Privacy Policy

1. Who We Are

RemoteStack operates the job board at remotestack.in, the AutoApply subscription service at remotestack.in/autoapply, and the RemoteStack MCP at mcp.remotestack.in, which lets AI assistants such as Claude and ChatGPT use RemoteStack. For privacy-related matters, contact us at privacy@remotestack.in.

2. Data We Collect

Job board visitors (free users):

• Email address and department preferences, if you subscribe to the weekly digest.
• Standard server logs including IP address, browser type, and pages visited — retained briefly for security and debugging.
• Analytics data (aggregate, anonymised) about how pages are used. This is cookieless. No identifiers are stored on your device and no individual is tracked across sites.

AutoApply subscribers:

• Name and email address.
• Resume content (PDF), uploaded at the time of subscription.
• Job preferences: target role, years of experience, skills, dream companies, dealbreakers.
• Application history: companies and roles applied to, application status, dates.
• Payment data: transaction reference and order ID. We do not store full card numbers or bank details — these are handled by our payment processor.
• Authentication data: email address used for magic link sign-in, managed via Supabase Auth.

RemoteStack MCP users (people who connect RemoteStack to an AI assistant):

• Email address, used to sign you in with a magic link and to link the MCP to your RemoteStack account.
• The name of the AI app you connect (for example "Claude"), as reported by that app when you authorise it.
• A usage record for each tool call: which tool, the credits it used, how long it took, whether it succeeded, and the protocol version. We do not store your search terms, the jobs returned, or any other content of your conversations.
• Credit balance history and credit pack purchases: pack, amount, currency, and the payment provider's payment and invoice references. We never receive your card or bank details.
• When you first sign in, a one-way keyed hash of your IP address, used only to limit free-credit signups per network. We do not store the IP address itself.
• Resumes: if you paste a resume into the MCP, it is sent to our AI provider to answer that request and is not saved to your profile. If you do not paste one, the resume saved on your RemoteStack profile is used. ATS check results are cached against a hash of the resume text so the same resume gets the same score.
• Sign-in tokens for your AI app are stored in hashed form on our hosting provider.

3. How We Use Your Data

• To provide and improve the RemoteStack job board and AutoApply service.
• To send the weekly jobs digest to subscribers who have opted in.
• To process your AutoApply subscription, match you with relevant job opportunities, and track application history.
• To use AI processing (via DeepSeek) to analyse your resume, score it, and generate application materials, tailored resumes and job match insights.
• To train, evaluate and improve AI models, using only anonymised data with your name, email address, phone number, postal address and profile links removed. A resume pasted into the RemoteStack MCP is never used for this. See section 8 of our Terms of Service.
• To run the RemoteStack MCP: authenticate you, answer your AI assistant's tool calls, keep your credit balance, and process credit pack purchases.
• To send transactional emails such as subscription confirmations, sign-in links, and application updates.
• To prevent fraud, enforce our Terms of Service, and comply with legal obligations.
• To communicate important changes to the service or these policies.

4. Third-Party Services

We use the following third-party services to operate the platform. Each processes your data only to the extent necessary for its function:

• Supabase — database and file storage, hosted in Singapore. Your profile, resume, and application data is stored here. Supabase is GDPR-compliant.
• Cloudflare: hosting for remotestack.in and mcp.remotestack.in, on Cloudflare's global network. Standard request and log data passes through Cloudflare, and the MCP's sign-in tokens are stored there in hashed form.
• Resend — transactional email delivery. Your email address and email content are processed by Resend when we send you emails.
• DeepSeek: AI model used to parse and score resumes, write cover letters and tailored resumes, and classify job listings. Resume content, and the job description when relevant, is sent to DeepSeek's API for processing. DeepSeek's servers may be located outside your country, including in China.
• Privacy-friendly analytics: we use cookieless analytics to collect anonymised, aggregate data about site usage (pages visited, referrer, general location). No cookies or device identifiers are set, and no profile of you is built. We do not use Google Analytics.
• Payment processors: Dodo Payments, the merchant of record for new subscriptions and credit packs in every currency. Dodo receives your name, email, billing country and address, and payment details, and uses them to process the payment, calculate tax and issue your invoice. Subscriptions started earlier continue to be billed by Commet (US dollars; Commet is the merchant of record) or Cashfree (Indian rupees). Your payment details are entered on their pages and processed by them. We do not store your full card or bank details.
• Logo.dev — used to display company logos on job listings. Company domain names may be sent to this service.

5. Data Retention

• Job digest subscriber emails: retained until you unsubscribe. Deleted within 24 hours of unsubscribe request.
• AutoApply subscriber profiles, resumes, and application history: retained for the duration of your subscription and for 90 days after cancellation, then permanently deleted.
• Payment transaction references: retained for 7 years for accounting and tax compliance.
• RemoteStack MCP account, credit history, usage records and purchase records: retained while your account exists. Purchase records follow the 7-year rule below; the rest is deleted when you ask us to delete your account.
• Server logs: retained for up to 30 days, then deleted.

6. Cookie Policy

We do not use tracking or analytics cookies on remotestack.in, so there is no cookie consent banner. The only browser storage we use is strictly necessary for the site to work:

• Theme preference (strictly necessary): Your light/dark mode choice is stored locally in your browser. No personal data, no tracking.
• Session cookies (strictly necessary): Supabase Auth uses secure HTTP-only cookies to maintain your signed-in session on the AutoApply dashboard. Required for the service to function.

Our analytics are cookieless and aggregate only. We do not use advertising cookies or retargeting cookies.

7. Your Rights

Depending on your location, you may have the following rights over your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data. We will comply within 30 days, subject to legal retention obligations.
• Portability: Request your data in a structured, machine-readable format.
• Withdrawal of consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Objection: Object to processing of your data in certain circumstances.
• Complaint: Lodge a complaint with your local data protection authority.

To exercise any of these rights, email us at privacy@remotestack.in. We will respond within 30 days.

8. India: Digital Personal Data Protection Act 2023

We process personal data of Indian residents in accordance with the Digital Personal Data Protection Act, 2023 ("DPDPA"). We collect and process your data only for the purposes described in this policy, with your consent obtained at the time of registration or subscription.

As a data fiduciary, we implement reasonable security safeguards to protect your personal data and notify you in the event of a data breach that is likely to affect your rights. You may exercise your rights as a data principal by contacting us at privacy@remotestack.in.

9. European Users: GDPR

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR). Our lawful basis for processing your data is:

• Contract: processing necessary to perform the AutoApply subscription service you have purchased.
• Consent: for email digest subscriptions.
• Legitimate interests: for fraud prevention and service security, where these are not overridden by your rights.

Data transfers to third parties outside the EEA are governed by Standard Contractual Clauses or the third party's adequacy determination where applicable.

10. California Users: CCPA

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA). You have the right to know what personal information we collect, to request deletion of your personal information, and to opt out of the sale of your personal information.

To exercise your rights or to submit a "Delete my data" request, contact us at privacy@remotestack.in.

11. Children's Data

Our Services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at privacy@remotestack.in and we will delete it promptly.

12. Security

We implement reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include encrypted data transmission (HTTPS), row-level security on our database, and restricted access to production systems. No system is entirely secure, and we cannot guarantee absolute security. We will notify you promptly in the event of a data breach that affects your rights.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the date at the top of this page and, where appropriate, notify you by email. Continued use of the Services after changes constitutes acceptance of the updated policy.

14. Contact

For any privacy-related questions, requests, or complaints, including data deletion or access requests, contact us at privacy@remotestack.in. We aim to respond to all requests within 30 days.