Privacy Policy
TailorFolio turns the career documents you give us into tailored résumés, cover letters and match reports. This page says exactly what we collect, why, where it goes and how you get it back or make it disappear. Short version: your career data is yours; we don't sell it, we don't train models on it, and you can export or delete all of it from Settings.
What we collect
| Data | Why |
|---|---|
| Email address and/or mobile number | Sign-in via magic link (no passwords), package-ready notices, receipts. |
| Your name | Appears on your résumés. |
| Files you upload (résumés, reviews, notes, PDFs, Word, images) | The only source we extract your career history from. Every bullet we write traces to something in these files. |
| Career knowledge base (roles, skills, achievements, projects, credentials) and every revision to it | Extracted from your files; the structured record we build packages from. |
| Job descriptions you paste, link or email us | To tailor a package to that posting. Stored with the package. |
| Generated packages, orders, credit balance | So you can download, regenerate and see what you were charged. |
| Card reference (Square customer ID, card ID, last four digits, brand) | To charge $5 per package or $49 per credit pack. We never see or store your full card number — it goes straight from your browser to Square. |
Inbound emails sent to your private @in.tailorfolio.com address | To extract the job posting. The raw email is kept for 30 days for troubleshooting, then deleted. |
| IP address, session cookie, request logs | Security, rate limiting, abuse prevention. Logs are kept 30 days. |
How the AI part works
Your files and the job description are sent to a large language model to extract facts and write the package. We use models hosted by Anthropic through our own gateway; the content is processed to produce your output and is not used to train their models or ours. The model is instructed to invent nothing: every claim in a generated résumé must be supported by your uploaded documents, and we run automated checks that reject output introducing roles, dates or employers that aren't in your files.
Who else sees your data
| Provider | What they process |
|---|---|
| Railway (hosting, Postgres) | Everything, encrypted in transit and at rest, in the United States. |
| Cloudflare R2 via our storage relay | Uploaded files, generated PDFs/ZIPs, your data export. |
| Anthropic (via our LLM gateway) | Document text and job descriptions, transiently. |
| Square | Card details and charges. Square's own privacy policy applies to the card itself. |
| Twilio SendGrid | Email delivery (magic links, package-ready notices, replies to inbound job postings) and receipt of inbound email. |
| Twilio | SMS delivery of sign-in links if you use a phone number. |
No advertising networks, no analytics trackers, no data brokers. We disclose data only when legally compelled, and we'll tell you unless we're prohibited from doing so.
Cookies
One session cookie (tf_session, HttpOnly, Secure, SameSite=Lax) keeps you signed in for 30 days, and one short-lived cookie tracks an upload you started before signing in. Nothing else.
Retention
- While your account is active: career knowledge base, files, packages and orders are kept so you can keep generating.
- Uploads you never claim (started but didn't sign in): deleted after 7 days.
- Inbound emails (raw message): 30 days. Logs: 30 days.
- Data exports: download link valid 1 hour; the file itself is deleted after 7 days.
- After you delete your account: everything is recoverable for 7 days, then permanently erased — files in storage, the knowledge base, packages, inbound mail, and your card is removed from Square. Order records are reduced to amount, date and status and kept for 7 years because tax law requires it; they no longer link to your email or name.
Your rights and how to use them
- Export — Settings → Export my data. You get a ZIP with your knowledge base as JSON, every original file, every package and your order history.
- Correct — the Resume constructor lets you confirm, dispute or edit any extracted fact.
- Delete — Settings → Delete my account. Recoverable for 7 days by clicking any sign-in link; after that it's gone.
- Object / restrict / complain — email privacy@tailorfolio.com. If you're in the EU/UK you may also complain to your local supervisory authority; if you're in California, the export and delete controls above satisfy your CCPA access and deletion rights, and we don't sell or share personal information as those terms are defined there.
Security
TLS everywhere; database rows are isolated per account at the database engine level (row-level security), so a bug in our application code cannot return another person's data; card data never touches our servers; sign-in is by single-use, expiring links. If we ever discover a breach affecting your data we'll notify you within 72 hours of confirming it.
Children
TailorFolio is for people looking for work and is not directed at anyone under 16. If we learn we hold data on a child we'll delete it.
Changes
If we change this policy in a way that matters we'll email you before it takes effect. The effective date at the top always reflects the current version.
Contact
Noctusoft LLC · privacy@tailorfolio.com