Privacy Policy

Last updated: July 4, 2026

This Privacy Policy explains what personal data ScoredWell (“ScoredWell”, “we”, “us”) collects, why we collect it, who we share it with, and the rights you have over it. ScoredWell is operated from the Philippines and serves users who may be located in the Philippines, the European Union, the United States, and elsewhere.

1. Who we are

ScoredWell is a job-search assistant that scores job postings against your professional profile and generates tailored application documents (CVs and cover letters). The operator is based in the Philippines. For privacy questions or to exercise your rights, contact us at admin@automatevibe.com.

2. The personal data we collect

We collect the following categories of personal data, directly from you:

Account data

Your email address and password (stored only as a secure hash), or — if you sign in with Google — your Google account identity and email. We retain sign-in and session records.

Profile and résumé data

The full contents of the résumé you upload or enter, which typically includes your name, employment history (employers, job titles, dates, and accomplishments), education, certifications, skills, your location, your compensation expectations, and your work-authorization status. This is the richest and most sensitive data we hold. You may also upload additional reference files (such as past CVs, cover letters, or portfolios), whose full text we extract and store.

Application and usage data

The jobs you add to your tracker, the fit scores and verdicts we generate for them, the application documents you generate, and behavioral/usage records of how you interact with the service (for example, which actions you take and when). We do not use third-party advertising trackers or web analytics.

3. How we use your data

We use your data to provide the service: scoring how well a role fits your profile, generating tailored CVs and cover letters, sending you digest and notification emails, operating your account, and processing payment for paid plans.

4. Automated processing by AI systems

ScoredWell uses large-language-model (LLM) and other automated systems to process your résumé and profile. Specifically: an automated system parses your uploaded résumé into structured data; automated systems generate your tailored CV and cover letter; and an automated system produces a fit score and a verdict (such as “Strong”, “Moderate”, “Stretch”, or “Skip”) for each job. These outputs are decision-support tools intended to help you decide which roles to pursue — they are not used to make a legally significant or similarly significant decision about you on our side, and they are not employer-side candidate screening. You can review and edit every generated document before using it. Where you are in a jurisdiction whose law (such as GDPR Article 22) gives you rights regarding automated decision-making, you may contact us to ask questions about this processing.

5. Sub-processors and recipients of your data

To run the service we share data with the third-party processors below. Each is named with the data it receives and the purpose. We do not sell your personal data.

Supabase · United States

Purpose: Authentication, database, and encrypted file storage.

Data shared: All account and profile data at rest, including your email, authentication credentials, résumé, reference files, and application records.

Vercel · United States

Purpose: Application hosting and serverless compute — running the website and its server-side functions — plus privacy-preserving web analytics (page views and site performance).

Data shared: Everything you submit passes through Vercel's compute in transit — résumé and reference-file uploads, profile edits, job text, and emails — and request metadata (including your IP address) is logged. Vercel also collects cookieless page-view analytics for us: pages visited and aggregate performance data, with no cookies set and no cross-site tracking (visitors are counted with a de-identified, daily-rotating hash that cannot be used to recognize you across days or sites).

OpenAI · United States

Purpose: Large-language-model processing — assembling tailored CVs and cover letters, and scoring how well a role fits your profile.

Data shared: Your résumé and profile content, plus job-description text.

Anthropic · United States

Purpose: Large-language-model processing — résumé parsing and the quality-gate review of generated documents.

Data shared: Your full résumé and profile content (employment history, titles, dates, skills).

Google (Gemini) · United States

Purpose: Optical character recognition (OCR) — reading the text out of a scanned or image-based upload when it has no extractable text layer, so we can parse and store it.

Data shared: The full page images / file content of an uploaded CV or reference file — but only for scanned or image-based uploads (photos, screenshots, or PDFs with no selectable text). Uploads with a readable text layer are processed on our servers and are not sent to Google.

Resend · United States

Purpose: Transactional and digest email delivery.

Data shared: Your email address and the contents of digest/notification emails (roles, companies, fit summaries). Your résumé body is never sent.

HaveIBeenPwned · United Kingdom

Purpose: Checking a chosen password against known data breaches at signup.

Data shared: Only a partial (SHA-1 prefix) hash of a password you choose at signup. Your password itself never leaves our servers (k-anonymity).

Careerjet · International

Purpose: Returning live job listings when you search for roles in the app.

Data shared: Job-search keywords, location, and — for licensed-search attribution — your device IP address and user agent. No résumé content is sent.

Tavily · United States

Purpose: Researching a target company to build an application intel brief. (Inactive — the company-research / intel-brief feature is not currently enabled.)

Data shared: A company name only. No personal data about you is sent.

Lemon Squeezy (Merchant of Record) · United States

Purpose: Payment processing, billing, and tax handling for paid subscriptions.

Data shared: Your email address and account identifier at checkout. (Inactive until paid plans launch.)

Sentry · United States

Purpose: Application error monitoring and crash reporting, so we can detect and fix problems.

Data shared: Diagnostic and error data when the app encounters a problem — error messages, stack traces, and technical context (such as the page and browser). Configured to exclude personal data by default; your résumé content is not sent.

We work with these providers under their respective data-processing terms, and we are formalizing data-processing agreements (DPAs) with each as ScoredWell grows.

6. International data transfers

Several of our sub-processors are based in the United States and other countries outside the Philippines and the European Economic Area. This means that if you are located in the Philippines or the EU/EEA, your personal data — including your résumé content — is transferred internationally for processing. We are working to put appropriate transfer safeguards (such as Standard Contractual Clauses or an equivalent mechanism) in place for these transfers, and you can contact us for more information.

7. Your rights

Depending on where you live, you may have the right to access, correct, export, restrict, or delete your personal data, to object to certain processing, and to withdraw consent. You can:

View and edit your profile and résumé data at any time from your Profile page.
Delete your account and your data from your Profile page (“Delete account”), which removes your account, profile, and uploaded files from our systems. This is permanent.
Contact us at admin@automatevibe.com to exercise any other right or to raise a concern. If you are in the Philippines, you also have the right to lodge a complaint with the National Privacy Commission; in the EU/EEA, with your local supervisory authority.

8. Data retention

We keep your personal data for as long as your account is active. When you delete your account, we delete your profile, résumé, and uploaded files, and we remove your email from our waitlist and beta-access list. We retain limited residual data — system logs, product-usage and analytics records, and our internal cost records — for up to 24 months, after which it is deleted or aggregated into a non-identifying form. Records we are required to keep for legal, security, or accounting reasons are retained only for the period the law requires.

9. Security

Your files are stored in a private storage bucket and served only over time-limited signed links. Access to your data is restricted to your own account through row-level security. At signup, any password you choose is checked against known breach datasets without your password ever leaving our servers.

10. Children

ScoredWell is intended for adult job seekers. You must be at least 18 years old to use the service. We do not knowingly collect personal data from anyone under 18; if you believe a minor has provided us data, contact us and we will delete it.

11. Legal framework

We intend this policy to address the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), the EU General Data Protection Regulation (GDPR) for users in the EU/EEA, and applicable United States privacy law. We process your data to provide the service you sign up for and, where applicable, on the basis of your consent. We continue to assess our registration and representative obligations as our user base grows.

12. Changes to this policy

We may update this policy. When we make material changes we will update the “Last updated” date and the policy version, and we may ask you to re-confirm your agreement.