Privacy Policy

Last updated August 18, 2026

This Privacy Notice for Kleo Labs Inc. ("we," "us," or "our") describes how we collect, use, store, and share personal information when you use KleoKlaw, our SMS and iMessage job-application assistant ("Services"). KleoKlaw searches and scores jobs, may tailor a résumé, fills ATS forms, and submits applications on Greenhouse and Workday on your behalf.

This notice covers when you:

• Visit kleoklaw.com or any website of ours that links here
• Message with Kleo via iMessage (SendBlue)
• Upload a résumé, complete onboarding, pay, or use application automation
• Install the local desktop agent
• Join our waitlist or otherwise contact us

US audience. KleoKlaw is intended for users in the United States. Work-authorization questions, EEO-1 / self-identification forms, and iMessage delivery assume a US context. We do not actively market to residents of the European Economic Area, United Kingdom, or Switzerland. If you access the Services from outside the United States, you do so at your own initiative. Information may be processed in the United States and in other countries where our processors operate, including Google Cloud regions and large-language-model providers that may process data outside the US (our primary model provider, DeepSeek, is based in the People's Republic of China).

California Notice at Collection. If you are a California resident, read Section 16 before you send a résumé or other personal information. By sending your résumé you agree to this Privacy Notice and our Terms of Service.

Questions? Contact founders@kleoklaw.com or Kleo Labs Inc., 15633 NE 173rd St, Woodinville, WA 98072, United States. If you do not agree with these practices, do not use the Services.

SUMMARY OF KEY POINTS

What we collect. Identity and two emails (job-application email and Google-verified account email), phone, address, résumé files and tailored PDFs, work authorization, education and experience, optional EEO / self-ID answers, job preferences, Workday passwords in a vault, iMessage threads, application snapshots, billing identifiers, and local-agent tokens. We do not collect Social Security numbers as a profile field. We do not collect biometrics or GPS.

Sensitive information. Work authorization, visa/sponsorship, citizenship, and optional EEO data (gender, Hispanic/Latino, race/ethnicity, veteran status, disability) are stored in plaintext on your user profile, not in the credential vault. Skip and "prefer not to answer" are different stored choices. We use EEO data only to fill employer self-ID forms you authorized. We do not use EEO data for job matching or scoring.

We do not sell personal information for money. We do share it constantly with employers when we apply for you, and with the processors listed in Sections 4 and 17. We do not share résumé, EEO, or application data for cross-context behavioral advertising. The marketing website uses Google Analytics.

Security is not bank-grade and not end-to-end. We generate, store, reset, and may text Workday passwords. Application-queue snapshots are plaintext in Postgres. SMS/iMessage is not end-to-end encrypted from a product perspective.

Your rights. You can view a 15-minute signed profile link, correct information over iMessage, and request deletion by emailing founders@kleoklaw.com. We do not currently offer an automated JSON export. STOP, cancel billing, and delete account are three different actions (see the Terms).

TABLE OF CONTENTS

1. WHAT INFORMATION DO WE COLLECT?
2. HOW DO WE PROCESS YOUR INFORMATION?
3. WHAT LEGAL BASES DO WE RELY ON?
4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
5. ARTIFICIAL INTELLIGENCE AND AUTOMATED DECISIONS
6. GOOGLE SIGN-IN, GMAIL, AND IMAP
7. HOW LONG DO WE KEEP YOUR INFORMATION?
8. HOW DO WE KEEP YOUR INFORMATION SAFE?
9. DO WE COLLECT INFORMATION FROM MINORS?
10. WHAT ARE YOUR PRIVACY RIGHTS?
11. CONTROLS FOR DO-NOT-TRACK FEATURES
12. UNITED STATES STATE PRIVACY RIGHTS
13. DO WE MAKE UPDATES TO THIS NOTICE?
14. HOW CAN YOU CONTACT US?
15. HOW CAN YOU REVIEW, UPDATE, OR DELETE DATA?
16. CALIFORNIA NOTICE AT COLLECTION
17. SUBPROCESSORS

1. WHAT INFORMATION DO WE COLLECT?

In Short: We collect the categories below. This list is meant to be complete for current product behavior, not illustrative.

