Privacy Policy

Who we are

Weydr (operated from India; legal entity details will be added upon business registration) is responsible for your personal data. This policy covers the Weydr website and app (the "Service").

For anything about your privacy or your data, including complaints, write to support@weydr.com. That address is our privacy and grievance contact. A named grievance officer will be added here when Weydr is registered.

Weydr is a job-search copilot: you build one master profile, and the Service tailors résumés, cover letters, interview prep, and salary insights against jobs you're applying to. This policy is written around what that actually requires us to store and process.

What we collect

Everything below is stored in your account, and is either something you give us or something the Service records while you use it.

• ·Account: your email address, name and password (as a secure hash, by our authentication provider), or your Google or LinkedIn sign-in details if you sign in that way.
• ·Your résumés: work history, skills, education and anything else you enter or import from a PDF, the master profile, and every tailored version.
• ·Jobs: job descriptions you paste in, or fetch from a URL you give us.
• ·Cover letters, interview prep sets and salary results generated for you, and the inputs to them.
• ·Profile details you choose to add: current title, target roles, LinkedIn URL, and your country. We suggest a country from the country of your IP address (read by our host when you load the page) and only save it when you confirm it.
• ·Salary figures: optional. If you enter your current or expected salary, it is sent to the AI provider to produce the salary estimate.
• ·An optional profile photo for templates that support it. See the note on photo links under Retention.
• ·Your AI provider key, if you use Bring Your Own Key (BYOK). It is encrypted at rest (AES-256-GCM) and decrypted only to make an AI call you asked for.
• ·Payments: PayPal handles your card or PayPal details. We receive and keep the transaction ID, plan, amount, currency, status and date. If you used a partner code, we keep which code was used and the partner it belongs to.
• ·Usage records: which AI actions you ran and how many tokens they used, actions that were blocked by a limit, and which paywall screens you reached.
• ·How you found us: when you sign up, the campaign tags in the link you first arrived on (for example utm_source), the referring website's domain, and the first page you saw. Saved once on your account so we can see which channels bring people in.
• ·Activity heartbeat: while a tab is open and you are active, the app sends a small ping so we can count the active seconds per day for your account.
• ·Support messages: the name, email, topic and message you send through the contact form, plus the page address and your browser's user-agent text, which the form attaches to help us reproduce problems.
• ·Waitlist: the email address you give if you join the waitlist.
• ·Email log: a record of which service and reminder emails we sent you and when.
• ·Rate-limit records: short-lived counters that use your account ID or, on public forms and the coupon check, your IP address, to stop abuse.
• ·Cached AI results: a copy of an AI result is kept for a short time so that an identical request is not run twice. See Retention.

Why we use it, and our legal basis

If you are in the EU, UK or a similar region, we rely on these legal bases:

We do not use your résumé, job or account data for advertising, and we do not make decisions about you that have legal effects through automated means.

AI and your data

On a managed plan, the résumé, job and salary content for each request is sent to Google's Gemini API to generate your result. We use the Gemini API on Google's paid API terms.

On a BYOK plan, that same content is sent directly to the provider you chose (Google, OpenAI, Anthropic, xAI, Mistral, DeepSeek or OpenRouter) using your key, under your account with them and their terms. Free tiers of some providers may keep your content and use it to improve their products, so check your provider's terms before you connect a key. DeepSeek processes data on servers in China. OpenRouter forwards your content to whichever model provider you pick.

To avoid paying for the same answer twice, we keep a copy of each AI result for a short time and reuse it if you make an identical request.

AI output can be wrong or incomplete. Check facts, dates and numbers before you send anything to an employer.

We do not sell your data and we do not use your content to train our own models.

