Privacy Policy

This Privacy Policy explains how Otclick ("we," "us," "our") collects, uses, shares, and protects your information when you use OtclickUS — our Chrome autofill extension, companion web dashboard (otclick.org), and related backend services (together, the "Service").

OtclickUS helps you apply to jobs faster. The extension fills application forms in your own browser with answers tailored from your profile and resume — we never submit anything for you; you review and click the site's own Submit. If you connect Gmail (read-only, optional), we classify incoming mail to keep your application tracker up to date.

The Service is directed at users in the United States and Canada. It is not offered to, or directed at, residents of the European Economic Area (EEA) or the United Kingdom, and we do not intend to process the personal data of EEA/UK residents. If you are in the EEA or UK, please do not use the Service.

Questions or requests about your privacy: support@otclick.org.

1. Information We Collect

1.1 Information you provide directly

• Account data — email and password (authentication handled by Supabase Auth), or a Google sign-in identifier if you use OAuth login.
• Profile data — name, email, phone, structured address (line, city, state, ZIP, county, country), professional links (LinkedIn, GitHub, portfolio), work authorization status, visa type, sponsorship needs, years of experience, EEO/diversity information you choose to enter, work experience, education, skills, languages, timezone, referral code, and a free-text career story.
• Resume files — PDF resumes you upload, plus the text and structured fields we extract from them.
• Saved answers — answers you write or edit while filling application forms, saved so they can be reused on future forms.
• Application content — the values typed into each job application form, the jobs you filled, and any outcome you set manually.
• Support & feedback — messages you send through the in-app feedback tool or to our support email.

Some optional fields — EEO/diversity information (e.g., race, gender, disability, veteran status) and work-authorization/visa data — may qualify as "sensitive personal information" under California's CCPA/CPRA and as sensitive information under Canada's PIPEDA. These fields are strictly optional.

1.2 Information collected automatically

• Usage data — pages viewed, features used, actions taken in the dashboard and extension.
• Device & connection data — browser type, operating system, device type, and IP address.
• Cookies & local storage — the Supabase authentication cookie (essential, keeps you signed in); extension settings stored locally (theme, auto-fill-on-detect preference, your session token).
• Performance analytics — aggregate page-performance metrics via Vercel Speed Insights.

1.3 Information from Gmail (only if you connect it — optional)

If you connect Gmail, we request read-only access via Google OAuth. We use it solely to read incoming mail and classify each message into an application outcome (interview / rejected / offer / ghosted).

• We store a Fernet-encrypted Gmail refresh token, your connected Gmail address, and sync timestamps.
• We never send email, create mailboxes, or modify your mailbox.
• Our use of Gmail data complies with the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is not used to train generalized AI/ML models.

1.4 Information from third parties

• Polar (payment processor) — subscription status, plan, and billing identifiers. We do not receive or store full card numbers.
• Google — basic profile/email if you sign in with Google OAuth.

2. How We Collect Information

• Directly — when you register, complete your profile, upload a resume, fill forms, or contact us.
• Automatically — through cookies, local storage, and analytics while you use the Service.
• From third parties — Google (OAuth/Gmail, with your consent), Polar (billing), Supabase (auth/storage infrastructure).

3. How We Use Information

We use your information to:

• Provide the Service — authenticate you, store your profile/resume, and generate tailored answers so the extension can fill application forms in your browser.
• Generate tailored content — send your profile, resume text, saved answers, and the page's form context to our LLM provider (OpenAI) to produce field values and optional cover-letter / resume text. Generation only runs when you trigger a fill; cover-letter/resume generation runs only when you turn that mode on.
• Classify your inbox (only if Gmail connected) — read incoming mail and update each application's outcome automatically.
• Job discovery — search remote roles (via HiringCafe) using filters you set.
• Billing — manage subscriptions and autofill quotas through Polar.
• Improve & secure the Service — analyze aggregate usage, debug, prevent fraud and abuse.
• Communicate — respond to support/feedback and send service-related notices.
• Comply with law — meet legal obligations and enforce our terms.

Under OpenAI's API terms, data we send for processing is not used to train their models. We do not use your data for new, materially different purposes without notifying you and, where required, obtaining consent.

