sourcetailorHome

Legal

Privacy Policy

Effective Date: July 1, 2026 · Last Updated: July 1, 2026

Welcome to Sourcetailor. We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our invite-only closed beta platform located at sourcetailor.com (including its subdomains, such as app.sourcetailor.com).

Notice for Beta Users: Sourcetailor is an invite-only closed beta platform designed to help individual candidates build a verified "Source" of professional experience and generate tailored resumes and job-match analyses. By participating in this beta, you acknowledge that the platform is actively evolving.

1. Data Controller & Contact Information

The data controller responsible for your personal data under the Mexican Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP) and global data frameworks is:

  • Data Controller: Matt Cortés
  • Postal Address: Estado de México, México
  • Privacy, Security, ToS, & Support Email: privacy@mattcortes.com

2. The Data We Collect About You

We collect several categories of information to provide, secure, and optimize our services.

2.1 Account & Authentication Data

  • Google OAuth Data: Email address, full name, and profile picture/avatar URL.
  • Session Metadata: Authentication timestamps, device identifiers, and session tokens handled securely via Supabase Auth.
  • Access Gating: Server-side application roles (stored in user_roles) to enforce invite-only access.

2.2 Profile & "Source" Content (User-Submitted)

This is your master career database. We collect any professional history metrics you choose to populate within "The Source," including:

  • Full name, professional headline, target role, and location data (country, timezone).
  • Work authorizations, remote-only preferences, availability, and target salary expectations.
  • Third-party professional links (LinkedIn URL, portfolio URLs).
  • Employment history (roles, companies, dates), skills (with self-declared proficiency levels), education, certifications, languages, projects, volunteer work, and self-declared career gaps.

2.3 Tailoring Input & AI Artifacts

  • Job Descriptions: Text pasted or submitted by you for analysis.
  • AI-Generated Artifacts: Structured job description breakdowns, per-requirement matching scores, gap reports, application recommendations, and generated tailored resumes (stored as structured JSON and downloadable PDFs).

2.4 Usage, Telemetry, & Analytics

  • Server-Side Log Performance: Records of operations containing model type used, token usage counts (input, output, and total tokens), system duration, operation status, and parent operation IDs for cost and quota analysis.
  • Product Analytics: User interaction and feature engagement events tracked via PostHog.
  • Quota Management: Hourly, daily, and monthly operational counters to track limit enforcement.

2.5 Feedback & Support Data

  • Ratings and free-text survey responses linked to specific tailoring tasks.
  • Text submissions and attachments sent via our in-app feedback widgets or directly to our privacy email.

2.6 Waitlist Records

  • Email addresses and optional introductory notes submitted by non-invited users requesting access to the platform.

2.7 Technical Logs

  • IP addresses, browser user-agent strings, referrer URLs, request latency, and client-side error code captures (including component stacks for active debugging).

2.8 Data We Explicitly Do Not Collect

  • No Financial Information: We do not collect or store credit card, billing, or bank data during this zero-cost beta phase.
  • No Third-Party Verification: We do not pull official backgrounds or government ID checks from external bureaus.
  • No Tracking Identifiers: We do not collect behavioral advertising IDs.
  • No Sensitive Personal Data: We do not request, nor should you include in your career profile, any sensitive information such as health records, political opinions, religious beliefs, sexual orientation, or biometric data.

3. How and Why We Process Your Data

Under global data laws, we must have a lawful basis to handle your data.

  • Providing Core Services (Profile Data, Source Content, Job Descriptions, Artifacts): Contractual Necessity — to provide the platform functions you actively request.
  • Executing AI Generations (Source Content, Submitted Job Descriptions): Contractual Necessity — essential execution of the core requested service.
  • Invite Gating & Security (Sign-in Email, Waitlist Data): Legitimate Interest — guarding system capacity and protecting platform stability.
  • Platform Analytics (PostHog Tracking Events, Product Telemetry): Legitimate Interest / Consent — improving our software layout based on real usage patterns.
  • Beta Communications (User Email Address): Contractual / Legitimate Interest — keeping beta testers updated on development critical to their account.
  • System Debugging (Server Error Logs, IP, User Agent): Legitimate Interest — maintaining a secure, reliable, and functional application.

We do not sell your data, do not use your Source content or resumes to train public models, and do not share your data with advertisers.

4. Third-Party Subprocessors & Data Transmissions

To operate our application infrastructure, your personal data is transferred to and processed by the following verified third-party entities:

  • Lovable (Application hosting, edge runtime, deployment): All data in transit passes through Lovable infrastructures. Lovable Privacy Policy
  • Supabase (Core database hosting, PostgreSQL, Auth, file storage): All persisted personal data is secured within Supabase infrastructure. Supabase Data Processing Addendum
  • Google Cloud Identity (Sign-in authentication provider): Accesses core email and baseline Google profile verification. Google Privacy Policy
  • Google AI Studio / Gemini API (Large Language Model execution): Your Source content and target job descriptions are passed as API prompts to generate resume alterations and gap matrices using gemini-2.5-flash and gemini-2.5-pro. Calls are made server-side directly using our account API key. Google AI Studio Terms
  • PostHog (Product interaction telemetry and feedback loops): Process event metadata, tailoring IDs, and unique user hashes. PostHog Privacy Policy

