Privacy Policy

The short version

Funded Drop reads job postings so you don't have to. To do that it holds your CV and a written brief about your search. We use them to find you roles, and for nothing else. We don't sell your data, we don't advertise against it, and you can delete all of it from Settings at any time.

Who is responsible

The data controller is Pavel Malyshev, Czech Republic, operating Funded Drop. For anything in this policy: contact@funded-drop.app.

What we hold

• Your email address: your sign-in identity, and where sign-in links, matches and reports go.
• Your CV, if you upload one: the PDF file, plus a written summary of it produced by an AI model. We don't need your photo, date of birth or anything sensitive, such as health, religion or political views. Please leave them out of the CV you upload, so they never reach our systems or the AI models.
• Your search rules (Free and Paid): where you can work, level, salary floor, function, visa and languages.
• Your brief (Paid): your onboarding answers and the brief composed from them (target roles, level, where you can work, salary floor, dealbreakers).
• Your matches and what you do with them: the roles we matched to you and our reasoning; what you saved, tagged, promoted, rated, marked applied or wrote in feedback; the application kits drafted for you; and, on Paid, your weekly reports.
• Quality checks: a second AI review of a sample of your matches, which we use to measure and fix match quality.
• Delivery details, only if you turn them on: your Telegram chat ID, and your browser's push-notification subscription.
• A record of the emails we've sent you, so we don't send duplicates and can honour unsubscribes.
• Product events: what you do in the app, with timestamps. For example, where you came from when you signed up (the referring site or campaign link), opening, rating or starring a match, asking for a kit, using tags and saved views, editing your search, and coming back from one of our notifications. We use them, in our own database and in totals across all users, to see where the product fails people and what helps.
• Issue reports, with any screenshot you attach.
• Billing status: whether you have an active subscription, plus the customer and subscription IDs Dodo Payments gives us. We never see or store your card details. Dodo Payments holds those.

We don't use tracking cookies, advertising pixels or third-party trackers, and our emails carry no tracking pixels. Links in our emails and notifications say which message they came from, so we can count returns. On our website, we count visits with Cloudflare Web Analytics, which sets no cookies and doesn't follow you across sites. On the sign-up page we also count, without any identifier, how far people get through the form: which steps are reached and which fields are left empty, as daily totals by campaign. We never record what you type. Our only cookie is the one that keeps you signed in. While you're checking out, the Dodo Payments checkout sets the cookies it needs to process your payment and prevent fraud, under Dodo Payments' own privacy policy. None of these cookies track you or feed analytics.

What we do with it, and why we're allowed to

• Running the service you signed up for (matching, drafting kits, delivering matches and reports, billing): this is necessary to perform our contract with you (GDPR Art. 6(1)(b)).
• Telegram and push notifications: your consent, given when you turn them on. Turn them off anytime and nothing else changes.
• Product events, website visit and sign-up form counts, quality checks and abuse prevention: our legitimate interest in a service that works, improves and isn't abused (Art. 6(1)(f)). You can object at any time (see Your rights).

We never apply to a job on your behalf. Application kits are drafts for you to read, edit and send yourself.

How the matching works

Your brief is compared against job postings from public company career pages. Some of that comparison is plain code: location, level and salary rules. Some of it is done by AI models, which read the posting and the relevant parts of your brief and CV summary, then grade the fit. This decides which roles we show you, nothing more. It makes no decision about you with any legal or similar effect, and you can always see the reasoning, push a near miss back up, or tell us we got it wrong.

Who else processes it

We don't sell personal data, and we don't share it with employers, recruiters or advertisers.

If you joined our old waitlist

We hold the email address you gave, the LinkedIn profile URL you entered, the market you picked, whether you asked for early access, any note you left, and a one-way hash of your network address (for abuse prevention), on the basis of the consent you gave on the form. We use it only to tell you about access. Reply to any email from us to be removed. Entries that never become accounts are deleted within 12 months of sign-up.

How long we keep it

• Your account data: for as long as your account exists.
• Sign-in links: they expire after 15 minutes. Invitation links we send personally expire after 24 hours.
• Product events and quality checks: deleted with your account. Totals across all users that can't identify anyone may be kept after that.
• Billing records: Dodo Payments keeps invoices and payment records for as long as tax law requires. That's Dodo Payments' legal obligation, and it outlasts your account.
• Backups: residual copies in our hosting provider's rolling backups expire within 30 days of deletion.
• Job postings and their labels are market data, not data about you, and are kept independently of any account.

Deleting your data

Settings → Danger Zone → Delete account removes, immediately and permanently: your account (email, brief, CV summary, billing status), your CV file, every match, rating, tag, note, kit and weekly report, your quality checks, product events, email records, issue reports and screenshots, your push subscriptions and Telegram link, and any outstanding sign-in links. Deletion also cancels an active subscription, so you're not charged again; Paid ends at once. It can't be undone.

If you sent your CV or messages to our Telegram bot, the copies inside your Telegram chat are held by Telegram, not by us. Deletion removes our copy and everything we derived from it. To remove the Telegram copy, delete the messages in the chat.

Want a copy of what we hold, or rather ask a person? Email contact@funded-drop.app.

Your rights

If you're in the EU or UK, you can access, correct, export, restrict or erase your personal data, object to processing based on legitimate interest, and withdraw any consent you've given (for Telegram or push) at any time.

You can also complain to a data protection authority. Ours is the Czech Office for Personal Data Protection (ÚOOÚ, uoou.gov.cz), and you can equally complain to the authority where you live.

Changes

If this policy changes materially, we'll tell you in the app or by email before the change applies.

Contact

contact@funded-drop.app