What we collect, why, and what we never do.

Effective September 11, 2026. Updated September 29, 2026: we read the public pages a resume links to (see Public pages a resume links to). Updated September 25, 2026: web sourcing replaces the candidate library pilot. Resumes we find on the web are now found for one account at a time and seen only by that account and its organization. This update also describes what we keep and discard, our internal search statistics and evaluation copy, the new removal page, and SerpApi as our search provider. The September 24 update added screen-size counts and return visits. Recruiter Autopilot ("we") is run by Thomas Jumper. Questions to [email protected].

The short version

• The open demo keeps your files in your browser. Only the text pulled out of them goes to our AI provider to be parsed, ranked, or drafted. We do not store demo data on our side.
• If you join the waitlist we store your email and what you tell us on the form. If you open an account, we also store what you put in your workspace so it follows you between devices.
• We never send email to a candidate on your behalf, and never use the candidates you import for anything but your own workspace.
• When you add a job order, we can search the public web for resumes that fit it, for you alone. What we find is seen only by your account and your organization. That section says where those resumes come from, what we keep, what we throw away, and how anyone can remove themselves.

What we collect

• Waitlist: email address, and if you give them, your name, agency, organization size, and where your candidates live today. We record the country of the network you signed up from, the signup time, and your place on the list.
• Account: the answers from the setup questions (name, agency, organization size, roles you fill, biggest time sink, placements a month, scheduling link), when you signed in, and whether you unsubscribed from email.
• Workspace: the candidate records you import, including the text extracted from resumes, your job descriptions, the shortlists and outreach drafts we generate, placements you record, and your settings. This is stored so your workspace is the same on any device.
• Usage counts: how many times a day the site was opened, a search was run, resumes were uploaded, or drafts were made. These are plain daily totals. Each count also notes whether the screen was phone, tablet, or desktop sized, judged from its width alone. For signed-in accounts that use web sourcing, the same counts are also kept per account under an anonymous code, so we can see whether web sourcing is useful.
• Return visits: on your first visit your browser stores a random ID in this site's local storage. It carries no name, email, or network address. Against that ID we keep, for each visit, its date, the link tag that brought you (the ?src= or ?ref= part of the address), the name of the site that sent you if your browser shares it (only the site, such as linkedin.com, never the page), your screen-size class, and which steps of the demo you took. If you join the waitlist or ask for a sign-in link from that browser, the ID is saved with your signup, so we can see which visits led to it. Clearing this site's data in your browser removes the ID.
• Technical: your network address is used to rate-limit signups and AI calls. Those counters expire within two days. We set a cookie that keeps you signed in, and two cookies that last only until you close your browser: one marks a visit, and one lets the demo start fresh each time. There are no advertising or third-party tracking cookies.

Retired optional landing-page counters

The optional landing click, section and scroll-depth counters were disabled on October 9, 2026. The consent card and measurement preferences control have been removed. New requests to that collector are rejected, including requests from older open pages.

Previously collected daily totals remain in our existing Cloudflare database. Those aggregates contain a landing-page version and phone/tablet/desktop width class, with no visitor IDs, individual journeys, page text, coordinates, URLs, referrers, filenames or candidate contents. Earlier allow/decline preferences may remain in your browser until they expire or you clear them; they do not enable collection. Existing usage and return-visit analytics described above are separate and unchanged.

What we do with it

• Run the product: parse resumes, rank candidates against job descriptions, draft outreach, and keep your workspace in sync.
• Email you about your waitlist place, your access, sign-in links, and, if you use web sourcing, new matches for your open job orders. Every email except a sign-in link you asked for carries an unsubscribe link.
• Protect the service from abuse and keep the bill for our AI usage sane.

Who else touches the data

• Cloudflare hosts the site and stores waitlist, account, and workspace data on its network.
• Anthropic provides our AI. Extracted text is sent to it to be parsed, ranked, or drafted, under commercial terms that do not allow it to train models on that data.
• Resend delivers our email and tells us if a message bounced.
• SerpApi runs the web searches for web sourcing and processes the search queries we send it on our behalf (SerpApi legal terms). It receives search queries only, built from your job orders, and no data about your candidates. Serper does the same job as a fallback, with the same limits, when SerpApi is not available.

Nobody else processes your data. We do not sell or rent the data you put in your workspace, and we do not share any data with advertisers. Resumes we find on the web for you are described in their own section below.

Resumes we find on the web for you

When you upload or paste a job order, Recruiter Autopilot can search the public web for resumes that fit it. It does this for your account only. This section applies both to you and to the people whose resumes we find.

How we find them

• We build search queries from your job order, such as a job title, skills, and a city, and run them through a search provider. SerpApi is our search provider, and Serper is the fallback. They receive the search queries only.
• We fetch only public PDF resumes that the search engine returned. We never log in, never bypass any access control, and never crawl a site by following its links. We do not buy data, and we do not take resumes from job boards, social networks, or any site that requires an account.
• Our software identifies itself as RecruiterAutopilotBot/1.0 (+https://recruiterautopilot.com/remove/; [email protected]), follows each site's robots.txt instructions, and limits how often it asks any one site for files.
• We keep a find only if it reads as one real person's own resume with a name, an email address or phone number, and a work history, and only if the person appears to be in the United States. We skip resumes from the European Union and the United Kingdom. Templates, samples, job postings, directories, and documents listing several people are discarded.
• While a job order is open, we re-run its searches once a week. We may email you about new matches, no more than once a day. Every such email has an unsubscribe link.

