Draft — v1, generated against REQUIREMENTS.md. Attorney review optional per founder decision; placeholders in brackets need a human decision before this is published.
Last updated: [Date]
This Privacy Policy explains what information DirectClients.com ("DirectClients," "we," "us") collects, how we use it, and the choices you have — particularly around the parts of the Service that are unusual enough to deserve specific explanation: AI processing of your resume, the Apply Direct browser extension, and the employer-portal credential vault.
Your resume, profile, and job-matching data are processed using Anthropic's Claude API to power resume parsing, the AI role-fit conversation, match-rationale generation, cover letter generation, and the extension's field-mapping. Anthropic processes this data as a service provider to DirectClients under its own data-handling terms and does not use your data to train its models by default under standard API terms. We do not sell your data to Anthropic or any other party.
Where an employer's application portal requires its own account, DirectClients:
Deleting a stored credential removes it from our vault; it does not delete the account on the employer's portal itself, and does not withdraw an application already submitted.
To complete portal-account email verification without requesting access to your personal inbox, we issue you a unique forwarding address (e.g., you@apply.directclients.com) via our email provider, Resend. Mail sent to that address is forwarded to your real inbox and is also processed by our systems for the limited purpose of detecting and completing portal verification links, and — if you use the application tracker — surfacing employer replies (e.g., interview invitations) into your tracker. We do not read or use this mailbox for any other purpose.
The DirectClients Chrome extension requests permissions necessary to: read and fill form fields on a page you've navigated to as part of an Apply Direct session; communicate securely with our backend to fetch the data needed for that session and report back what was filled or submitted. It does not track your general browsing, read pages unrelated to an Apply Direct session, or collect data when inactive.
Some jobs are posted directly on DirectClients by staffing and recruiting firms, and some of those take applications inside DirectClients. When you apply to one, and only after you confirm what you're sharing, we give that firm a copy of: the resume file you choose, your name, email, phone, LinkedIn URL and city/state, your cover letter if you include it, and a match score with a short reason. The firm doesn't get access to your profile, your other resumes or anything else in your account. Firms agree to our Firm Posting Terms, which limit their use of this information to contacting you about job opportunities.
You can withdraw an application until the firm has reviewed it, which deletes the firm's copy. After that, the firm may keep the information for its own recruiting records under its own privacy practices. If you delete your DirectClients account, we delete the copies we hold for firms.
The firm also sees the status it sets on your application (for example "Interviewing"), and that status is shown to you. Firms that post on DirectClients see how many candidates viewed each of their jobs and clicked through to apply, as totals only; they never see who viewed a job. We delete this viewing record for you if you delete your account.
This is off unless you turn on "Let staffing firms find me" in your profile. While it's on, approved staffing firms and employers can search an anonymous version of your profile: your current job title, target roles, skills, years of experience, seniority, city and state, work-arrangement preference, availability, and whether you're authorized to work in the US or need sponsorship. They don't see your name, email, phone, LinkedIn, current employer or resume.
A firm can send you a contact request about one of its jobs. Nothing more is shared unless you choose Share, which gives that firm the same information as applying to its job on DirectClients (described above). You can decline any request, and turning the setting off removes you from search right away. If you delete your account, your requests are deleted too.
We share data with the following categories of service providers, solely to operate the Service:
| Provider | Purpose | |---|---| | Supabase | Database, authentication, file storage | | Anthropic (Claude API) | AI processing (§3) | | Stripe | Subscription billing and payment processing | | Resend | Transactional and inbound email, including the verification alias (§5) | | Cloudflare | DNS, CDN, and bot/abuse protection for our own site | | Vercel | Hosting for the DirectClients web application | | Trigger.dev / Inngest | Scheduled background processing for job-data sourcing |
We do not sell your personal information to third parties.
Access to your data by DirectClients staff is role-scoped and logged: support staff can view your account and application history to help resolve issues, but cannot view plaintext vault credentials; only automated systems use those credentials operationally. Every internal access to vault metadata is itself logged for security review.
You can access, correct, or delete your profile and resume data at any time from your account settings. You may request full account deletion, which removes your profile, resume, vault credentials, and associated PII from our systems (retained audit logs may be anonymized rather than deleted where needed for dispute-resolution integrity). [State-specific rights — e.g., CCPA, other state privacy laws applicable as we expand beyond the initial pilot regions — to be finalized.]
We encrypt data at rest and in transit, use per-user encryption keys for the credential vault backed by a dedicated secrets-management layer, and maintain audit logs of both candidate-facing submissions and internal staff access to sensitive data.
The Service is not directed to individuals under 18, and we do not knowingly collect data from anyone under 18.
We may update this Privacy Policy from time to time. We'll notify active subscribers of material changes before they take effect.
Questions about this Privacy Policy or your data: [privacy email, e.g. privacy@directclients.com]
This document was drafted with AI assistance based on DirectClients' documented product requirements. Bracketed items require a founder/business decision and, before public launch, we recommend a licensed attorney review — timing of that review is the founder's own call.