Identity and contact

• Legal first name, last name, and display name
• Job-application email on your profile, which can differ from your Google-verified account email used for sign-in and Stripe billing
• Phone number (SendBlue / iMessage handle)
• Street address, city, state, postal code, country
• Date of birth, only when an employer form requires it (not asked at default onboarding)
• LinkedIn, GitHub, portfolio, and personal website URLs
• Age-gate attestation (at_least_18)

Work authorization (sensitive)

• Authorized to work in the US (yes/no)
• Requires sponsorship now or in the future
• Citizenship status (citizen, permanent resident, visa, other)
• Visa type (for example F-1, OPT, H-1B) when you provide it

Education and experience

• Schools, majors, degrees, GPA, dates, graduation
• Employers, titles, dates, and bullet-point experience
• Languages, interests, awards
• Uploaded résumé file(s) and tailored PDFs generated per application
• Screening answers reused across jobs (known_answers), for example SAT/ACT or GPA

EEO / protected-class self-identification (highly sensitive)

Stored in plaintext on the user profile, not in the credential vault:

• Gender and pronouns
• Hispanic/Latino
• Race/ethnicity (EEO-1 categories)
• Veteran status
• Disability status

A stored None (never asked) is not the same as prefer_not_to_answer (you declined). Skipping still stores a choice. Purpose: only to fill employer self-ID forms you authorized. Not used for matching or scoring.

Preferences and settings

• Job categories, locations, remote, salary/hourly ranges, intern versus full-time
• Company blacklist and keywords
• Auto-apply, daily cap, quiet hours and timezone, Workday on/off, résumé tailoring on/off, manual review

Credentials and secrets (vault)

• Generated/managed Workday passwords
• Optional user-chosen Workday password
• Optional Gmail app password for a dedicated IMAP inbox
• Per-user vault encryption keys (wrapped with a system key in Google Secret Manager / environment)
• OTP codes and Workday activation or password-reset links (transient; they transit iMessage and our servers)

We do not collect Social Security numbers as a standing field. If a form requires SSN or government ID, we text a gap question rather than invent an answer.

Communications

• Full inbound and outbound iMessage / SMS thread
• Pending actions, gap questions, OTP asks
• Delivery receipts from SendBlue
• 15-minute signed profile-view links (capability URLs; treat them like a password)

Application operational data

• Frozen full-PII snapshots on each application-queue row
• Filled form state, review screenshots, change logs
• Browser-automation artifacts, which may include screenshots of name, address, and EEO fields
• Per-tenant plus-addressed emails (for example user+tenant@gmail.com)
• Desktop-agent auth token, claimed orders, and that the local machine is used to type passwords and click submit

Billing

• Stripe customer id, subscription status, trial dates
• Last4 / brand via Stripe (not the full card number / PAN)

Waitlist

• Name, optional gender, job types, age attestation, Terms/Privacy version accepted, and timestamp

Website, cookies, and device

• IP address, browser and device characteristics, pages viewed, referring URLs, approximate geography from IP (not GPS)
• Google Analytics on kleoklaw.com (device identifiers, pages, approximate geography)
• Cookies and similar storage for Google Sign-In, Stripe Checkout, sessions, and analytics
• No public index of user profiles

We do not currently honor Do Not Track signals (Section 11). We do not use a cookie consent banner because the site is intended for a US audience.

Sources

• You (iMessage, résumé upload, Google Sign-In, Stripe, waitlist form, settings texts)
• Résumé parser (LLM)
• Employer ATS pages (options and required fields)
• Job boards / ingest partners (job data, not your identity)
• Email (forwarded OTP mail or IMAP)
• SendBlue (delivery status)
• Stripe
• The local desktop agent on your computer

All personal information you provide must be true, complete, and accurate. You must notify us of material changes.

2. HOW DO WE PROCESS YOUR INFORMATION?

We process personal information to:

• Create and operate the account, including Google Sign-In and age attestation
• Parse a résumé into a profile
• Match and score jobs (without using EEO fields)
• Tailor a résumé with an LLM, unless you turn tailoring off
• Fill and submit applications, including ticking ordinary employer privacy/terms acknowledgements
• Ask gap questions over iMessage; a yes is your answer and, where applicable, your acceptance of employer terms
• Create or reset Workday candidate accounts and read OTP mail
• Bill and collect through Stripe
• Prevent fraud, debug, and send ops alerts (which may include user or job identifiers)
• Comply with law, enforce the Terms, and handle security incidents

We do not sell personal information for money. We do not use EEO / self-ID data for matching or scoring.