What we keep: facts, not files

• Identifiers: name, email address, and phone number as shown on the resume.
• Work and education facts: job titles, employers, dates, skills, education, and location.
• One short quoted line from the resume, used as the evidence line for a match.
• Source information: the web address of the PDF and the date we found it.

That is all. After the facts are pulled out, we discard the PDF and its full text. We never store a paraphrase of the whole resume. The text of a fetched resume is sent to our AI provider (Anthropic) to pull out these facts and to rank the find against your job order, under commercial terms that do not allow it to train models on that data. We do not seek out sensitive information such as government identification numbers, health, religion, or immigration status, and we do not keep it.

Who sees a web find

• A web find belongs to the account whose search found it. Only that account, and the members of its organization, can see it.
• Nothing about a person crosses between accounts. If two recruiters find the same resume, each has a separate copy, and neither can see the other's.
• Notes, tags, and pipeline statuses a recruiter adds to a person are that recruiter's own, like any other record in their workspace.
• We do not sell web finds or share them with other businesses.

What we keep across accounts

• Search statistics: across all accounts, we record which search query patterns, website domains, and keywords produce qualifying resumes, so searches get better. These statistics hold no names, no addresses of individual resumes, and no facts about any person.
• An internal copy for evaluation: we keep an internal copy of web finds, with the same facts-only fields listed above, to evaluate and improve how we find and rank resumes. Only our administrators can open it, and every access is logged. It is never shown to any account and never used to produce any account's results.
• Our own scheduled searches: we run searches for common roles on a schedule, not for any account. By default these record only the search statistics above and discard every person they find. We can switch them to keep the same facts in the internal copy, under the same rules. They never add anyone to any account's results.

How long we keep it

• A web find stays in an account until the account deletes it, the person asks to be removed, or the account closes.
• The internal copy keeps a find until the person asks to be removed.
• When someone is removed, we keep only their email address, phone number, the address of the file, and a fingerprint of the file, in a block list, solely so we never collect them again. Tell us if you would rather we delete those too, with the understanding that we could then find the same resume again.

Your rights if we found your resume

• Remove yourself and stay out: use the form at recruiterautopilot.com/remove with the email address or phone number on your resume, or the address of the PDF. You do not need an account or a reason. We delete you from every account's web finds and from the internal copy, and add you to the block list so you are not collected again. The form does this immediately. If you email us instead, we do it within one business day.
• Know what we hold, get a copy, or correct it: email [email protected]. We respond within 45 days and may ask you to confirm that the email address or phone number on the resume is yours.
• You may use an authorized agent to make any of these requests. We will not treat you differently for using any of these rights.
• A recruiter's own private notes about you stay with that recruiter after removal, in the same way they would if the recruiter had found your resume themselves. You can ask that recruiter directly to delete them.

Website owners who would rather we never fetch files from their site can block RecruiterAutopilotBot in robots.txt or email us.

Your candidates' data

In an organization account, members of the same organization can see the shared candidates, job orders, and pipeline statuses, including who added records and changed a status. Personal account settings remain separate.

When you import resumes, you are the one who collected them and you are responsible for having a proper basis to hold them. Resumes we find on the web for you follow the rules in the section above. We process that data only on your instructions and only for your workspace. Deleting a candidate removes their active profile on the next successful save. Placement snapshots and pipeline history may remain on associated job orders. Contact us for an erasure request that also covers retained history and recovery copies.

Public pages a resume links to

When a resume lists links, such as a GitHub profile, a portfolio site, a Substack, or a Stack Overflow profile, we read those public pages to add job-relevant facts to the candidate's profile: counts, project names and descriptions, languages, recent posts and dates, each shown with a link to where it came from. We read only pages the candidate chose to list, only what is public, and in the way each site allows: through its official interface or public feed where it has one, and otherwise only if the site's robots.txt permits it, identifying ourselves as RecruiterAutopilotBot. We never read LinkedIn (its terms don't allow it) or social media accounts, and nothing is written or guessed by AI. We keep the extracted facts on the candidate's record in your workspace, and a copy of each page's facts, not the page, for up to a week so the same page isn't read again. They are removed with the record.

Notes and meeting transcripts added to a candidate or job order are visible to everyone in the organization and are sent to our AI provider to produce summaries and to suggest profile updates, which are applied only when a person in your organization accepts them. Notes and summaries are included in exports and backups and removed from active storage when the associated record is deleted; recovery copies follow the retention periods below.

How long we keep it

• Waitlist entries until you ask us to remove them.
• Workspace data until you delete the candidate, the job order, or the account.
• Web finds until the account deletes them, the person asks to be removed, or the account closes. The internal copy until the person asks to be removed. Search statistics hold no personal information and are kept as long as they are useful.
• Short-lived backups of workspaces for up to 15 days, so a mistake can be undone.
• During a storage upgrade, we retain the original workspace as a recovery copy until it is reviewed and retired. Requests to erase data also cover these recovery copies.
• Rate-limit counters for up to two days; sign-in links for 30 minutes.
• Return-visit records for up to 400 days after the last visit.

Your choices

• Unsubscribe from email with the link in any message. Your place on the list is kept.
• Ask for a copy of your data, or ask us to delete your waitlist entry, account, or workspace, by emailing [email protected] from the address on the account. We do it by hand within a few days and confirm when it is done.

Other things worth saying

• This is an early-access product run by a small organization. Data lives on Cloudflare's network, which may store it in the United States and other countries.
• The service is for working recruiters and is not directed at anyone under 18.
• If this policy changes in a way that matters, we will email everyone on the list before it takes effect.