Privacy Policy

1. Introduction

Matatah ("we", "us", "our") operates the Matatah web application and Chrome extension (together, the "Service"). This Privacy Policy explains what information we collect, how we use it, and the choices you have. By using Matatah you agree to the practices described here.

2. Information We Collect

2.1 Information you provide

Account information: your name and email address, obtained when you sign in with Google or GitHub. Profile data: résumé text, work experience, skills, education, LinkedIn/GitHub/website URLs, target roles, salary preferences, and location. Application data: job descriptions, tailored résumés and cover letters, application status, and notes. Community data: posts, replies, and upvotes you create in the in-app community.

2.2 Information collected automatically

Usage data: pages visited, features used, and timestamps. Device information: browser type, operating system, and screen size. The Chrome extension collects job-posting URLs you choose to apply to, form-field data on application pages (only when you actively trigger autofill), and page metadata used for matching.

2.3 Information we do NOT collect

We do not collect general browsing history beyond the application pages you explicitly interact with, and we do not store your full payment-card details (payments are handled by Stripe). We never ask for your Google, LinkedIn or email password.

2.4 Job-site sign-ins

Some employers (for example Workday career sites) require an account before you can apply. When you let Matatah create or save that employer-site sign-in, we store the site, the email used and the password, encrypted at rest with AES-256-GCM. It is used only to sign you back in to that employer's site for your own applications, is shown to you only when you ask to reveal it in Settings, and can be deleted there at any time.

3. How We Use Your Information

We use your information to:

(a) provide, maintain, and improve the Service; (b) generate AI-tailored résumés and cover letters matched to specific job descriptions; (c) score and rank job matches against your profile; (d) autofill application forms via the Chrome extension, at your direction; (e) track your application pipeline; (f) run the in-app community; (g) send transactional emails about your account; (h) respond to support requests; and (i) detect and prevent fraud or abuse.

4. AI Processing and Automated Applications

Matatah uses third-party AI models (including Anthropic's Claude) to generate tailored application materials. When we do this: (a) your résumé, profile, saved answers, and the relevant job description are sent to the AI provider; (b) we send only the minimum data needed; (c) providers process data under their own privacy policies and data-processing agreements; and (d) generated content is stored in your account and visible only to you.

When you use autofill or automated-application features, your profile and generated documents are entered into the third-party job sites and applicant-tracking systems you choose to apply to. Those third parties receive and process that data under their own terms. You direct and authorize each submission and are responsible for the information sent. We record your acceptance of our Terms and this Policy — with a timestamp and version — as a record of your consent. Matatah does not submit an application unless you have either reviewed it or turned on auto-submit in Settings, in which case it submits only applications where every required field was answered from your profile and the form's own checks passed; anything uncertain waits for you.

5. Warm Intro

Warm Intro helps you find people at a company who could refer you for a job already in your Matches, Today or Applied list. It uses no paid people-data provider. About you, it uses: (a) your profile and résumé (employers and dates, schools and years, skills, titles, city); (b) if you choose to connect Gmail for Warm Intro, message headers only (sender, recipients and dates), never message text, to know who you've emailed at that company and whether they replied; and (c) people you mark "I know them", or save with the extension's "Save to Warm Intro" button on a profile you opened yourself. These stay in your private space and are never shared with other users.

To find people at the company, Matatah uses only: the job posting's own text (for example a named recruiter or hiring manager); the company's own public team, about, leadership and blog pages on its own domain, fetched politely (we obey robots.txt, identify ourselves as MatatahBot and rate-limit every site); and the title, snippet and link of results from a web search API. We keep a shared cache of the minimum needed about those people — name, title/headline, public profile link, company, team, function, seniority, location if shown in the result, where we found them, and when — and recheck people not confirmed in 60 days only when they are about to be shown. Searches run only when you choose "Warm intro first" on a job, or when a job moves to Applied (unless your after-apply setting is Never). The raw search results (title, link, snippet) are kept for 30 days so the same search is never paid for twice, and people not confirmed in 180 days who aren't tied to an active job are deleted. We never collect, store, guess or show email addresses or phone numbers of the people we find, and we cap how many Matatah users are shown the same person in a week.

Matatah does not log into, automate or fetch linkedin.com, does not scrape profile pages, and does not read LinkedIn data exports. Matatah never sends a message on your behalf: it drafts a note, and you open it in your own Gmail (only for people already in your own Gmail) or copy it into LinkedIn and send it yourself. You can see everything Warm Intro holds for you, and delete all of it in one click, at Warm Intro → Your warm intro data.

If you are someone Matatah may suggest, you can have yourself removed at matatah.com/remove. We honor removals within 72 hours (in practice immediately) and you will not be suggested again.

6. Google User Data (Gmail)

Connecting Gmail is optional and you can disconnect it at any time in Settings. If you connect it, Matatah asks Google for read-only access (gmail.readonly), or for Warm Intro only, message headers (gmail.metadata). Matatah cannot send, delete, label or change your email.