Employer-form privacy checkboxes

On submit, KleoKlaw may tick boxes whose labels look like privacy or terms acknowledgements (acknowledge / privacy / consent / gdpr). That can bind you to the employer's privacy notice, not this one. We refuse boxes that consent to processing of sensitive demographic survey data until you answer. We refuse optional marketing consent. See also Section 11.7 of the Terms.

3. WHAT LEGAL BASES DO WE RELY ON?

In Short: For US users we process information to provide the contract (the Terms), with your direction (including SMS answers), to comply with law, and for security and fraud prevention.

If you are located in the EU or UK despite our US-only offering, this paragraph applies. We would rely on performance of a contract, consent (including for optional EEO), legitimate interests in operating and securing the Service, and legal obligation. We have not appointed an EU/UK representative or DPO, have not published Standard Contractual Clauses for DeepSeek, and do not currently offer the Service to EEA/UK residents as a targeted product. China-based model processing is a transfer risk; do not use KleoKlaw if you need GDPR-adequate transfers.

If you are located in Canada, we process information with your consent (express or implied where the law allows) and as otherwise permitted for fraud prevention, legal process, and providing the Service you requested. You may withdraw consent by contacting us; withdrawal does not reverse applications already submitted to employers.

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

We share personal information with the recipient classes below. This is sharing to operate the Service, including submitting applications. It is not a sale of personal information for money.

Once an application is submitted, the employer or ATS is an independent controller under its own privacy policy. We cannot recall it.

Sale / sharing for ads. We do not sell personal information for money. We do not share résumé, EEO, or application data for cross-context behavioral advertising. The marketing website uses Google Analytics. We do not claim that we "never share" personal information — we share it with employers on every submit.

LLM training. Kleo Labs Inc does not independently train general-purpose models on your data. We have not verified that every LLM provider's contract prohibits training or retention. Do not treat this notice as a warranty that DeepSeek, Gemini, or a future provider will not use prompts for their own purposes. Those providers process data under their own terms.

5. ARTIFICIAL INTELLIGENCE AND AUTOMATED DECISIONS

We use large language models and automated scoring to extract résumés, tailor documents, parse SMS, rank jobs, and decide whether a match is strong enough to enqueue (at or above your minimum score). Auto-apply without per-job human review is possible if you turn auto-apply on and manual review off. A non-exhaustive large-employer list still pauses those applications for review. You can disable auto-apply, keep manual review on, skip EEO questions, disable Workday, or delete the account.

We do not warrant that tailored résumés or automated applications are undetectable. We do not warrant that matching will include every suitable job.

To limit automated application processing: disable auto-apply over iMessage, decline pending confirmations, or close the account. Replying STOP opts you out of proactive messages; it does not by itself disable auto-apply or cancel Stripe.

6. GOOGLE SIGN-IN, GMAIL, AND IMAP

If you register with Google Sign-In, we receive your name, email (account_email), and related profile fields from Google. Billing uses that account email, not necessarily the job-application email on your profile.

If you forward verification emails or grant IMAP access, we use it to retrieve ATS one-time codes and activation or reset links for applications you authorized. IMAP on a dedicated inbox is full mailbox access to that dedicated account, not your unrelated personal mail. We do not use Gmail or mailbox contents for advertising. If we access Google user data via Google APIs, we will use it only to provide or improve user-facing features of the Service consistent with the Google API Services User Data Policy, including Limited Use requirements, and not for serving ads.

You can revoke Google access in your Google account and/or by contacting us. Revoking access may prevent us from completing applications that need a verification code.

7. HOW LONG DO WE KEEP YOUR INFORMATION?

These periods reflect current compaction and deletion code. They are operational intent, not a guarantee that every replica is gone on that day. Counsel has not separately certified them.

