Privacy Policy

1. Who we are

JobPrefill ("we", "us", "our") is a product of Cybertide Solutions Pvt Ltd (CIN: U47912UP2023PTC192792), a company registered in India. JobPrefill is a Chrome extension, available at jobprefill.com, that auto-fills Workday, Greenhouse, and Lever job application forms from a locally-stored, encrypted profile.

Registered office: WORKSHALA, D-9, Sector-3, Noida, India.
For privacy enquiries, contact us at support@jobprefill.com.

2. What never leaves your device

Everything you enter into JobPrefill is stored only on your device. We never receive, store, or share your profile data, and we hold nothing that identifies you personally. The filling engine that uses this data runs entirely inside your browser.

2.1 Profile data (stored on your device, encrypted — never sent anywhere)

You enter the following into the extension popup. It is stored only on your device, encrypted with AES-256-GCM. We never receive it, transmit it, or have access to it:

• Personal information: name, email, phone, address, links, pronouns
• Work experience: job titles, companies, dates, descriptions
• Education: institutions, degrees, fields of study, graduation dates
• Skills
• Declarations: citizenship, work authorisation, sponsorship status
• Voluntary disclosures: gender, ethnicity, veteran status, disability (all optional)
• Résumé file (stored as base64 in local storage)
• Preferences: desired salary, relocation preferences
• Account sign-in details for supported platforms (e.g., Workday) you choose to save (stored per-site, encrypted)

2.2 Usage and licensing data (stored locally, plaintext)

The extension stores a usage record locally to enforce the free-plan limit and cache your licence validation. This record contains:

• Monthly application count and reset date
• Your plan (free or pass)
• Your licence key (if you have one)
• A random installation identifier — a UUID generated locally on your device, not derived from your hardware or identity
• A list of job URLs counted in the current month (for deduplication)
• Cached licence validation result and timestamp

This data contains no profile PII (no name, no résumé) and is stored in plaintext for performance reasons. It remains on your device.

3. What leaves your device

The extension makes exactly two kinds of network request, described below. Neither one ever contains your profile, your answers, your résumé, or anything you typed into a form.

3.1 Question wording, to recognise what a form is asking

Some application questions are phrased in ways the extension does not recognise on its own. To handle these, when the extension encounters unanswered multiple-choice questions on an application page, it may send the following to our service:

• The public wording of the question as it appears on the page (e.g. "Are you willing to relocate?")
• The type of input control the question uses (e.g. a dropdown)
• The name of the form platform (Workday, Greenhouse, or Lever) — not the page address

What is never sent: your answer or any selected/typed value, your profile, your résumé, your name or contact details, your work-authorisation or sponsorship status, and the employer's application URL. Our service determines what category of question it is (such as "relocation") and nothing more; the answer is then decided locally on your device, from your profile — the service never sees or produces answers.

The question wording is processed transiently for this single purpose and is not stored on our servers; to avoid repeat lookups we retain only the resulting category label, for up to 30 days, in a form that does not contain the question text. If the service is unreachable, the extension simply works fully locally and sends nothing.

3.2 Licence key validation (paying users only)

If you have entered a Pro licence key, the extension contacts our backend at most once every 24 hours to check the pass is active. This request contains:

• Your licence key
• The random installation identifier described in 2.2 — used to enforce the per-pass device limit. It is not linked to your identity.
• A non-personal authentication token that is identical in every copy of the extension, so it cannot identify you

Our backend stores no account or profile record about you — it checks the key is valid and active and returns the result. If you deactivate a device to move your pass, the same identifiers are sent once to release that device's slot.

3.3 IP address

Like every network request on the internet, the requests above necessarily reveal your IP address to the receiving server. We use the IP solely for abuse rate-limiting:

• It is kept in our own storage for at most 60 seconds, then expires automatically.
• On the service described in 3.1 it is stored only in a pseudonymised, non-reversible form, never as the raw address.
• We do not write IP addresses to logs, and we never associate an IP with a licence key or a question.
• Cloudflare, as our infrastructure provider, processes connection data (including IP) transiently under its own terms, like any host.

Our lawful basis for this processing (where GDPR applies) is legitimate interest — protecting a free, unauthenticated service from abuse, using the least data for the shortest time we can.

4. Data we do not collect

• No telemetry or analytics of any kind
• No values you type or select into forms — never your answers, only a question's public wording as described in 3.1
• No page content from the websites you visit beyond that question wording
• No browsing history
• No device fingerprinting
• No crash reports or usage statistics

5. How we use data

• Profile data: only to fill supported application form fields in your browser. Never transmitted.
• Question wording: only to recognise what a form question is asking, so the answer can be filled from your local profile.
• Licence key + installation identifier: to verify your 3-month pass is active and to enforce the per-pass device limit.
• Email: your purchase email is handled by our payment provider, which delivers your licence key directly. We do not store your email and do not send marketing email.
• IP address: abuse rate-limiting only, as described in 3.3.

6. Data storage and security

Your profile is encrypted with AES-256-GCM using a key generated on your device on first install. The encryption key stays in your browser's local extension storage and is never transmitted. Local-only encryption protects against drive-by reads of storage snapshots.

Our backend services store no profile data and keep no account record about you. They validate licence keys when asked, recognise question wording when asked (3.1), and apply basic abuse protection (rate limiting) — nothing else.

7. Service providers

Data leaving your device is handled by the following providers:

• Cloudflare — hosting and infrastructure for our backend services and this website. See Cloudflare's Privacy Policy.
• Our payment provider — a Merchant of Record that operates the checkout. When you purchase a Pro pass, your payment details (card number, billing address) and email address are collected directly by the payment provider on its own checkout page — we never see or store payment card data. It issues your licence key, emails it to you, and holds your purchase records. The provider is identified on the checkout page and on your receipt, where its privacy policy is linked.

Neither provider ever receives your profile data.

8. Data retention

• Profile data: on your device only, until you clear it or uninstall the extension. Uninstalling removes all locally stored data. We have no copy to retain.
• Question-recognition records (3.1): category labels only, up to 30 days. No question text, no IP, no identifier of you.
• Rate-limiting entries: at most 60 seconds in our own storage. Cloudflare's edge processes connection data transiently under its own retention terms — we scope our retention claims to storage we control.
• Purchase records (your email, order, and licence key): held by our payment provider as Merchant of Record, in line with its retention policy.

9. Your rights and controls

You have direct, immediate control over your data inside the extension:

• Export your profile as a JSON file at any time, and import it on another machine.
• Clear Profile deletes your locally stored profile instantly. There is no server copy, so there is nothing for us to delete or "process" — it is simply gone.
• Uninstalling the extension removes everything it stored.

Depending on where you are located, you may also have legal rights including:

• Access to any personal data we hold about you
• Correction of inaccurate data
• Deletion of your data
• Portability of your data

Because your profile lives exclusively on your device, you exercise those rights yourself, at all times. For data related to your purchase (your email, order, and licence key — held by our payment provider), contact support@jobprefill.com and we'll help, or contact the payment provider directly using the details on your receipt.

10. Children's privacy

JobPrefill is not directed at children under 16. We do not knowingly collect personal data from children.

11. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via the extension update notes or email. The "Last updated" date at the top of this page will always reflect the current version.

12. Contact

Questions or concerns about this policy?
Cybertide Solutions Pvt Ltd (CIN: U47912UP2023PTC192792)
Registered office: WORKSHALA, D-9, Sector-3, Noida, India
Email: support@jobprefill.com
Website: jobprefill.com