5. Artificial Intelligence (AI) Disclosures & Practices

Because AI processing is fundamental to Sourcetailor, please review these operational commitments carefully:

  • Strict No-Training Commitment: We process all AI tasks using a paid, developer-tier Google AI Studio API key. Under Google's explicit developer data governance terms for paid API accounts, your prompts (Source data, job descriptions) and outputs (resumes, match matrices) are strictly confidential and are not utilized by Google to train or improve its foundational machine learning models.
  • Probabilistic Outputs: AI models generate text based on probabilities. Outputs may occasionally contain factual inaccuracies, omissions, or structural errors. You remain solely responsible for verifying the absolute truth and correctness of any resume or text before sending it to a prospective employer.
  • Input Security: Target job descriptions are treated by our system as untrusted inputs. While we use server-side injection guards, users should avoid inputting proprietary, highly confidential, or classified corporate text into the tailoring module.

6. Data Retention & Account Deletion

We enforce strict timelines to ensure your data is not stored longer than necessary for beta development:

  • Account, Profile, & Source Database: Retained continuously for the duration of your active account.
  • Tailoring Artifacts: Saved for your ongoing reference during the closed beta timeline unless explicitly deleted by you via the user dashboard.
  • Telemetry, Analytics, & Feedback: Retained for a maximum of 48 months from collection to execute comprehensive system performance trends and cost-modelling analyses.
  • Server Logs & Error Captures: Purged automatically on a rolling 30-day window.
  • Waitlist Records: Retained until you are granted access to the closed beta or until you request removal.

Account Deletion

You can trigger a full, permanent deletion of your profile, Source data, and tailoring histories directly within the application dashboard via Profile → Delete Account, or by contacting us at privacy@mattcortes.com. Upon execution, your active database data is deleted immediately. Residual database backups are entirely overwritten and purged within a 30-day rolling backup cycle.

7. Data Security Guardrails

We maintain modern technical safeguards to defend your data against unauthorized access, loss, or manipulation:

  • Row-Level Security (RLS): All data tables in our database enforce Postgres Row-Level Security scoped directly to your validated unique authentication ID (auth.uid()). No user can view or alter another user's Source records.
  • Server-Side Token Isolation: Sensitive application tokens, administrative access keys, and external API secret keys (such as our GEMINI_API_KEY) are kept strictly on our server backend and are never exposed to the client browser environment.
  • Secure Transmissions: All connections, API routes, and static pages are served exclusively over encrypted HTTPS protocol.
  • Google OAuth Mandate: We do not store user passwords. Because authentication is handled entirely through Google OAuth using short-term JSON Web Tokens (JWTs), password compromise risks on our end are naturally mitigated.

8. International Data Transfers

Sourcetailor is operated out of the Estado de México, México. However, the software subprocessors outlined in Section 4 process data globally (predominantly within United States cloud server clusters). If you access our platform from outside Mexico (such as the EU or UK), your data will be securely transferred across borders. We rely on standard contractual clauses (SCCs) and robust data processing addendums provided by our hosting providers to guarantee an equivalent level of safety.

9. Your Legal Rights (ARCO & Global Rights)

Depending on your geographic location, you hold explicit statutory rights over your personal data. Under frameworks like the Mexican LFPDPPP (ARCO Rights), GDPR, and CCPA, you can request:

  • Access (Acceso): Obtain a comprehensive copy of all personal data we hold about you.
  • Rectification (Rectificación): Correct any inaccurate, incomplete, or out-of-date career records (most of which you can manage inside the app yourself).
  • Cancellation/Erasure (Cancelación): Command the permanent deletion of your profile and data footprint.
  • Opposition (Oposición): Object to our processing of your data based on legitimate interest justifications.
  • Portability: Export your tailoring history as structured JSON and your customized resumes as PDFs.

To exercise these rights, submit your request to privacy@mattcortes.com. We verify identity parameters before processing and will issue a formal resolution within 30 days.

If you are unsatisfied with our data processing actions, you have the right to file an official complaint with your local data authority (such as the INAI in Mexico, the AEPD in Spain, or the ICO in the United Kingdom).

10. Cookies & Local Storage

We use a minimal, privacy-first technical storage footprint. We do not use any third-party advertising tracking or behavioral retargeting pixels.

  • Supabase Authentication (sb-*): Essential cookies used to verify your active secure login session state.
  • Theme Preferences: Local browser storage to remember your custom light/dark display preference.
  • Onboarding Tracking: Local storage entries tracking your interface tour progress so you do not see introductory walkthroughs repeatedly.
  • PostHog Analytics: Analytical cookies used solely to evaluate app feature utility. Where local international law mandates (such as the EU/UK), the initialization of non-essential analytics tracking is strictly subject to your active consent choice upon first login.

11. Minor Restrictions

Sourcetailor is strictly intended for adult job seekers. We do not knowingly compile data from individuals under the age of 18. If we discover an account has been registered by a minor, we will instantly delete all associated records.

12. Policy Changes & Contact

We reserve the right to alter this document during our beta footprint. Any material modifications to our data management procedures will be broadcast directly via your registered email or posted as an in-app system warning prior to taking effect.

For any questions regarding your data privacy, security disclosures, or to exercise your rights, contact: privacy@mattcortes.com.