Privacy Policy
Last updated: May 17, 2026
This policy is compliant with GDPR (EU), CCPA (California), and PIPEDA (Canada).
1. Data Controller
American Software Group (“ASG”, “we”, “us”) is the data controller for personal data collected through our platform. We are registered in the State of Missouri, USA.
For EU/EEA users, ASG serves as data controller under Article 4(7) GDPR. For UK users, we are registered under the UK GDPR.
2. Data We Collect
Account Data
- Name, email address, phone number
- Authentication credentials (hashed)
- User type (job seeker / employer / trainer)
- Account preferences and settings
Profile Data (Job Seekers)
- Resume content and work history
- Skills, education, certifications
- Salary expectations and job preferences
- ATS scores and AI-generated resume content
- Mock interview transcripts and evaluation scores
Usage Data
- Pages visited, features used, time spent
- Job searches, applications submitted
- IP address, browser type, device information
- Auto-apply audit logs (when enabled)
3. Legal Basis for Processing (GDPR)
Contract Performance (Art. 6(1)(b))
Processing necessary to provide the Service — account management, job matching, subscription billing.
Legitimate Interests (Art. 6(1)(f))
Platform security, fraud prevention, service improvement, analytics.
Consent (Art. 6(1)(a))
Marketing communications, Auto-Apply consent, optional analytics cookies.
Legal Obligation (Art. 6(1)(c))
Tax records, regulatory compliance, law enforcement requests.
4. How We Use Your Data
- Provide and improve the Service
- Match job seekers with relevant job opportunities
- Generate AI-powered resume and interview content
- Process payments and manage subscriptions
- Send transactional emails and job alerts (with consent)
- Detect and prevent fraud and abuse
- Comply with legal obligations
5. Data Sharing
We share personal data only in the following circumstances:
- With Employers: When you apply to a job, your profile is shared with that employer
- Service Providers: Supabase (auth/database), Stripe (payments), AWS S3 (file storage), Twilio (SMS), Anthropic (AI processing)
- Legal Requirements: When required by law or valid legal process
- Business Transfer: In connection with a merger or acquisition (with advance notice)
We do not sell your personal data to third parties for marketing purposes.
6. Your Rights
Access
Request a copy of your personal data
Rectification
Correct inaccurate personal data
Erasure
Request deletion of your data ('right to be forgotten')
Portability
Receive your data in a machine-readable format
Restriction
Restrict processing of your data
Objection
Object to processing based on legitimate interests
Withdraw Consent
Withdraw consent at any time without affecting prior processing
CCPA Rights
California residents: right to know, delete, and opt-out of sale
To exercise your rights, email privacy@americansoftwaregroup.com. We respond within 30 days.
7. Data Retention
We retain account data for the duration of your account plus 2 years. Application and auto-apply data is retained for 3 years for legal compliance. You may request earlier deletion by contacting us.
8. International Transfers
Data is processed in the USA (primary), EU (Supabase EU region available on request), and India (development operations). For EU transfers, we rely on Standard Contractual Clauses (SCCs) under GDPR Article 46.
9. Contact & DPO
Data Protection Officer
privacy@americansoftwaregroup.com
American Software Group, St. Louis, MO, USA
EU residents may also lodge complaints with your local supervisory authority.