Privacy Policy

This Privacy Policy explains what personal data Tailorline ("we") collects, why we collect it, how long we keep it, and the rights you have over it. It applies to the Tailorline service ("the Service") at tailorline.app ("the Site"). The Service is operated by Ahmad Mekkawi, Mansoura 35799, Dakahlia, Egypt.

We process personal data to provide and operate the Service. We do not sell your personal data to third parties, and we only use it for the purposes described below.

When you create an account we collect your email address, first name and last name, and optionally a phone number. We also store the content you create or upload with the Service (resumes, job descriptions, applications, cover letters and related content), along with your preferences and settings, including your content language.

We record usage data needed to run the Service: your plan, a credit ledger of grants and consumption, AI token usage, PDF export counts, and metadata about background jobs. AI requests are centrally managed through Tailorline's proxy, and we do not ask for or store third-party LLM provider API keys.

Effective September 24, 2026, encrypted copies of user-provided AI provider keys that had been stored locally were deleted. Future AI calls use Tailorline's managed models and your plan credits. If you previously used a provider key, you must revoke it directly with that provider; Tailorline cannot revoke upstream provider credentials.

Passwords are hashed and stored securely; we never store plaintext passwords. We keep you signed in with two httpOnly cookies: a short-lived access cookie (valid about 15 minutes) and a rotating refresh cookie that keeps your session active for up to 30 days. Google Sign-In lets you sign in with your Google account; we receive your name, email and a confirmation that the email is verified, and store a link to your Google account. Google's use of your data is governed by Google's own privacy policy.

The Tailorline browser extension pairs with your account through a device-authorization handshake: the extension generates a one-time challenge, and approving the connection on our authorize page (while you are signed in) binds a single-use grant to that challenge. Only a hash of the challenge is stored on our servers, the device credentials are delivered directly to the extension, and we keep only a hash of the device's api secret alongside a display name you approve. Pairing can also be completed with your email and password inside the extension. Every paired device is listed and revocable from your Profile, and changing your password disconnects all of them. When the extension detects a job description, it reads the page only at your explicit request (when you open the extension), and the posting text is sent to the Service so it can tailor your resume. When you use the form-filling feature, your resume data is placed directly into the job application page in your browser for you to review: the extension never submits forms on your behalf, and it does not send your data to any page other than the one the job was detected on.

We send transactional email to welcome you, verify your email address, and support password reset and email change. Email is sent via our provider, Lark Mail, from [email protected] (welcome emails) and [email protected] (verification, password reset and email change). We do not run a marketing mailing list and send only service-related messages.

Paid plans are handled by Polar, which acts as merchant of record. Checkout runs on our pages through Polar's embedded payment form; your card details go directly to Polar in its own frame, and we do not see or store them. We receive order and subscription information, including your email address, from Polar to provide your plan and credits. Polar's privacy policy governs its processing of your data.

We use Sentry to monitor errors so we can fix bugs. Sentry may capture technical error data such as stack traces; it is disabled unless a monitoring configuration is enabled and does not record replays or ad information.

We also count page views ourselves, on our own servers, with no third party analytics service, no advertising trackers and no third party analytics cookies. The counter runs only on our public pages — the marketing pages, these legal pages and the sign-in pages — and never inside the signed-in application, so nothing you do once you are logged in is counted.

Each page view is recorded as one aggregate row: the page you opened, the day it happened, a coarse device type, the country Cloudflare reports for the connection, any campaign parameters in the address, and the name of the site you came from. A referrer is reduced to a site name — never a full address, never a search term, never the contents of a link.

The visitor is an anonymous identifier that changes every day. It is derived from the day and your IP address with a keyed one-way hash, so it cannot be reversed, guessed by trying addresses, or matched to an account: a visitor count is an aggregate, not a person. We do not store IP addresses. The address is used once to derive that identifier and then discarded.

If your browser sends Do Not Track: 1, we honour it. The request is dropped on our side as well as yours, and no record of the visit is written at all.

Visit records are deleted automatically after 180 days, the default of our SITE_VISIT_RETENTION_DAYS setting, so this data is short-lived by design.

We keep your data while your account is active and you continue to use the Service. Background job records are purged automatically after about 30 days. Verification and account-recovery tokens expire within hours or days of being issued. The anonymous page view records described in section 08 are deleted automatically after 180 days by default, whether or not you have an account. You can close your account at any time, which permanently deletes your data as described below.

We process your personal data only where we have a legal basis to do so:

• Contract: to provide the Service you signed up for (accounts, resumes, tailoring, tracking, billing).
• Consent: where you give it, for example optional marketing emails. You may withdraw consent at any time.
• Legitimate interests: to keep the Service secure and reliable (fraud prevention, abuse detection, troubleshooting), balanced against your rights.
• Legal obligation: to comply with tax, accounting, and other laws that apply to us (our payment provider handles billing records as merchant of record).

We are based in Egypt, so your data is transferred to and processed there. Our subprocessors (hosting, email delivery, payment processing) may process data in other countries. Where data leaves the European Economic Area, we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses with our subprocessors.

You have the right to access the personal data we hold about you and to receive a copy in a portable format. You can download a copy of your data at any time from your Profile via"Download your data". You have the right to request deletion (the right to erasure): you can permanently delete your account and all associated data from your Profile via "Delete account". You also have rights to rectification, restriction and objection.

To exercise any of these rights, or if you have a question about our processing, contact us at [email protected]. We will respond within a reasonable time and, in the European Economic Area, within one month where required. You also have the right to lodge a complaint with your local data-protection supervisory authority.

We use two httpOnly cookies to keep you signed in: a short-lived access cookie and a rotating refresh cookie. The page-view counter described in section 08 sets one further httpOnly cookie, a random identifier that groups the page views of one browser into one visit session; it is not readable by scripts, it cannot be linked to your account, and it is only set when your browser does not send Do Not Track. We do not use third party cookies, advertising cookies or cross-site tracking.

The Service is not directed at children under 16 and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us so we can delete it.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by reasonable means. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

Questions, requests or complaints about this Privacy Policy or your data can be sent to [email protected] or to Ahmad Mekkawi, Mansoura 35799, Dakahlia, Egypt. EU data-protection representative enquiries are handled through the same contact.