Privacy Policy

1. Who we are

Guap ("we", "us", "our") operates the Guap platform and the Barista browser extension. We are the data controller for the personal data you provide through our services.

2. What data we collect

• Account data: name, email address, profile photo, role (job seeker, business, university).
• Profile data: education history, work experience, skills, CV/resume content, job preferences, and other fields you choose to store in your Guap profile.
• Application data: information you fill through the Barista extension, including form field values and the URLs of job applications you complete.
• AI-generated content: text drafted by our AI assistant based on your profile, CV, and job descriptions you provide.
• Usage data: extension interactions, pages visited on supported ATS platforms, feature usage, and performance metrics.
• Technical data: browser type, extension version, IP address, and device identifiers.

3. Sensitive data (EEO / diversity)

If you choose to store answers to diversity and equal-opportunity questions (such as race, ethnicity, gender identity, disability status, or veteran status), we only do so with your explicit, separate consent. You can withdraw this consent at any time through your profile settings. This data is classified as special-category data under Article 9 of the GDPR and is processed only on the basis of your explicit consent.

4. How we use your data

• To provide autofill functionality through the Barista extension
• To generate AI-powered draft answers for application form fields
• To improve our matching algorithms and extension features
• To manage your subscription and process payments
• To communicate with you about your account and our services
• To comply with legal obligations

5. Legal basis (GDPR)

• Contract performance: providing the autofill service you signed up for
• Consent: AI processing of your data, storage of sensitive/EEO data, and optional marketing
• Legitimate interest: improving our services, fraud prevention

6. Data sharing

We share data with these processors under Data Processing Agreements:

• Neon (PostgreSQL hosting, EU region)
• OpenRouter (AI model inference, configured for no-retention)
• Cloudflare R2 (object storage for CV bytes, EU region)
• Stripe (payment processing)
• Railway (application hosting)

We do not sell your personal data to third parties.

7. Data retention

We retain your data for as long as your account is active. Upon account deletion, your data is purged within 30 days. AI generation logs are retained for 90 days for quality improvement, then anonymized.

8. Your rights

Under the GDPR, you have the right to:

• Access: request a copy of your data via our export feature (XML format)
• Rectification: edit your profile data at any time
• Erasure: request deletion of your account and associated data
• Restriction: limit how we process your data
• Portability: receive your data in a structured, machine-readable format
• Objection: object to processing based on legitimate interest

To exercise these rights, use the settings in your account or contact us at [email protected].

9. Security

We implement appropriate technical and organizational measures, including encryption at rest for sensitive data, bearer-token authentication, and least-privilege access controls. The Barista extension stores your authentication token only in the background service worker - content scripts never have access to it.

10. International transfers

Your data is stored on servers in the European Union. Where we use processors outside the EU, we rely on Standard Contractual Clauses or adequacy decisions.

11. Changes to this policy

We will notify you of material changes via email or through the extension. Continued use after changes constitutes acceptance.

12. Contact

Data Controller: Guap - [email protected]