Privacy Policy.

1. Who we are and what this policy covers

NeuroHire (“NeuroHire”, “we”, “us”) operates the job-search platform at neurohire.ai. The data controller for the personal information described in this policy is NeuroHire, the operator of neurohire.ai.

This policy covers the neurohire.ai website and app, including public job browsing without an account. Some of the collection described below — analytics and browser storage in particular — starts before you sign up, so this policy applies to visitors as well as account holders.

You can reach us at hello@neurohire.ai for any privacy question or request in this policy.

2. Information you provide

Registration. Full name, email address, and password. Your password is stored only as a bcrypt hash — never in plain text.

Profile. Phone number, skills (free-text tags), experience level, preferred locations, preferred job types, and an avatar image URL. All of these are optional and editable at any time.

Resumes. You can upload a resume as a PDF or DOCX file up to 10 MB (we validate the file type). For each upload we store: the file itself, the full extracted plain text, an AI-parsed structured version (work history, education, skills, contact information), and a file hash.

AI outputs you generate. Tailored resumes (full section content, tailoring strategy, and ATS-score snapshots) and cover letters (full body plus the AI's reasoning) are stored per user and job. Draft tailoring responses are also cached for 7 days to make regeneration fast.

Profile autofill. After parsing a resume, we automatically fill empty profile fields from it — phone number, up to 50 skills, and experience level. You can edit or remove anything it fills in.

Waitlist. If you join the Resume AI waitlist we store your email address and where you signed up from. There are two ways in: typing your email on the landing page, or clicking the in-app “Get it first” pill — which submits your account email with one click. The only purpose is a single launch-announcement email (“No spam — one email when it ships”).

Support. If you email hello@neurohire.ai, we receive your message and email address. Our mailboxes are handled via Google Workspace.

3. Information collected from guests (no account)

When you browse without an account, PostHog (see section 7) captures anonymous pageviews and autocaptured interactions (button clicks, form submits, and link clicks) so we can measure landing-page traffic, referrers, country breakdowns, and conversion to signup. Search terms typed on the jobs board and pages you visit are recorded as event properties on those pageviews.

As a guest you do not have a Person profile in PostHog and no session replay is recorded. PostHog assigns a distinct identifier to your browser (stored as a ph_* cookie / localStorage entry) so repeat visits from the same browser aren't double-counted as unique. If you sign up later, the events from your pre-signup session are attributed to your new account.

When you submit the landing waitlist form we also record the join with the email you provided (source: landing).

Your browser also keeps a local activity store: jobs you viewed or dismissed and your last 10 searches. This lives on your device, not on our servers (section 5).

4. Information collected automatically

We process the following for security and fraud prevention (our legitimate interest — see section 10):

• IP address and user-agent — captured at signup, login, and token refresh; held in your session record for the session's life (at most 7 days) and in security audit logs.
• Device fingerprint — your browser may supply a fingerprint that we bind to your session; a mismatch invalidates the session. We also compute server-side request fingerprints (a hash of browser headers), retained for 30 days and indexed by IP and user ID.
• Bot protection — every request's headers are analyzed; a short per-IP request history is kept for about 10 minutes; requests scoring above confidence thresholds are automatically blocked.
• IP reputation — per-IP violation scores drive escalating automatic blocks (1 hour, 6 hours, 24 hours, or 7 days). Blacklisted IPs are stored indefinitely, and hidden honeypot endpoints permanently blacklist IPs that access them. If you believe you were blocked in error, email hello@neurohire.ai and a human will review it.
• Brute-force protection — failed login attempts (including the email address attempted) are logged; 5 failures lock the account for 15 minutes, and per-IP locks apply too.
• Security audit log — kept in Redis only: a global stream capped at 100,000 events, a per-user index kept 90 days, a per-IP index kept 30 days, and alerts kept 7 days. Staff with the admin flag can view these logs as part of internal security operations.
• AI telemetry — every AI call logs the model used, token counts, latency, cost, and validation results tied to your user ID. Prompt content is not logged here.

