Privacy policy

This policy explains what personal data savara collects when you use the service, why we collect it, who we share it with and what rights you have. We have tried to write it plainly. If anything is unclear, contact us and we will explain.

In short: we collect what is needed to run a job-search tool for you, we do not sell your data, we do not use your data to train AI models, and you can ask us to delete everything at any time.

• Account data: your email address, a hashed password (or the identity provider you sign in with), and the date you created your account.
• Profile data: the career preferences you give us during onboarding, such as target roles, locations, remote preference and job types.
• Resume data: the content of the resumes you create or upload, including work history, education, skills and contact details, plus version history.
• Application data: the jobs you save, the applications you track, their stages, deadlines, notes and links to the resume you used.
• AI requests: the drafts you ask for and the results, so you can find and edit them later, together with usage counts for plan limits.
• Outreach drafts: messages you draft to employers and any follow-up reminders you set.
• Billing data: your plan, subscription status, and payment event records received from our payment processor. We do not receive or store full card numbers.
• Inbox data (optional): only if you connect Gmail. See “Connected Gmail inbox” below.
• Support messages: anything you send us through the contact form or by email.
• Technical data: IP address, browser type and server logs, used for security, rate limiting and diagnosing problems.

If you choose to connect Gmail under Settings, savara requests read-only access (the gmail.readonly scope) so it can spot replies from employers you track and suggest an application status, such as interview, assessment, offer or rejection. You confirm every change; savara never changes a status on its own.

• Once a day, and when you press Check now, we search the last 14 days for recruiting-related emails and read only their sender, subject, date and Gmail's short preview snippet. We do not download or store full message bodies or attachments.
• We keep an email's sender, subject, date and snippet only when it matches a company in your application tracker. Everything else is discarded immediately.
• Unclear emails may be classified by our AI provider using only that sender, subject and snippet.
• Your Google access token is encrypted at rest. Disconnecting in Settings deletes it, revokes savara's access at Google and deletes stored email suggestions.
• savara's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is used only to provide this feature to you; it is never used for advertising, never sold, never used to train AI models, and never read by people except with your permission, for security, or to comply with the law.

• To provide the service: authenticate you, store your resumes and applications, search listings and generate drafts you request.
• To enforce plan limits and manage your subscription.
• To send service emails such as verification, password recovery and billing notices. We do not send marketing email without your consent.
• To keep the service secure, prevent abuse and investigate problems.
• To comply with legal obligations, including tax and accounting requirements for payments.

Where the law requires a legal basis, we rely on performance of our contract with you (providing the service), our legitimate interests (security, preventing abuse, improving the product), your consent where we ask for it, and compliance with legal obligations.

We use a small number of service providers to run savara. Each only receives the data needed for its role.

• Supabase provides authentication and our database. Your account and application data is stored in Supabase's EU West region. Access is restricted by row-level security so that each user can only read and change their own records.
• Our payment processor handles payments for paid plans through its hosted checkout. It receives the data needed to take payment, including your card details, which savara never sees or stores. It sends us verified payment and subscription events so we can activate the right plan.
• Anthropic provides the AI models behind the assistant. When you request a draft, the relevant resume text and job text is sent to Anthropic to generate it. Under our agreement with Anthropic this data is not used to train their models.
• Public job boards (currently Remotive, Arbeitnow, RemoteOK and Jobicy) are the source of job listings. We fetch listings from them; we do not send them your personal data. When you follow a link to an original posting you leave savara and that site's privacy policy applies.
• Transactional email and hosting providers deliver service emails and run the application.

We do not sell personal data and we do not share it with advertisers or data brokers. We may disclose data if required by law or to protect the rights and safety of users or the public.

Your primary data is stored in the EU. Some providers, including our AI and payment providers, may process data in other countries, including the United States. Where that happens we rely on appropriate safeguards such as standard contractual clauses or equivalent mechanisms.

• Account, profile, resume and application data is kept for as long as your account exists.
• When you ask us to delete your account we delete your personal data within 30 days, except where we must keep limited records for legal, tax or accounting purposes (for example payment records).
• Server logs used for security are kept for a short, rolling period and then discarded.
• Support messages are kept for as long as needed to resolve your request and for a reasonable period afterwards.

Depending on where you live you may have the right to:

• Access the personal data we hold about you and receive a copy.
• Correct inaccurate data. Most profile and resume data can be edited directly in the app.
• Delete your data. You can request deletion of your whole account at any time.
• Restrict or object to certain processing.
• Receive your data in a portable format.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, use the contact form with the email address on your account. We will respond within one month.

We use encrypted connections, hashed passwords, server-side authorisation on every private operation and database-level access rules. Secrets such as API keys and payment credentials are never exposed to the browser. No system is perfectly secure, so if you believe your account has been compromised please tell us straight away.

savara uses strictly necessary cookies to keep you signed in and to protect forms. We do not use advertising or cross-site tracking cookies. See the cookie policy for details.

We count page visits with our own cookie-free analytics: for each page view we record the page, the referring site, the device type and the country your connection comes from. Visitors are counted with a code derived from your IP address and browser that changes every day, so you can't be recognised from one day to the next, and nothing is stored on your device. This data is only used in aggregate to understand how the site is used.

savara is not directed at children under 16 and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will remove it.

We may update this policy as the service changes. Material changes will be announced by email or in the app before they take effect. The date at the top shows when it was last revised.

Privacy questions and requests can be sent through the contact form. This policy is governed by the laws of [Jurisdiction], without prejudice to any mandatory data protection rights that apply where you live.