• Application-queue terminal rows (submitted, permanent failure, cancelled, tailoring failed, expired): about 365 days, unless you delete the account sooner
• Notification-queue consumed rows: about 24 hours
• Inbound SMS ledger: about 7 days
• Job pool (raw jobs): about 60 days
• Stale matches / completed match-compute jobs: about 7 days
• Events / Stripe events: about 90 days
• Conversation (agent_messages): about 180 days
• Agent memory: until account deletion (no nightly compact rule)
• Vault audit: about 730 days
• Vault credentials (Workday passwords, IMAP app passwords): until account deletion. Turning Workday off skips new Workday auto-applies; it does not purge the vault
• Résumés and artifacts in R2: until account deletion (no nightly TTL). Do not assume every historical copy was always deleted on schedule
• Stripe: according to Stripe and tax law (often years)
• Waitlist: until conversion or up to 24 months
• Backups, Cloud Run logs, /tmp debug snapshots, SendBlue history, LLM-provider logs, shared IMAP copies: may outlast the periods above. Local worker snapshots are typically short-lived and not guaranteed to survive restarts. Browser-automation profiles on machines used for submit may survive account deletion

Account deletion

Email founders@kleoklaw.com to request deletion. From active systems we attempt to remove: user profile, preferences, settings, vault entries (DEK zeroized), matches, pending actions, agent memory, onboarding session, agent/recruiter messages, Postgres queue rows for that user (including submitted-status rows), and R2 objects under users/{user_id}/. Postgres and R2 purge is best-effort after the vault key is zeroized; a failure is logged as incomplete.

What remains: applications already sitting at employers (we cannot un-file them); Stripe customer records unless cancelled separately; SendBlue message history; LLM provider logs; shared-inbox copies of forwarded mail; backups until they expire; logs and screenshots as described above. We do not currently keep a separate "already applied" ledger after deletion in our application queue — those rows are deleted with the account — but employers still have what we submitted.

8. HOW DO WE KEEP YOUR INFORMATION SAFE?

We use a per-user data-encryption key for vault secrets, wrapped with a system key held in Secret Manager / environment configuration. Equal-opportunity and other demographic answers are not in that vault. Application-queue payloads are plaintext PII snapshots in Postgres. iMessage is not end-to-end encrypted from a product perspective. We generate, store, reset, and SMS Workday passwords; we do not claim we never see them. The local agent receives Workday passwords.

No method of transmission or storage is 100% secure. Transmission of personal information to and from the Services is at your own risk.

Incidents. If we discover a breach affecting your personal information, we will notify you and regulators as required by applicable law. Many US states require notice without unreasonable delay; some clocks are 30–60 days, and some are faster.

9. DO WE COLLECT INFORMATION FROM MINORS?

The Services are not directed at children under 13 (COPPA). The Service requires users to be 18 or older. Typical users include students who are 18–22. We do not onboard 16–17 year old high-school intern seekers. If we learn we collected information from someone under 18, we will deactivate the account and delete what we can from active systems. Tell us at founders@kleoklaw.com.

10. WHAT ARE YOUR PRIVACY RIGHTS?

• Access / know. Text us for a 15-minute signed profile link, or email founders@kleoklaw.com. The link is a capability URL; anyone with it can view the page until it expires. There is no public profile index.
• Correct. Text profile edits or send a new résumé.
• Delete. Email founders@kleoklaw.com. See Section 7. STOP and CANCEL are not deletion.
• Export. We do not currently offer an automated JSON dump. You may request access by email; we will provide what applicable law requires, which may be a copy of profile information rather than a full machine export of every store.
• Opt out of sale / share. We do not sell PI for money. To opt out of any sale or sharing you believe we are conducting, email founders@kleoklaw.com or say so over iMessage.
• Limit use of sensitive PI (CPRA). We use sensitive PI to fill employer EEO forms you authorized and to create or reset job-site accounts (including Workday). You can prefer-not-to-answer EEO questions (we will send that choice to employers when the form allows). You can disable Workday. You can delete the account. We cannot complete many applications without some identity and work-authorization data.
• Appeal. If we deny a privacy request, email founders@kleoklaw.com with the word "appeal." We will respond in writing. You may also complain to your state attorney general.
• Authorized agent. You may designate an agent. We may require proof of authorization and identity.

EEA/UK/Swiss rights (access, erasure, portability, objection, complaint to a supervisory authority) would apply if those laws cover you; we still do not target those regions. Automated decisions that enqueue or submit applications are described in Section 5; you can turn on manual review or disable auto-apply.

Withdrawing consent. You may withdraw consent by changing settings, skipping EEO, opting out of Workday, STOP, or deletion. Withdrawal does not undo processing already done or applications already submitted.

11. CONTROLS FOR DO-NOT-TRACK FEATURES

We do not currently respond to DNT browser signals or similar automatic do-not-track mechanisms. California law requires us to say so. If a binding standard is adopted, we will describe our practice in an updated notice.

