Privacy Policy

Hyaku Labs LLC, a company in New Jersey, United States, operates Airtight and decides how your data is used. For people in the European Union and the United Kingdom, we are the data controller. Contact: support@airtight.so.

Account: your email address, used to sign you in. If you sign in with Google, we receive your email address and name from Google; we do not receive your password or your Google data.

Profile and documents: the resume data you enter or upload (work history, education, skills, links), examples you confirm, job postings you paste or accept from Discover, and the documents, fit checks and check reports the Service generates for you.

Usage and payments: basic product analytics (pages and features used, keyed to your account id, never to your documents) and, if you subscribe, billing status from our payment processor. We never see or store your card number. To understand where people get stuck we also record how the app is used, with every word on the screen masked and every field hidden: the recording shows clicks, scrolling and layout, never your name, your resume or the documents we write for you. Text is visible only on the public pages (home, pricing, sign-in) and the first-run setup, which carry nothing personal.

Cookies: only what sign-in requires (session cookies). Product analytics uses browser storage, not a cookie, and honours your browser's Do Not Track and Global Privacy Control signals. On the landing and pricing pages, Meta, TikTok or OpenAI (ChatGPT ads) advertising pixels measure our ads. In the United States they run unless you decline on the cookie bar. Everywhere else, and whenever your browser sends a Global Privacy Control signal, we ask first and load them only if you allow them. Inside the product they see only that you signed up or subscribed, never what you write. Decline and no advertising cookie is set and nothing is reported to them.

Your privacy choices: you can change your answer here at any time.

Support: what you write to us, so we can answer.

To provide the Service: generate and check your documents, find matching roles, track your applications, bill subscriptions, answer support, and improve the product from aggregate usage. That's the list. We do not sell personal information, we do not use your resume data for advertising or profiling, and we do not use your content to train models, ours or anyone else's.

For people in the EU and UK, the legal bases are: performing our contract with you (the Service itself, billing, support); our legitimate interest in keeping the Service secure and understanding how it is used, in ways that never expose your documents; your consent for advertising pixels, which you can withdraw at any time; and legal obligations such as tax records.

Generating and checking documents sends your profile and the job posting to Anthropic's Claude API. Under the API terms we use, that data is not used to train Anthropic's models. No other third party receives your resume data.

Service providers that host and run Airtight, each receiving only what its job requires: Supabase (database, authentication, file storage), Vercel (application hosting), Anthropic (document generation), Fly.io (PDF rendering), Inngest (background jobs), Stripe (payments), Resend (transactional email), Sentry (error reports, with resume content kept out) and PostHog (product analytics). When advertising measurement is on (section 2), Meta, TikTok and OpenAI receive advertising measurement events: that you signed up or subscribed, with your email address hashed so it can be matched to their ad click, never your resume or documents.

We also disclose data when the law requires it (a valid legal request, or to protect the Service and its users from fraud or abuse), and if Hyaku Labs LLC or the Service is sold or merged, in which case your data goes with it under these same commitments and you will be told.

Our providers store data in the United States. If you use Airtight from the EU, UK or elsewhere, your data is transferred to the US. Where the law requires safeguards for that transfer, we rely on our providers' standard contractual clauses and, where they hold it, EU-US Data Privacy Framework certification.

Your data is kept while your account exists. Deleting your account from Settings removes your profile, postings, documents, files, and history from the live database immediately; copies in our database provider's backups are gone within 30 days. You can also delete individual application packages at any time. Billing records are kept as long as tax law requires. Error reports and server logs, which never hold resume content, are kept for 90 days.

You can access your data in the app, correct it, export your documents, and delete everything yourself. Wherever you live, you can also write to support@airtight.so to ask what we hold, to correct it, to delete it, to receive a copy, or to object to a use; we answer within 30 days and never treat you differently for asking.

California and other US states: residents of California (under the CCPA and CPRA), and of the other states with consumer privacy laws, have the rights to know, delete, correct and port their data and to opt out of sale, sharing and targeted advertising. We do not sell personal information. The only sharing, as those laws define it, is the advertising measurement in section 5. To opt out, choose Decline on the cookie bar, turn it off under "Your privacy choices" in section 2, or send a Global Privacy Control signal from your browser, which we honour.

EU and UK: you have the rights of access, rectification, erasure, restriction, portability and objection, and to withdraw consent at any time. You can complain to your national data protection authority (in the UK, the ICO).

Data is encrypted in transit, access is scoped per-account at the database layer (row-level security), and resume content is kept out of our logs. Sign-in uses an email link or your Google account; there is no password to leak. No system is perfectly secure; if a breach affects your data we will notify you promptly and within the time the law sets. The security page says all of this in plain words.

The Service is for adults 18 and over. We do not knowingly collect data from anyone younger; if we learn we have, we delete it.

Material changes will be announced by email or in the app before they take effect. Earlier versions are available on request. Questions: support or support@airtight.so.