Privacy Policy

1. Who we are

KickMyHR (“the Service”) is operated by Intellinapse Ltd, a company registered in England & Wales (company number 16587897). In this policy, “we”, “us”, and “our” refer to Intellinapse Ltd.

For privacy questions or to exercise any of your rights below, contact us at info@brainsparkgames.com.

2. Scope of this policy

This policy covers the KickMyHR web application and the KickMyHR Chrome extension. It does not cover third-party websites you visit while using our Chrome extension — those have their own privacy policies.

3. Information we collect

3.1 Account information

When you sign in with Google, we receive and store:

• Your name, email address, and profile picture
• Your Google account ID (to link you across sign-ins)
• OAuth access and refresh tokens, used to call Google APIs on your behalf (see Calendar section below)

3.2 Content you create

While using the Service, we store:

• Resumes: text content, uploaded files (PDF), structured sections you build, and metadata such as the file name
• Cover letters: the same as resumes
• Job applications: job title, company, location, URL, salary, status, description, your private notes, applied date
• Interviews: date and time, stage, location, attendee email addresses you enter, your notes, outcome
• Contacts: recruiter or hiring manager info you choose to save (name, email, LinkedIn URL, role, your notes)
• ATS scores: keyword matches, missing keywords, AI-generated suggestions, generated cover letter text
• Notifications: reminders we have shown you (e.g. follow-up prompts), with a read/unread state

3.3 Chrome extension data

The Chrome extension, when installed and active:

• Reads job description text from the page you are currently viewing, only on the job sites listed in our extension manifest (LinkedIn, Indeed, Glassdoor, Greenhouse, Lever, Workday, and ~25 other supported job boards) — and only when you actively use the extension
• Parses your resume locally in the browser; the parsed text is sent to our servers only if you choose to save the resume to your account
• Computes the ATS keyword score locally in your browser — your resume text is not sent to our servers for scoring
• Stores your settings (such as your own Groq API key if you provide one, sync preferences) in Chrome local storage on your device

The extension does not read pages outside the supported job sites. It does not track your browsing.

3.4 Google Calendar (only if you grant access)

If you choose to sign in with the Calendar permission, we use that permission only to:

• Create calendar events for interviews you schedule inside KickMyHR
• Update or delete the events we created when you reschedule or remove the interview

We do not read your existing calendar, scan other events, or modify anything we didn't create. We store the Google event IDs of events we created so we can update or delete them later. You can disconnect Calendar access at any time at myaccount.google.com/permissions.

3.5 Payment data

If you subscribe to a paid plan, payment is processed by Stripe. We store your Stripe customer ID, subscription state, and price plan — but we never see or store your card number. Stripe's privacy policy applies to the card data itself.

3.6 Push notifications

If you enable push notifications, we store the browser-provided push subscription endpoint and keys so we can send you reminders. You can disable this at any time in Settings.

3.7 Server logs

Like any web service, our hosting providers record standard server logs including IP address, timestamps, request paths, and user-agent strings. These are retained for up to 30 days and are used for security, debugging, and abuse prevention.

4. How we use your information

We use the information described above to:

• Provide and improve the Service
• Score your resume against job descriptions and generate AI analysis when you trigger those features
• Track your job applications and interviews
• Send you notifications (in-app, push, and transactional email) about your applications
• Process payments
• Detect and prevent abuse
• Communicate with you about service updates or important changes

5. What we do not do

• We do not sell your personal data to advertisers, data brokers, or anyone else
• We do not use your resume or job data to train AI models — not ours, not anyone else's
• We do not share your resume with employers — sharing is entirely under your control
• We do not use advertising or tracking cookies. We don't serve ads

6. Sub-processors and third parties

We use the following service providers to operate the Service. Each processes data only on our instructions and is contractually bound by standard data-protection terms.

• Google — sign-in (OAuth), and optionally Google Calendar
• Supabase — database hosting (EU region)
• Vercel — web application hosting
• Stripe — payments
• Groq — AI inference, only when you trigger an AI-powered feature (deep analysis, cover letter generation, resume tailoring)
• Resend — transactional email

7. About AI features

When you trigger an AI feature (deep analysis, cover letter generation, resume tailoring), we send the relevant data (typically the job description, your resume text, and missing-keywords list) to Groq for processing. Groq processes this in real time and does not retain it for training, per their privacy policy.

If you provide your own Groq API key in Settings, AI calls from the Chrome extension are made directly from your browser to Groq, and we never see the request.

8. How long we keep your data

• Account and content data: kept until you delete your account
• Server logs: up to 30 days
• Push subscriptions: kept until the subscription expires or you disable notifications
• Deleted data: removed from our active database immediately; backups roll off within 30 days

9. Your rights

Depending on where you live, you have the right to:

• Access: view all your data inside the app — every resume, job, interview, note, and score is visible to you
• Export: download your data; email us if you need a full export and we'll provide it within 30 days
• Delete: delete your account and all associated data at any time from Settings
• Correct: edit any of your data directly in the app
• Object or restrict processing in certain cases
• Lodge a complaint with the UK Information Commissioner's Office or your local data-protection authority

To exercise any right not directly available in the app, email info@brainsparkgames.com. We respond within 30 days.

10. Security

• All traffic is encrypted in transit (HTTPS only)
• Data is encrypted at rest in our hosting provider's database
• We never store passwords — sign-in is delegated to Google OAuth
• If you provide your own Groq API key, it's encrypted with AES-256 before being stored
• We use industry-standard practices including least-privilege access controls and audit logging

11. Cookies

We use only the cookies strictly necessary to operate the Service: a session cookie that keeps you signed in, and a CSRF cookie to protect form submissions. We do not use advertising, marketing, or third-party tracking cookies.

12. International data transfers

We are based in the UK. Some of our sub-processors are based in or operate from the United States (Vercel, Stripe, Groq, Resend). When data is transferred to the US, we rely on Standard Contractual Clauses and equivalent safeguards as required by UK GDPR.

13. Children

The Service is not directed to children under 16, and we do not knowingly collect data from them. If you believe a child has provided us data, contact us and we'll delete it.

14. Changes to this policy

We'll post material updates here with a new “last updated” date and notify active users by email when changes are significant.

15. Contact

Intellinapse Ltd
Company number: 16587897
Email: info@brainsparkgames.com