12. UNITED STATES STATE PRIVACY RIGHTS

Residents of states with consumer privacy laws — including California (CCPA/CPRA), Colorado (CPA), Virginia (VCDPA), Utah (UCPA), Connecticut (CTDPA), Oregon, Texas, Montana, Nebraska, New Jersey, Delaware, Iowa, Tennessee, Minnesota, Maryland, and others as they come into force — may have rights to know, access, correct, delete, obtain a copy, opt out of sale/share/targeted advertising, limit sensitive PI, and appeal, subject to legal exceptions.

Categories of Personal Information We Collect

In the past twelve months we have collected the categories in the table. Examples describe what we actually collect in this product, not a generic inventory.

Retention for these categories follows Section 7. We do not collect or process sensitive personal information to infer characteristics for advertising. We use sensitive PI to fill employer forms and to create job-site accounts as described above.

Disclosure recipients are listed in Sections 4 and 17. We do not sell personal information. We do not share personal information for cross-context behavioral advertising of application data. Website analytics is described in Section 1.

How to Exercise Your Rights

Email founders@kleoklaw.com. We will verify identity (for example from the phone or account email we already have). Authorized agents must show authorization. Appeals: same address. California Shine the Light: same address, once per year, about disclosure to third parties for their direct marketing; we do not disclose personal information to third parties for their direct marketing in that sense.

13. DO WE MAKE UPDATES TO THIS NOTICE?

Yes. The updated date appears at the top. For material changes we may notify you by iMessage, email to account_email, and/or posting at kleoklaw.com/privacy. Continued use after the effective date is acceptance of the updated notice where the law allows.

14. HOW CAN YOU CONTACT US?

Email founders@kleoklaw.com or write:

15. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Text Kleo for a 15-minute profile link or to correct facts. Send a new résumé to refresh parsed experience. Email founders@kleoklaw.com to delete the account. STOP does not delete data. CANCEL does not delete data. We cannot retract an application an employer already accepted. We do not currently provide a self-serve export file.

16. CALIFORNIA NOTICE AT COLLECTION

This section is the short notice California law expects at or before collection, including before résumé upload.

Categories of PI: identifiers (name, two emails, phone, address); professional and education information from your résumé; preferences; iMessage content; billing identifiers; device/website data. Sensitive PI: work authorization, citizenship/visa, optional EEO (gender, race/ethnicity, Hispanic/Latino, veteran, disability), login credentials and Workday passwords, contents of text and verification email. Date of birth only if an employer form requires it. We do not collect SSN, biometrics, or precise GPS.

Purposes: operate the account; parse the résumé; match jobs; tailor résumés; fill and submit applications; ask gap questions; create/reset Workday accounts and read OTP mail; bill; security and debugging; legal compliance. We use sensitive PI to fill employer EEO forms you authorized and to create job-site accounts.

Sold or shared for ads? We do not sell PI for money. We do not share application data for cross-context behavioral ads. We share PI with employers and processors as described in Sections 4 and 17. The website uses Google Analytics.

Retention: see Section 7 (application snapshots ~365 days; inbound SMS ledger ~7 days; consumed notifications ~24 hours; job pool ~60 days; conversations ~180 days; vault and résumés until deletion; Stripe per Stripe).

Rights: see Sections 10 and 12. Full policy: this page. Contract: Terms of Service.

By sending your résumé you agree to this Privacy Notice and the Terms, including that we will apply for you (including clicking submit), may rewrite your résumé unless you opt out, may tick employer privacy acknowledgements, will ask before arbitration/non-competes, and may create or reset Workday passwords (including accounts you already have) and text you that password unless you opt out of Workday.

17. SUBPROCESSORS

We use the following classes of subprocessors / service providers. We will update this section when the list changes. It is not a separate live registry URL.

• SendBlue — iMessage
• Stripe — payments
• Google (Cloud, Firebase/Firestore, Sign-In, Analytics, Gemini as LLM fallback)
• DeepSeek — primary LLM
• Neon — Postgres queues
• Cloudflare R2 — object storage
• Amazon Web Services (SES) — email
• Supabase — waitlist database (separate from production user store)
• Website hosting (for kleoklaw.com)
• CAPTCHA / fraud prevention on the waitlist

Employers and ATS platforms are independent controllers of applications we submit, not our subprocessors. The local desktop agent runs on your computer under your control.