Privacy Policy

1. Data Controller & Contact Information

This Privacy Policy applies to the Offer Every Day software application, accessible via web browser at offereveryday.app, and its mobile applications on Google Play and Apple App Store (collectively, the "Service").

Under the EU General Data Protection Regulation (Regulation (EU) 2016/679 - "GDPR"), the Data Controller responsible for your personal data is:

2. Information We Collect

We collect information to deliver, optimize, and secure our career management tools. This includes:

• Account Information: Full name, email address, password hash, and profile preferences when you register or sign in using email or OAuth providers (Google, GitHub, LinkedIn).
• Resume, Profile & Career Data: Work history, education, skills, certifications, contact details, uploaded resume files (PDF, DOCX), tailored cover letters, and application notes that you create, edit, or upload into the application.
• Job Descriptions & URL Links: Job descriptions, target employer names, job postings, and URLs you submit for AI matching and compatibility scoring.
• Payment & Transaction Data: When purchasing Pro or Power subscription tiers, payment card details and transactions are processed directly by our secure payment provider, Stripe, Inc. We never store complete credit card numbers or security CVV codes on our servers.
• Technical, Device & Usage Information: Device type, operating system version, browser type, IP address, referral URLs, language preference, and system logs recorded during server interactions to ensure reliability and fraud prevention.

3. Legal Basis for Processing (GDPR Art. 6)

In compliance with GDPR Article 6, we process your personal data under the following lawful grounds:

• Performance of a Contract (Art. 6(1)(b)): Processing necessary to provide our core services, such as generating tailored resumes, scoring job matches, maintaining your account, and fulfilling subscription benefits.
• Legitimate Interests (Art. 6(1)(f)): Processing necessary for product security, preventing fraudulent use, debugging technical issues, and enhancing the application experience.
• Consent (Art. 6(1)(a)): Specific optional actions, such as receiving optional promotional newsletters or granting specific device permissions on mobile devices. You may withdraw consent at any time.
• Compliance with Legal Obligations (Art. 6(1)(c)): Retaining invoices and transaction records to comply with accounting, tax, and regulatory requirements.

4. AI Processing & Resume Analysis

Offer Every Day utilizes advanced Artificial Intelligence and language model processors (including secure cloud-hosted models) to parse job descriptions, highlight relevant skills, calculate match scores, and draft tailored application content.

5. How We Use Your Information

We use collected data strictly for the following purposes:

• Creating, authenticating, and maintaining your account.
• Generating, formatting, exporting (PDF/DOCX), and saving your resumes and cover letters.
• Analyzing job requirements against candidate profiles to provide real-time ATS scoring.
• Processing subscription upgrades, quota limits, and billing transactions.
• Sending critical transactional communications (email verification, password resets, security notices).
• Defending against security attacks, automated abuse, and ensuring platform stability.

6. Third-Party Processors & Data Sharing

We do not sell, rent, or trade your personal data. We disclose data solely to trusted sub-processors necessary to run the Service:

7. International Data Transfers

When data is transferred outside the European Economic Area (EEA), we ensure adequate protection standards are applied in accordance with GDPR Chapter V, relying on:

• European Commission Standard Contractual Clauses (SCCs).
• EU-U.S. Data Privacy Framework (DPF) adequacy decisions where applicable.
• Technical security measures including end-to-end transport encryption (TLS 1.3) and AES-256 data encryption at rest.

8. Data Retention & Deletion

We retain your data for as long as your account remains active. You may delete individual resumes, uploaded documents, or your entire account at any time through the application settings or by contacting saad.zgm@gmail.com.

Upon account deletion, all personal data, resume records, and generated documents are permanently deleted or irreversibly anonymized within thirty (30) days, except where retention is mandated by law (e.g., tax records).

9. Your GDPR Privacy Rights

If you reside within the European Union / European Economic Area or applicable jurisdictions, you hold the following rights under GDPR Articles 15 to 22:

• Right of Access (Art. 15): Request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): Correct inaccurate or incomplete personal information.
• Right to Erasure ("Right to be Forgotten", Art. 17): Request the permanent deletion of your account and related records.
• Right to Restriction of Processing (Art. 18): Request that we limit how your data is processed under specific circumstances.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, and machine-readable format (e.g. JSON or PDF).
• Right to Object (Art. 21): Object to processing based on legitimate interests or direct marketing.
• Right to Withdraw Consent: Withdraw any previously granted consent at any time without affecting past lawful processing.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local EU Data Protection Supervisory Authority.

To exercise any of these rights, email us at saad.zgm@gmail.com. We respond to all verified requests within thirty (30) days free of charge.

10. Data Security Measures

We implement state-of-the-art technical and organizational measures to safeguard your personal data, including:

• Encryption of all data in transit via modern HTTPS / TLS 1.3 encryption.
• Database encryption at rest using AES-256 standards.
• Secure hashing of user credentials using salted bcrypt/argon algorithms.
• Strict role-based access control (RBAC) limiting internal server access.
• Continuous vulnerability assessment, automated firewall protection, and DDoS defenses.

11. Cookies & Local Storage

Offer Every Day uses essential cookies and local storage items strictly necessary for core functionality:

• Authentication & Session Tokens: Secure JWT / session cookies to maintain your login status.
• User Preferences: Storing selected theme (Dark / Light mode) and language (English, Arabic, German).
• Security Tokens: CSRF tokens to safeguard forms against cross-site request forgery.

We do not use invasive third-party cross-site advertising tracking cookies.

12. Children's Privacy

Our Service is intended for working professionals and job seekers. We do not knowingly collect personal information from individuals under the age of 16 (or applicable age in your jurisdiction). If you become aware that a child has provided us with personal data, please contact us immediately for deletion.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect operational, legal, or regulatory updates. When significant modifications are made, we will provide noticeable notice via the application, email, or by updating the "Effective Date" at the top of this document.

14. Contact Our Privacy Team

If you have questions, feedback, or requests regarding this Privacy Policy or how your personal information is handled, please reach out to our Data Protection team: