• Resend — transactional and lifecycle email delivery.
• Crisp — in-app support chat for entitled users.
• Vercel (or our then-current hosting provider) — application hosting and delivery.

We may also disclose data if required by law, to protect rights and safety, or in connection with a merger, acquisition, or asset transfer (with notice where required).

We do not sell personal information as that term is commonly understood under the CCPA/CPRA, and we do not share personal information for cross-context behavioral advertising.

Employers receive only what you choose to submit when you complete an application on their site or systems. We do not transmit your EEO answers to employers.

7. International transfers

You use a Service operated from the Philippines. Your data may be transferred to and processed in other countries, including the United States (for example OpenAI, Lemon Squeezy, Resend, hosting) and China (DeepSeek).

China does not benefit from an EU adequacy decision. Where GDPR applies, we rely on appropriate safeguards such as standard contractual clauses and careful vendor selection, together with the measures described in this policy (including excluding EEO and phone from AI prompts). By using the Service you acknowledge these transfers as necessary to provide matching and AI features.

8. Retention

We retain account, profile, resume, and application data for as long as your account remains active and as needed to provide the Service.

After account deletion or a verified erasure request, we delete or anonymize personal data within thirty (30) days, except where we must retain limited records for legal, tax, security, or dispute-resolution purposes (for example billing records or fraud logs).

Email send logs and similar operational records may be kept for a limited period for deliverability and abuse prevention.

9. Security

We use industry-standard measures appropriate to the sensitivity of the data, including hashed passwords, encrypted transport (HTTPS), access controls, and separation of sensitive EEO fields from AI pipelines.

No method of transmission or storage is completely secure. You are responsible for keeping your password and devices secure.

10. Cookies and local storage

We use:

• Authentication cookies (Auth.js / NextAuth session tokens) — strictly necessary to keep you signed in.
• CSRF cookie (bolthire_csrf) — strictly necessary for form security.
• Short-lived bolthire_pending_quiz cookie — necessary to carry quiz answers across Google OAuth.
• Browser localStorage keys (for example bolthire_quiz_answers, bolthire_quiz_step, bolthire_match_count, bolthire_cover_letters) — used in the pre-signup funnel to preserve progress.
• Crisp chat cookies or similar third-party storage when the support widget loads for entitled dashboard users.

Strictly necessary cookies do not require consent under most cookie laws. Crisp is loaded for support in the product experience; if you prefer not to use chat, you can contact us by email instead.

11. Marketing and transactional email

Transactional emails (such as password resets) are sent regardless of marketing preferences because they are necessary for the account.

Lifecycle and marketing-style emails (welcome, abandoned checkout, match digests) respect your marketingEmailsOptOutAt preference and unsubscribe links / List-Unsubscribe headers. You can opt out via those links or by contacting us.

12. Your rights under Philippine law (RA 10173)

Subject to lawful exceptions, you may request:

• Access to your personal information.
• Correction (rectification) of inaccurate or incomplete data.
• Erasure or blocking of data that is incomplete, outdated, false, unlawfully obtained, or no longer necessary.
• Objection to processing in certain circumstances.
• Data portability where applicable.
• Damages for inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of personal information under the Act.

You may lodge a complaint with the National Privacy Commission. For verified requests, email [EMAIL]. We aim to respond within thirty (30) days.

Account and data erasure: there is currently no in-product "delete account" button. To erase your account and personal data, email [EMAIL] from the address on your account. We will verify your identity and complete deletion or anonymization within thirty (30) days, subject to legal retention needs.

13. GDPR / UK GDPR rights (where applicable)

If EU/EEA or UK data protection law applies to you, you may have the right to access, rectify, erase, restrict processing, object, withdraw consent, and receive a portable copy of data you provided.

You also have the right to lodge a complaint with your local supervisory authority. Contact us first at [EMAIL] so we can try to resolve your concern.

14. California privacy (CCPA/CPRA)

If you are a California resident, you may have rights to know, delete, and correct personal information, and to opt out of "sale" or "sharing" for cross-context behavioral advertising.

We do not sell personal information and do not share it for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes that require a right to limit under the CPRA beyond what is necessary to provide the Service.

To exercise California rights, email [EMAIL]. We will not discriminate against you for exercising your rights.

15. Children

The Service is not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe a child has provided us data, contact us and we will delete it.

16. Security incidents

Where required by RA 10173 and related NPC rules, we will notify the Commission and affected individuals of personal data breaches within the prescribed timeframes (including the 72-hour notification expectation where applicable), describing the nature of the breach and measures taken.

17. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top will change when we do. Material changes may be communicated by email or in-product notice where appropriate.

18. Contact

Privacy requests: [EMAIL]

Legal: [EMAIL]

Support: [EMAIL]

Postal: [ADDRESS]

BoltHire, sole proprietorship, the Philippines.