Privacy Policy

The short version

Funded Drop reads job postings so you don't have to. To do that it needs to know what you're looking for, which means it holds your CV and a written brief about your search. We don't sell that to anyone, we don't advertise against it, and you can delete all of it from Settings at any time.

Who is responsible

The data controller — the person responsible for how your data is handled — is Pavel Malyshev, an individual entrepreneur based in Prague, Czech Republic, operating Funded Drop. For anything in this policy, write to privacy@funded-drop.app.

What we hold

• Your email address — it's your sign-in identity and where sign-in links go.
• Your CV, if you upload one: the PDF itself, plus a written summary of it produced by an AI model.
• Your profile brief — the answers you gave during onboarding and the brief composed from them (target roles, seniority, locations, salary floor, dealbreakers).
• Your activity in the app — which matches you saved, tagged, opened, marked applied, the feedback you typed on a card, application kits generated for you, and any issue report or screenshot you send us.
• Your Telegram chat ID, if you connect Telegram, so cards can be delivered there.
• Product events — timestamps of milestones like signing up, uploading a CV or tapping a verdict, so we can see where the product fails people.

We do not use tracking cookies, advertising pixels or third-party analytics. The only cookie is the one that keeps you signed in.

What we do with it

Your brief and CV summary are compared against job postings we crawl from public company career boards. Some of that comparison is plain code; some of it is done by AI models, which means the relevant parts of your brief, your CV summary and a job description are sent to the model provider to be evaluated. Model providers are contractually barred from training on that data.

We never apply to a job on your behalf. When the app drafts an application kit, it is a draft for you to read, edit and send yourself. Nothing is submitted to an employer by us, ever.

Who else sees it

These are the only third parties involved, and each sees only what it needs:

• Cloudflare — hosting, database and file storage. Everything above lives here.
• Anthropic — the AI models that read job descriptions, summarise your CV and draft application kits.
• Resend — sends your sign-in links and email digests.
• Telegram — only if you connect it, and only to deliver your cards.

We do not sell personal data, and we do not share it with employers, recruiters or advertisers.

Where it goes

Some of those providers process data outside the EU:

• Anthropic (United States) — certified under the EU–US Data Privacy Framework, with standard contractual clauses as backup.
• Resend (United States) — certified under the EU–US Data Privacy Framework, with standard contractual clauses as backup.
• Cloudflare — runs a worldwide network, so storage and processing can happen wherever its infrastructure is; transfers are covered by standard contractual clauses.
• Telegram — only if you choose to connect it; delivery to your chat is governed by Telegram's own privacy policy.

The waitlist

If you join the waitlist on our landing page, we store the email address you gave, the market you picked, whether you asked for early access, the note you typed if you left one, and a one-way hash of your network address that we keep to prevent abuse of the form. We use this for one purpose: emailing you about beta access and, when billing opens, about the founding pricing the form mentions. The legal basis is the consent you give by ticking the box, and you can withdraw it at any time — reply to any email from us, or write to the address below, and your entry is removed. Waitlist entries that never become accounts are deleted within twelve months.

How long we keep it

For as long as your account exists. Sign-in links expire after 15 minutes. Job postings and their labels are shared reference data about the market, not about you, and are kept independently of any account.

Deleting your data

Settings → Danger Zone → Delete account removes, immediately and permanently: your account record (email, brief, profile, CV summary), your uploaded CV file, every match, verdict, tag, note and application kit tied to you, your issue reports and their screenshots, your push subscriptions, your waitlist entry if you had one, and any outstanding sign-in links. It cannot be undone. Residual copies in our hosting provider's rolling backups expire within 30 days. Job postings themselves are not personal data and stay.

If you'd rather ask a human, or want a copy of what we hold about you, email the address below.

Your rights

If you're in the EU or UK you have the right to access, correct, export, restrict or erase your personal data, and to object to how it's processed. The legal basis for processing is the contract you enter by using the service, plus your consent for the AI processing of your CV. Withdrawing consent means deleting your account, because the service cannot function without it.

You also have the right to complain to a data protection authority. Ours is the Czech Office for Personal Data Protection (ÚOOÚ, uoou.gov.cz); you can equally complain to the authority in your own country.

Contact

Privacy questions and data requests: privacy@funded-drop.app.