Privacy Policy

What this covers

How Y.EAA handles information about you: what it collects, what it does with it, who else touches it, and how long any of it stays. It covers the Y.EAA web application and the opportunity-search service behind it.

Your resume and your answers are this product's entire input, so most of what follows exists to keep them yours.

What we collect

Account and identity: your email address, and an internal identifier we generate for you. If you sign in through an identity provider we record that the provider vouched for you — never their credentials, and never ongoing access to that account. Signing in with Google gives Y.EAA no access to your Google account.

Your resume: the file you upload, and the structured profile extracted from it — contact details, work history, education, skills.

What you are looking for: saved roles, salary and location preferences, and your answers about authorisation to work.

Reusable answers: the answers you write once and reuse across applications, kept separately from any answer already submitted.

Your activity: the searches you ran, the opportunities found for you, why each was ranked as it was, and the applications you tracked.

Operational records: request identifiers, timings, error reports, and sign-in events, kept so a failure can be diagnosed.

What we do with it

Run the product for you — search, rank, explain, prepare, and track.

Keep your account secure and your sessions revocable.

Find and fix failures, and keep the service running.

Nothing else. We do not build an advertising profile of you and we do not use what we hold to market other products at you.

What we never do

We do not sell your personal information, and we do not share it for advertising of any kind.

We run no analytics, advertising, or session-recording trackers. There are none in the product to turn off.

We do not use your resume, your answers, or your applications to train our own models.

We do not fetch a document from a web address you hand us. A resume reaches us because you uploaded the file, which is a narrower and safer capability than following a link.

We do not put resume text, your answers, or application content into operational logs. An error report carries a one-way digest of your account identifier, the route that failed, and which release it failed on — never content.

Artificial intelligence, and what leaves our systems

Reading a resume, and drafting an answer for you, are done by a large-language-model provider we send the relevant text to. That provider is currently DeepSeek.

Only what a task needs is sent, and it is sent so the result can be returned to us. The provider is not somebody we share your information with for purposes of their own.

Anything a model produces about you is a draft attributed to the model, never a fact about you. Where the product shows a claim as coming from your resume, it can point at the passage it came from.

Who else handles it

Listed by the job they do, because that is what determines what they see: a hosting and database provider; private object storage for the files you upload; an email service that delivers sign-in codes; whichever identity provider you choose to sign in with; the AI provider named above; an error-reporting endpoint; and, once payments exist, a payment processor.

Each of them acts on our instructions and for the purpose we engaged them for. None receives your information to use for itself.

We will also disclose information where the law requires it, and we will tell you when we are permitted to tell you.

Where it is stored

In managed services we contract for, in the regions those services run in. Some of the providers above operate outside your country, so your information may be processed elsewhere. Where the law requires a safeguard for that transfer, we put one in place.

How long we keep it

Your resume file, the profile extracted from it, your saved roles, and your answers stay while your account is open. Delete a resume and the stored file goes with it; end your account and all of it goes.

Your search results and application history stay while your account is open, because their whole purpose is to tell you what you have already done.

Operational records are kept only as long as they are useful for diagnosing faults, then discarded.

Records we are obliged to retain — payment and tax records, once payments exist — are kept for the period the law sets and no longer.

Backups expire on their own cycle, so a deletion reaches a backup when that backup ages out rather than at the moment you ask.

Your choices

You can see what we hold, correct it, take a copy of it, and have it deleted. Most of it you can reach and change inside the product; for the rest, ask us.

We will confirm a request really came from you before acting on it. That check exists so that nobody else can download or destroy your job search.

Depending on where you live you may have further rights — to object, to restrict how we process something, or to complain to a regulator. Using any of them costs nothing and we will not treat you differently for it.

Automated decisions

Y.EAA ranks opportunities against your profile and judges whether an application is one it could fill. Those automated decisions shape what you are shown; they produce no legal or similarly significant effect on you, and no employer's decision is made by us.

An action with consequences — one that reaches an employer or spends your money — is never taken automatically on the strength of an account-level setting. It requires a confirmation from you for that action, checked on our servers at the moment it runs.

Keeping it safe

Traffic is encrypted in transit. Uploaded files are held in private storage, are checked against a size limit and confirmed to be the file type they claim to be, and the links that reach them are short-lived.

Every record is read through a query already narrowed to your account, so another customer's row is never loaded and then filtered out — it is never loaded.

Sessions are records in our own database rather than self-contained tokens, which is what makes signing out a revocation that takes effect on the next request.

Children

Y.EAA is for adults looking for work. It is not intended for anyone under 16, and we do not knowingly collect information from them.

Changes to this policy

This policy is versioned, and the version is the date it took effect. This is version 2026-08-08.

When we publish a new version we state whether it requires your agreement again, and where it does, the actions that depend on it pause until you give it while the rest of your account carries on working.

Contact

Questions, or a request about your information: privacy@yeaa.ai.