Privacy
What we collect, who else touches it, and how long we keep it. In plain English first, because a policy nobody reads protects nobody.
Last updated 22 August 2026
The short version
We hold your resume and profile so an application can be filled in. Your resume only leaves Shortlist when you approve a specific application, and then it goes to that one employer. We do not sell your data, we do not pass it to recruiters, and we do not use your resume to train any model. You are the customer, not the product.
Who we are
Shortlist is operated from India by the maker of shortlistapp.co. For any privacy question, or to exercise any right below, write to hello@shortlistapp.co— see Contact.
What we collect
- Account details — your name and email address, from Google sign-in.
- Your profile and resume — the file you upload, the text extracted from it, and the answers you give during onboarding, including any equal-opportunity answers you choose to provide. Those answers are optional and you can decline them.
- Application records — which jobs were applied to, what was filled in, the outcome, and evidence of the submission (including screenshots of the form as it was sent) so a dispute about whether an application went out can be settled.
- Replies from employers — mail sent in response to an application, archived against that application and forwarded to your own inbox.
- Payment records — plan, amount and status. We never see or store your card or UPI details; those go directly to the payment provider.
- Technical logs — errors and performance traces, used to find faults. Personal content is redacted from them by default.
Who else processes it
Running this needs other companies. Each one below sees only what its job requires, and each is bound by its own contract with us.
| Who | What they do | What they see |
|---|---|---|
| WorkOS | Google sign-in | Your name and email |
| Neon | The database | Everything stored — encrypted at rest |
| Cloudflare | This website, and file storage | Your resume file and submission evidence, encrypted at rest |
| Oracle Cloud | The servers that run the apply engine | Data in transit while an application runs |
| Bright Data | The remote browser that fills forms | The form contents while it is being filled |
| Resend | Sending and forwarding mail | Message contents and addresses |
| Razorpay (India), Dodo Payments (elsewhere) | Taking payment | Your name, email and payment method — we do not |
| Anthropic | Drafting answers to application questions | The question and the relevant part of your profile |
| Sentry, Grafana | Error and performance monitoring | Technical logs, personal content redacted |
| LangSmith | Diagnosing the AI when an answer goes wrong | Records of AI requests — content redacted by default |
We do not sell personal data, and we do not share it with advertisers or recruiters. Naming these companies rather than writing "trusted partners" is deliberate — you cannot judge who holds your resume from a euphemism. It also means the list must stay true: if we add or change a processor that touches your data, this table changes with it.
Cookies
This site sets no advertising or tracking cookies, and there is no analytics script following you around it. The app at app.shortlistapp.co sets one cookie to keep you signed in — that is what it is for, and removing it signs you out. There is no cookie banner because there is nothing to consent to.
The one moment your resume leaves us
When you approve an application, your resume and your answers are submitted to that employer through their own application system — Greenhouse, Ashby, Workable, Rippling or similar. From that point the employer is the one holding your data, under their own privacy policy. That is the whole purpose of the product, and it never happens without your explicit approval on that specific application.
AI, and what it is not used for
An AI model drafts answers to questions an application asks. It is sent the question and the part of your profile needed to answer it. Your resume is not used to train anyone's model, and by default the content of those requests is redacted in our own monitoring. If the model cannot answer a question honestly, the application stops and asks you — it does not invent an answer.
How long we keep things
- Your account, profile and resume — until you delete your account.
- Application records and employer replies — until you delete your account, because they are your record of where you applied.
- Submission evidence — kept while it can still settle a dispute, then deleted.
- Technical logs — 14 days.
- Payment records — as long as tax and accounting law requires, which is longer than the rest and not ours to shorten.
Your rights
You can ask for a copy of your data, ask us to correct it, or ask us to delete it. Deleting your account removes your profile, resume and application history. Write tohello@shortlistapp.co and we will act within 30 days.
If you are in California, you may ask what personal information we collect, ask for a copy, ask us to delete it, and ask us to correct it. We do not sell or share personal information as those words are defined by the CCPA, so there is nothing for you to opt out of — and we will not treat you differently for asking.
If you are in the EU or UK, our basis for processing is performing the contract you signed up for — and consent for the optional equal-opportunity answers, which you can withdraw at any time. If you are in India, the same rights apply under the Digital Personal Data Protection Act.
Security
Data is encrypted in transit and at rest. Access to the production database is limited to the people who operate the service. Sign-in is handled by Google, so we never hold your password, and payment details never touch our servers. No system is perfect: if we ever discover a breach affecting your data, we will tell you and the relevant regulator without waiting to be asked.
Children
Shortlist is not for anyone under 16, and we do not knowingly collect their data.
Changes
If this policy changes in a way that affects you, we will say so by email before it takes effect — not by quietly editing this page and changing the date at the top.
Shortlist is a small, independent product. This policy describes honestly what the system does today, but it has not been reviewed by a lawyer — if you need a formal data-processing agreement, write to us and we will sort one out properly.