Job activity on our servers (signed-in users). We store the jobs you save, the jobs you view — explicitly including “clicked Apply but didn't finish” — and the applications you tell us about, with their status over time.

5. Information stored only on your device

The following never leaves your device — we cannot see it:

• Job activity store (neurohire-user-store): saved, applied, viewed, and dismissed jobs (the last 500) plus your last 10 search queries. Persists until you log out or switch accounts.
• Preference and UX flags: theme, board density, first-run tour completion, promo-pill dismissal, waitlist-joined flag, and nh_store_owner — your user ID, used to detect an account switch on a shared browser. This last key is not removed on logout.
• Flag-gated profile fields (currently hidden in the UI): headline, location, about, experience and education entries, preferred title, minimum salary, relocation and workplace preferences — and notably work-authorization status and security clearance.
• Session storage (cleared when the browser session ends): pending apply/save intents and banner dismissals.

6. Cookies and local storage

The first three cookies are strictly necessary for the service to work and require no consent. The PostHog cookies are not strictly necessary — see section 7 for how product analytics currently operates.

7. Analytics (PostHog)

We use PostHog, a product-analytics platform provided by PostHog, Inc. Data is stored on PostHog's US Cloud infrastructure. PostHog is certified under the EU-US Data Privacy Framework for transfers from the EU, UK, and Switzerland.

When PostHog loads: only after you sign in (or, in three narrow pre-signup cases described in section 3, when you submit the landing waitlist form or open the sign-up / forgot-password pages). If you never sign in and stay off those three pages, PostHog never loads and no product analytics are recorded.

To be transparent about granularity, PostHog receives event-level data, not just aggregates:

• Page URLs, including query strings.
• Raw free-text search terms and result counts.
• Per-job view, save, apply, and dismiss events with the job ID, job title, and employer name.
• Account lifecycle events: sign-up, login, logout, email verification, profile update, account deletion, and password-reset request (event names only — no profile content).
• “Not interested” relevance signals, which we may use to improve ranking and recommendations.
• Person properties attached to your PostHog identity: email, first and last name, verification status, sign-up date, and running counts of jobs you have saved, applied to, viewed, or dismissed.
• Session replay: a masked video of your interactions with the site. All input fields (email, password, search, resume text, notes) are obscured. Retained by PostHog for approximately 30 days.

Data sent to PostHog may be processed on PostHog's US infrastructure outside your country. The transfer relies on PostHog's certification under the EU-US Data Privacy Framework for EU/UK/Swiss data. To request deletion of your PostHog data, email hello@neurohire.ai.

8. AI processing

Anthropic PBC processes resume data on our behalf: the full text of your resume (and, for hard-to-read PDFs, the raw PDF file) is sent to Anthropic's API for parsing, and your parsed resume plus the job description are sent when you generate a tailored resume or cover letter. Anthropic does not use data submitted through its API to train its models by default. Retention of API inputs is governed by our agreement with Anthropic.

Job-catalog AI (no user data). Separately, our job catalog is enriched by AI that never receives your personal data: Google Gemini extracts structured fields (salary, visa sponsorship, clearance, qualifications) from scraped public job postings, and OpenAI computes job-description embeddings for search. These systems process job content only.

Profiling and automated decisions. Match scores are computed algorithmically from rule-based signals (skills, experience, and location overlap). They are informational only — they are not an employment decision and have no legal or similarly significant effect on you. Relevance feedback you give (like “not a fit”) may inform future ranking. The only fully automated decisions we make are security blocks (section 4); you can contest any block by emailing hello@neurohire.ai.

9. Processors and recipients

• Anthropic PBC — AI resume parsing, tailoring, and cover letters (receives resume content, which is personal data).
• PostHog, Inc. — product analytics and session replay (receives behavioral data and Person properties for signed-in users, per section 7). Data stored on PostHog's US Cloud.
• Google LLC — Google Workspace Gmail SMTP for transactional email delivery (receives your email address and message content).
• Contabo — hosting provider. Our databases, cache, and search index run on Contabo infrastructure, and resume files are stored on the server's filesystem. Contabo operates data centers in Europe and the United States.