What we read and why.Matatah searches your inbox only for mail about job applications: confirmations, interview and assessment invitations, offers, rejections, and one-time codes from applicant systems. From those messages it reads the sender, subject, date and Gmail's short snippet, never attachments, to (a) sort replies in your Tracker inbox and move each application's status (Applied, Interview, Offer, Rejection); (b) when you are applying, read a one-time code from an applicant system that arrived after the code was requested, so the application can continue; and (c) for Warm Intro, see whether you have already emailed someone at a company (headers only). The Tracker inbox reads matching messages from Gmail when you open it.

What we keep.For messages linked to an application we store the sender address, subject, date, the application it belongs to and its category (for example "Interview"), so your Tracker keeps its status. We do not store message bodies or attachments. OAuth tokens are encrypted at rest. When you disconnect an inbox we delete its tokens, and once no inbox is connected we delete the stored message details too. You can also ask us to delete them at any time at privacy@matatah.com.

What we never do. We do not sell Gmail data, use it for advertising, or transfer it to anyone except as needed to provide these features, to comply with law, or as part of a merger or acquisition with notice to you. We do not use Gmail data to train or improve general AI or machine-learning models, and we do not send it to AI providers. No person at Matatah reads your email unless you ask us to (for example for support), it is needed for security or to comply with law, or the data has been aggregated and anonymized for internal operations.

Matatah's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Data Sharing and Disclosure

We do not sell your personal information. We may share data with:

Service providers who help us run Matatah, each bound by their own terms and data-processing agreements: Google and GitHub (sign-in), Neon and Vercel (database and application hosting, United States), Stripe (payments), Resend (transactional email), Anthropic (AI content generation), and — for Warm Intro only — a web search API provider (such as Brave Search), which receives search queries naming the company and the kind of role, never your name or details. We may also disclose data when required by law or legal process, or in connection with a merger, acquisition, or sale of assets, with prior notice to users.

8. Community Content

Anything you post in the in-app community — posts, replies, and the display name shown on them — is visible to other signed-in Matatah members. Please don't share sensitive personal information or other people's private details there. You can delete your own posts, and admins may remove content that violates our guidelines. Feature requests you post may be copied into our internal roadmap tooling.

9. Data Storage and Security

Your data is stored on servers in the United States (Neon and Vercel). We use industry-standard safeguards including encryption in transit (TLS/HTTPS), encryption at rest for sensitive data, and access controls. No method of transmission or storage is completely secure, and — as an early-stage prototype — we cannot guarantee absolute security or that data will never be lost.

10. Data Retention

We retain your data while your account is active or as needed to provide the Service. On account deletion, profile data and generated documents are removed within 30 days; anonymized usage analytics may be kept for product improvement; and records required by law (e.g., billing) are retained as required. You can request deletion at any time.

11. Your Rights

Depending on where you live, you may have the right to:

(a) access the personal data we hold about you; (b) correct inaccurate data; (c) delete your data; (d) export your data; (e) object to or restrict certain processing; and (f) withdraw consent where processing relies on it. To exercise these rights, email privacy@matatah.com. We aim to respond within 30 days.

12. Chrome Extension Privacy

The Matatah Chrome extension (a) checks each page locally for a job-application form and does nothing on pages without one; it does not record or send your browsing history; (b) reads and fills application form fields only when you start a fill, or when you have turned on Bot Apply for jobs you queued, which opens those postings in a background tab and fills them from your profile; (c) submits an application only when you click submit or have chosen automatic submission for that run; (d) communicates only with Matatah servers (matatah.com) and the employer site you are applying on; (e) stores minimal data locally (your auth token, cached profile and run state); (f) does not inject ads, trackers, or analytics into web pages, and does not sell or transfer your data to third parties for advertising; (g) on a LinkedIn profile page you have open, shows a "Save to network" button that reads that page only when you click it and saves only the name, title and company you confirm; and (h) can be disabled or removed at any time from Chrome. Use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

13. Cookies and Tracking

We use essential cookies for authentication and session management. We do not use third-party advertising cookies or cross-site tracking. We may use privacy-respecting, aggregate analytics to understand how the Service is used. You can control cookies through your browser settings.

14. Children's Privacy

Matatah is not intended for anyone under 18. We do not knowingly collect personal information from children. If we learn we have, we will delete it promptly.

15. International Data Transfers

If you use the Service from outside the United States, your data will be transferred to and processed in the United States. By using the Service, you consent to this transfer, and we maintain appropriate safeguards in line with applicable data-protection laws.

16. California Privacy Rights (CCPA)

California residents have additional rights under the CCPA, including the right to know what personal information is collected, to delete it, and to opt out of its sale. We do not sell personal information. To exercise these rights, email privacy@matatah.com.

17. Changes to This Policy

We may update this Policy from time to time. We'll note material changes via email or a prominent notice in the Service. The "Last updated" date above reflects the latest revision.

18. Contact Us

Questions about this Policy or our data practices? Email privacy@matatah.com or support@matatah.com.