Privacy Policy

We collect different types of information for different purposes:

• Account data:

  • Email address
  • Name
  • Password (stored only as a cryptographic hash)
  • Profile information and account settings

• Content data:

  • Resume information you provide (e.g., work experience, education, skills)
  • Job descriptions you enter
  • Generated resumes, cover letter drafts, and analysis results

• Payment data:

  • Payment history and subscription status
  • Credit card and bank details are processed exclusively by our payment provider Stripe and are never stored on our servers

• Technical data:

  • IP address and browser user agent (on each page load, held briefly in server logs)
  • For visitor counting: a daily-rotating, irreversible hash derived from your IP address and browser signature (see Section 5) — no cookie is set and the IP address itself is not stored
  • Error reports when technical problems occur (see Sentry, Section 6)

We process your data only where we have a legal basis to do so. Specifically:

• Providing the service

  (account management, creating and optimizing resumes and cover letters, AI-powered generation, application tracker): performance of a contract (Art. 6(1)(b) GDPR where applicable).

• Payment processing

  via Stripe: performance of a contract; retention of payment records: legal obligation.

• Cookieless visitor counting and error diagnostics:

  legitimate interest in measuring and reliably operating our service. No user profiles are created.

• Analytics and marketing cookies

  (Google Analytics, PostHog, Google Ads conversion tracking, TikTok Pixel): only with your consent. You can withdraw your consent at any time with effect for the future (see Section 5).

• Transactional emails

  (e.g., email verification, password reset, notices about your credits): performance of a contract.

On your first visit, a consent banner asks whether you accept analytics and marketing cookies (opt-in). Without your consent, no analytics or marketing services are loaded.

Necessary cookies and storage:

• Consent cookie (cc_cookie):

  stores your cookie preferences. Lifetime: 1 year.

• Session token:

  an authentication token is stored in your browser's local storage when you sign in. It is removed when you sign out.

Analytics (only with consent):

• Google Analytics (_ga, _gid):

  collects pseudonymized usage statistics to improve our service.

• PostHog:

  product analytics to improve the user experience. Processing takes place on servers in the EU (PostHog EU Cloud).

Marketing (only with consent):

• Google Ads conversion tracking:

  measures whether visitors reached us through a Google ad.

• TikTok Pixel (_ttp):

  measures whether visitors reached us through a TikTok ad. Provider: TikTok Technology Limited. Data may be transferred to countries outside the EU/US (see Section 7).

Cookieless visitor counting (no consent required):

For pure reach measurement, our server derives a daily-rotating, irreversible hash from your IP address and browser signature. Nothing is stored on your device, the IP address itself is not retained, and recognition beyond the same day is technically impossible.

You can adjust or withdraw your consent at any time with effect for the future:

We share your data only with the following recipients, and only to the extent necessary for the purposes described. Data processing agreements are in place with all processors:

• Hosting (Railway):

  our application and database run on Railway Corp. (USA). Sensitive resume data is additionally encrypted in the database (see Section 9).

• Payment provider (Stripe):

  for secure payment processing. Stripe receives your email address and payment information. Stripe is PCI-DSS Level 1 certified.

• AI provider (Google Gemini API):

  for AI-powered creation and analysis of application documents, your resume content (e.g., name, work experience, education, skills) and the job description are transmitted to Google. We use the paid Gemini API, under which Google is contractually bound not to use submitted content to train its AI models.

• Email delivery (Resend):

  transactional emails (e.g., verification, password reset) are sent via Resend Inc. Your email address is processed for this purpose.

• Error diagnostics (Sentry):

  when technical errors occur, error reports are sent to Sentry (Functional Software, Inc.). We have disabled transmission of standard personal data and use Sentry's EU data infrastructure.

• Analytics and marketing services:

  Google Analytics, Google Ads, PostHog (EU Cloud), and TikTok Pixel — each only with your consent (see Section 5).

We do not sell your personal information, and we do not share it with third parties for cross-context behavioral advertising without your consent.

Some of the providers listed process data in countries other than your country of residence, in particular in the United States and Switzerland. Where required, we base such transfers on:

• the EU-U.S. / Swiss-U.S. Data Privacy Framework (for certified providers such as Stripe, Google, and Sentry)
• EU Standard Contractual Clauses
• adequacy decisions of the European Commission or the Swiss Federal Council

If you consent to the TikTok Pixel, data may also be processed in additional third countries. See TikTok's privacy policy for details.

We keep your personal data only as long as necessary for the purposes for which it was collected:

• Account and content data: as long as your account exists; when you delete your account, all resumes, cover letters, and profile data are deleted immediately
• Payment records: according to statutory retention periods (generally up to 10 years)
• Visitor counting: only the daily-rotating hash is stored, which cannot be linked to any person
• Error reports (Sentry): automatically deleted after Sentry's standard retention period (90 days)

You can delete your account yourself at any time in your profile settings ("Delete account"). This also deletes your data at our payment provider Stripe, unless statutory retention obligations require otherwise.

We use technical and organizational measures to protect your personal data, including:

• Encrypted transmission of all data (TLS/HTTPS, HSTS)
• Encryption of your resume and application data in the database (AES-256-GCM)
• Passwords stored exclusively as cryptographic hashes
• Access controls and authentication
• Regular backups and security reviews

Depending on where you live, you may have the following rights regarding your personal data:

• Right to know / access the personal data we hold about you
• Right to correct inaccurate personal data
• Right to delete your personal data
• Right to restrict or object to certain processing
• Right to data portability (receive a copy of your data in a usable format)
• Right to withdraw consent at any time with effect for the future
• Right to non-discrimination for exercising your privacy rights (California residents, CCPA/CPRA)

To exercise any of these rights, contact us at team@atsoptimized.com . You can also delete your account and its data yourself at any time in your profile settings. We will respond to verified requests within the timeframes required by applicable law.

You also have the right to lodge a complaint with a data protection authority — in the EU with the supervisory authority of your country of residence, in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC), and in California with the California Privacy Protection Agency.

We may update this privacy policy from time to time. We will inform you of material changes by posting the new policy on this page and updating the "Last updated" date.

If you have questions about this privacy policy or our data practices, please contact us: