Privacy Policy

What we collect

The resume you upload, the job posting you point us at, and anything you type during a session. If you create an account, your email address and your subscription status. Plus the ordinary technical records any website keeps — pages visited, rough location from your IP address, browser type, and errors.

What we never do

• We don't sell your data, and we don't share it for advertising.
• We don't let AI providers train on your content. We route only to model hosts that contractually don't retain or train on what we send them.
• We don't record your screen. Session recording is switched off, and the analytics we do run is configured to mask text so your resume can't leave the page that way.
• Your resume text never appears in an analytics event.

How your session is used

Your resume and the job posting are sent to a large language model to produce a draft resume and cover letter, and to a smaller set of intermediate steps along the way (pulling out your experience, deciding what to emphasise, checking the draft). We also keep a record of each step so we can work out why a bad result was bad.

Who we share it with

We use these providers to run the service. Each one only receives what it needs, and each is bound to handle it on our instructions.

• OpenRouter — routes our AI requests, currently to Z.ai's GLM models. Receives your resume and the job posting. Requests are restricted to hosts that don't retain or train on the content, which may be located outside your country, including in the US and China.
• Supabase — database, file storage and sign-in. Holds your session data and email address.
• Vercel — hosting. Handles every request and keeps short-lived server logs.
• Stripe — payments. Receives your billing details directly; we never see your card number.
• PostHog — product analytics and error reports, and only with your consent. Receives page views and event names, never document content.

Cookies

Two kinds, and only one of them is a choice. The cookies that keep you signed in and carry you through checkout are strictly necessary — without them the product doesn't work, so they don't need consent and there's no way to turn them off and still use Tellwell. The analytics cookie is optional. Decline it and we fall back to counting visits without a persistent identifier.

You haven't chosen yet — the banner at the bottom of the screen is waiting for you.

How long we keep it

Sessions are deleted after 12 months without activity. If you ask us to delete your account we act on it within 30 days, apart from what we have to keep for tax and accounting — Stripe payment records, which are kept for six years and contain no resume content. Analytics events are kept for 12 months.

Security

Traffic is encrypted in transit and data is encrypted at rest. Sessions are protected by database row-level security, so one person's session can't be read by another even if something else goes wrong. Card details never touch our servers. Access to production data is limited to those who need it. No system is perfect, and if we ever have a breach affecting you we'll tell you.

Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it, or object to how we're using it. Email tellwell.support@forhumankind.io and we'll respond within 30 days. If you're in the UK or EU and you think we've got it wrong, you can also complain to your national data protection authority.

Contact

Tellwell is operated by For Human Kind. Reach us at tellwell.support@forhumankind.io.