That is the whole list. We use no ad-tech, no fingerprinting SDKs, and no data brokers. Fonts are self-hosted (no runtime requests to Google Fonts). Session replay is provided by PostHog for signed-in users only, with all input fields masked. We do not sell or rent your personal information.

10. Purposes and lawful bases

11. How long we keep data

12. Your rights and how deletion works

Depending on where you live, you may have the right to:

• Access — get a copy of your data.
• Rectification — fix incorrect data (you can edit your profile directly).
• Deletion — delete your account and personal data.
• Portability — receive your data in a machine-readable format.
• Restriction and objection — limit certain processing.
• Withdraw consent for consent-based processing at any time.
• Complain to your data-protection supervisory authority.

We respond to rights requests within the timeframes required by applicable law.

Where to delete your account: on your Profile page (account section), not in Settings.

What account deletion does today. Deleting your account immediately scrubs the identity fields from your user record (email, name, phone, avatar, skills, preferences), deactivates login, and revokes your sessions.

Export. You can request a machine-readable export of your data by emailing hello@neurohire.ai. Our automated export covers your profile, applications, saved and viewed jobs, resume metadata, and session records (with IP and user-agent); tailored resumes, cover letters, parsed resume content, waitlist entries, and audit logs are not yet included in it — ask and we will provide those separately.

Residual device data. Server-side deletion does not clear your browser's local storage (section 5). On a shared device, also clear the site's data in your browser.

13. California privacy rights (CCPA/CPRA)

For California residents, the categories of personal information we collect (as defined in Cal. Civ. Code §1798.140) are: identifiers (name, email, phone, IP address), professional or employment-related information (resume content, work history, applications), internet or network activity (job views, searches, usage data), and inferences (match scores, relevance signals). We collect them from you directly and automatically from your use of the service, for the business purposes described in sections 2–10.

We do not sell personal information. Our analytics provider, PostHog, processes data only on our behalf as a service provider — we use no ad networks and no cross-context behavioral advertising. We do not currently process Global Privacy Control (GPC) signals.

You may exercise the rights in section 12 without discrimination — we will never deny you the service, charge different prices, or degrade quality because you exercised a privacy right. You may also submit a request through an authorized agent by emailing support@neurohire.ai; we will verify the request with you directly before acting on it.

14. International data transfers

Our infrastructure is hosted by Contabo, which operates data centers in Europe and the United States. Our processors Anthropic and Google may process data in the United States and other countries. Where personal data crosses borders, we rely on the safeguards available for each processor — such as standard contractual clauses or the EU-US Data Privacy Framework (PostHog's certification is described in section 7).

15. Security

• Passwords are hashed with bcrypt and never stored in plain text.
• Authentication uses HttpOnly cookies, short-lived access tokens (~15 minutes) with rotating refresh tokens, and immediate session revocation. No credentials are kept in browser web storage.
• Double-submit CSRF protection on all state-changing requests.
• Security headers, including X-Frame-Options DENY and a Permissions-Policy that disables geolocation, camera, and microphone.
• Email is delivered over TLS (STARTTLS).
• Automated bot, brute-force, and IP-reputation defenses (section 4).
• Access to security data is restricted to admin staff.

To be candid about limits: resume files are stored on our server's filesystem protected by access controls, but they are not currently encrypted at rest, and we do not currently run automated vulnerability scanning. We are stating this plainly rather than overclaiming.

16. Data breach notification

If a security breach affects your personal data, we will notify you and the relevant regulators without undue delay, as required by applicable law.

17. Children

NeuroHire is not directed to individuals under 16, and you must be at least 16 to use the service. We do not knowingly collect personal data from children; if we learn we have collected data from a child in error, we will delete it.

18. Changes to this policy and contact

We will update this policy as the service evolves. For material changes, we will give notice via the service (such as a banner or in-app notice) and update the effective date at the top of this page, which always reflects the current version.

For any privacy question or request: hello@neurohire.ai.