4. Data Sharing and Third Parties

We share data only with service providers ("processors") that help us run the Service, and only as needed:

We may also disclose information: (a) to comply with law, legal process, or lawful government requests; (b) to protect our rights, users, or the public; (c) in a merger, acquisition, or asset sale (with notice).

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA.

5. International Data Transfer

Otclick is based in Kazakhstan, and our service providers (Supabase, OpenAI, Google, Polar, Vercel) may process data in the United States and other countries. Because of this, your information may be processed outside your country of residence, including for users in the United States and Canada. We require our providers to protect your data under contractual safeguards comparable to those described in this Policy.

6. Data Retention

• Account & profile data — kept while your account is active; deleted immediately when you delete your account.
• Resume files & parsed text — kept while the account is active or until you delete the resume; deleted immediately on account or resume deletion.
• Application data & saved answers — kept while the account is active.
• Gmail token — kept until you disconnect Gmail or delete your account, then discarded immediately. We do not store full email bodies beyond what's needed to classify a message.
• Usage/analytics logs — retained up to 3 months in aggregate/pseudonymized form.
• Billing records — payments are handled by Polar as merchant of record; Polar retains billing and tax records under its own legal and tax obligations and privacy policy. We keep only the subscription identifiers needed to manage your plan, and delete them when you delete your account.

On account deletion we revoke external-provider state tied to your identity (e.g., Polar customer anonymization) before cascading the deletion of your records.

7. Your Rights

Depending on where you live, you may have the right to:

• Access — request a copy of your personal data.
• Correct — fix inaccurate data (most profile fields are self-service in Settings).
• Delete — request deletion; the dashboard offers type-to-confirm account deletion in Settings → Account.
• Restrict / object to certain processing.
• Data portability — receive your data in a portable format.
• Withdraw consent — e.g., disconnect Gmail, turn off doc-generation, at any time.
• Opt out of marketing communications.

California (CCPA/CPRA): rights to know, delete, correct, opt out of sale/share (we do neither), limit use of sensitive personal information, and non-discrimination for exercising your rights.

Canada (PIPEDA): rights to access and correct your information and to complain to the Office of the Privacy Commissioner of Canada.

To exercise any right, contact support@otclick.org. We respond within 30 days as required by law and may need to verify your identity.

8. Cookies and Tracking

• Essential — the Supabase auth cookie keeps you signed in; the extension stores your session and settings locally. These are required for the Service to function.
• Analytics — Vercel Speed Insights collects aggregate performance data.

We do not use advertising or cross-site tracking cookies.

9. Security

• Encryption in transit (HTTPS/TLS) and Gmail tokens encrypted at rest (Fernet).
• Row-Level Security — each user can access only their own rows; shared job-cache data is read-only.
• Access controls & authentication via Supabase Auth (JWT).
• Per-user storage scoping for resume files.
• Ownership checks on all API routes.

No system is 100% secure; we cannot guarantee absolute security. If a breach affects you, we will notify you and authorities as required by law.

10. Children's Privacy

The Service is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we learn we have, we will delete it. If you believe a child provided us data, contact support@otclick.org.

11. Contact and Rights Requests

Otclick
Kazakhstan, Almaty, Kairat, Daulet Kerei 120
Privacy inquiries & data requests: support@otclick.org
Response time: within 30 days as required by applicable law.

12. Changes to This Policy

We may update this Policy. For material changes we will notify you by email and/or an in-app/website notice at least 30 days before they take effect, and update the "Last updated" date above. Continued use after the effective date constitutes acceptance; where required, we will seek renewed consent.

13. Additional Provisions

• US- and Canada-focused service — the Service is directed at users in the United States and Canada and is not offered to EEA or UK residents.
• No sale of data — we do not sell or rent your personal information.
• Third-party links — the Service links to external company/ATS sites and job listings; we are not responsible for their privacy practices.
• Governing law — this Policy is governed by the laws of Kazakhstan, without prejudice to mandatory consumer-protection rights in your country of residence.
• Glass-box guarantee — the extension only fills forms you can see and review in your own browser; it has no capability to submit on your behalf.