This page summarizes what HAMRA does with your data. The full legal terms are at /privacy; this is the human-readable version.
What we store
- Profile data. Everything you enter into your profile: experience, skills, preferences, education. Stored encrypted at rest in our database.
- Resume content. Both your master resume and the tailored variants Co-pilot generates per job.
- Application history. Which jobs you queued, which you submitted, the outcome.
- Personality assessment results. Your DISC profile.
- Account metadata. Email, name, plan, billing identifiers.
What we do NOT store
- The actual content of forms on third-party job-board sites. The extension fills those locally; we don't capture or log what was typed.
- Your browsing history. The extension only runs on job-board origins you visit directly.
- Your password (managed by Supabase Auth; we never see it).
- Your payment card (handled entirely by Razorpay / Dodo).
Where the data lives
- Database: Supabase (Postgres), hosted in AWS
ap-south-1. - Email send: Resend.
- File storage (resumes): Supabase Storage.
- AI calls: Google Vertex AI. Your prompts include profile + job data; Vertex AI does not store or train on this data per Google's terms.
Your rights
- Export. Request all your data at any time via /api/gdpr/export from your settings.
- Delete. Permanently delete your account + all associated data from /settings/account. This is non-recoverable.
- Opt-out. Granular email category preferences at /settings/email-preferences.
Reporting a security issue
See our security disclosure policy — we credit responsible reporters and respond within 72 hours.