Who receives your data

We share personal data only with the service providers that run the Service, and only what each needs:

• ·Supabase: database, sign-in and file storage (your account, content and photo).
• ·Vercel: hosting, plus Web Analytics and Speed Insights (page views and loading speed, no advertising profiles).
• ·PostHog (EU servers): cookieless product analytics. It receives the pages you view (addresses without their query strings, except campaign tags), how long you stay, the referring site, your browser and device type, and your IP address, which it uses to estimate your country and to count unique visitors with a hash that changes daily; it does not keep the IP address itself. It does not receive your name, email address, account ID or anything you write in Weydr.
• ·Google: the managed Gemini AI on managed plans, and Google sign-in if you use it.
• ·PayPal: payment processing at checkout. PayPal loads on the checkout page and sets its own cookies.
• ·Resend: sending our emails (receipts, reminders, support replies).
• ·Upstash: rate limiting (counters that may include IP addresses).
• ·ImprovMX: forwards mail sent to our support address to our inbox.
• ·LinkedIn: sign-in, if you use it.
• ·Your chosen AI provider, for BYOK users only: Google, OpenAI, Anthropic, xAI, Mistral, DeepSeek or OpenRouter, as described above.

We may also disclose data if the law requires it, or to protect our rights and users. If Weydr is ever sold or merged, your data may transfer to the new owner under this policy.

Where your data goes

Weydr is operated from India, and our providers run in the United States and other countries. Your data is therefore processed outside the country you live in. For transfers of EU or UK personal data we rely on the provider's Data Privacy Framework certification or Standard Contractual Clauses.

How long we keep it

Profile photo links are public by design: anyone who has the link can open the picture, so keep the link private. The photo is removed when you remove it or delete your account.

Your rights

Depending on where you live (including under the EU and UK GDPR, India's DPDP Act and California law) you can:

• ·Get a copy of your data (access and portability). Use Settings → Data & privacy → Download my data.
• ·Correct anything that is wrong. You can edit most of it yourself in the app.
• ·Delete your data. Delete your account yourself under Settings → Data & privacy. Your content is removed immediately. If an automatic deletion fails for any reason, we complete it within 30 days.
• ·Ask us to restrict how we use your data, or object to uses based on legitimate interests.
• ·Withdraw consent at any time (for example the optional emails or your photo). This does not affect what we did before.
• ·Complain to your data-protection authority. We would like the chance to fix it first, so please write to us too.

To use a right that you cannot use yourself in the app, write to support@weydr.com from your account email. We reply within 30 days.

BYOK key control: you can revoke or replace your connected provider key at any time from Settings → AI key.

California privacy notice

We do not sell your personal information and we do not share it for cross-context behavioral advertising. In the last 12 months we collected these categories: identifiers (name, email address, IP address), commercial information (your plan and payments), internet activity (usage and activity records), professional and employment information (your résumé and job data), and financial information (salary figures you choose to enter, used only to produce your results). You can ask to know, delete or correct your information, and we will not treat you differently for doing so. Use the contact below.

Cookies and local storage

We use essential cookies to keep you signed in. We store your light/dark theme choice and a flag that the intro animation has played in your browser's local storage. We do not use advertising trackers, and we do not set a cookie for partner or coupon codes: a code in a link stays in the page address and is used at checkout.

Vercel Web Analytics and Speed Insights are cookieless: they measure page views and loading speed without building profiles of you across other websites.

PostHog is also cookieless here: it sets no cookie and uses no local or session storage. It counts visits with a hash that changes daily, so it can't recognise you across days or follow you to other websites, and it never links your visits to your Weydr account. The record of how you found us is kept in memory in your open tab only (never in a cookie or browser storage) until you sign up, and then saved with your account.

Some pages load code from other companies, which can see your IP address and may set their own cookies: PayPal on the checkout page, and Google on the sign-in and sign-up pages if the Google button loads.

Security

Your account and content are stored with Supabase and protected by database access rules that tie each record to your account. BYOK keys are encrypted at rest with AES-256-GCM and decrypted only to make the AI call you request. Connections use HTTPS.

We use reasonable technical and organizational measures to protect your data, but no online service can guarantee absolute security.

Children

Weydr is for people aged 16 and over (18 where your local law sets a higher age). We do not knowingly collect information from anyone younger, and we will delete it if we learn we have.

Changes to this policy

We may update this policy as the product changes. We will update the date at the top of this page, and for material changes we will tell you by email or an in-app notice.

Contact and grievances

Questions, requests or complaints about your data: support@weydr.com. A named grievance officer will be added to this page when Weydr is registered.