Privacy Policy

Introduction

Hotfix Jobs is a job discovery platform that helps you search and track job opportunities. This privacy policy explains what information we collect, how we use it, and how we protect it.

Hotfix Jobs is operated by Hotfix LLC, which is the data controller for the personal information described here. Hotfix Jobs is available worldwide and carries jobs from many countries. Our systems and the people who operate them are located in the United States, so using Hotfix means your information is processed there. See International data transfers below.

You can contact us about anything in this policy, including any request to exercise the rights described under Your rights and data control.

Information we collect

We collect information you provide when creating an account and using our services. This includes account data (email address, authentication method), resume data (uploaded PDF files and structured data extracted from them, including target roles, skills, and experience), alert criteria (such as roles, seniority, work type, location, salary, skills, companies, and industries), recent job-search criteria, AI Search prompts (the plain-language descriptions you write and the refinements you make to them), device tokens used to deliver push notifications, and usage data (searches performed, pages visited, jobs saved, and features used). Alerts, recent searches, and AI recent searches are stored with your Hotfix account so they can be used across supported devices. When an employer pays to feature a job, we process the payment details needed to complete that purchase.

We do not collect or store payment card details. Card data is handled entirely by our payment processors, described under Third-party services below.

How we use AI

Hotfix Jobs uses artificial intelligence throughout the platform to provide its core features. Below is a detailed explanation of each AI-powered feature and how your data is used.

Resume processing

When you upload a resume, AI extracts text, skills, experience, and education from the PDF to build your profile. The original PDF is retained in our storage bucket so you can preview it from your account page; you can replace or delete it from Account. The structured data extracted from the PDF is used solely to power your Hotfix Jobs experience: it populates your profile and prefills application forms when you apply through Hotfix. Resume data never determines which jobs you are notified about.

Job extraction

When new jobs are ingested from company applicant tracking systems, AI extracts structured fields (title, locations, salary, required skills, years of experience, and a short summary) from the raw posting text. This data powers search filters and the notifications we send.

AI Search

AI Search lets you describe the job you want in plain language instead of setting filters. Your prompt is sent to our AI provider, which interprets it into structured criteria (such as work type, salary, location, and seniority) and semantic requirements, and then ranks open jobs against it. Your prompt is also converted into a numerical embedding used to retrieve relevant jobs. Hotfix shows you the criteria it read from your prompt so you can remove anything it got wrong.

Prompts from successful AI searches are saved to your account as AI recent searches so you can replay them. You can delete any of them at any time. AI Search is limited to 10 new searches per UTC day and 5 turns per session for every account.

Alerts and matching

An alert is a fixed set of criteria that decides which newly posted jobs you hear about. Finding jobs for an alert is deterministic and does not call an AI model. Alerts are the only source of job-match notifications; your resume plays no part in deciding what you are notified about.

You can also create an alert from an AI search. When you do, the structured criteria that AI read from your prompt become the alert's criteria, and matching from that point on runs deterministically against those criteria exactly as it does for any other alert. Your original prompt is stored alongside the alert so you can see what it was built from.

Each newly posted job that matches one of your active alerts becomes its own notification, naming that job and linking straight to it. A limited number are created per day. Delivery is same-day in the bell and through push when your device allows it. Turn on Email matches in Account → Alerts for optional same-day email. Hotfix Weekly is a separate Friday magazine email; match delivery is controlled by your alerts and Email matches, not that newsletter.

Company enrichment

AI searches the web to enrich company profiles with details like headquarters, size, founding year, industry, and tech stack. This data comes from publicly available sources.

Job applications submitted through Hotfix

When you apply to a role through Hotfix’s in-app apply experience, your application is submitted to the company’s applicant tracking system (Greenhouse or Ashby). The ATS record is the company’s system of record.

In addition, Hotfix retains its own application record so we can show you a status update, retry failed submissions, and email you if a submission could not be delivered. Each application record includes the applicant email address you entered, the form payload you submitted (excluding the resume bytes themselves), the response returned by the destination ATS, and the submission status (pending, submitted, or failed). The resume PDF you uploaded is stored alongside your account. Application records are kept for as long as your account exists, so your status history stays accurate, and are deleted when you delete your account. You can also ask us to delete an individual application record sooner by contacting us.

Data storage and security

Your account data is stored in a managed Postgres database hosted by Neon, and uploaded files such as resumes are stored in Google Cloud Storage. Both encrypt data at rest. All data in transit is protected via HTTPS. We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, or destruction.

Third-party services

We use the following third-party services: Neon for database hosting; Google Cloud Platform for backend hosting and file storage; Vercel for frontend hosting; Clerk for user authentication and account management (sign-in with Google and Apple OAuth; Clerk stores your email address, OAuth provider identifiers, and session metadata under their own privacy policy); DataFast for product analytics on the website; OpenAI for our AI features (job extraction, resume parsing, AI Search interpretation and ranking, and company enrichment); Apple Push Notification service (APNs) for push notifications on iOS; Stripe for employer Featured payments on the web; Resend for transactional and digest emails; and Logo.dev for company logos. Your resume data and profile information are never used to train AI models. We access our AI provider through its API, which does not use submitted data for model training by default. Each third-party service operates under its own privacy policy.

No data selling

We never sell, share, or provide your resume, profile data, or personal information to employers, recruiters, or any third parties. Your data is used exclusively to provide and improve Hotfix Jobs services for you.

Cookies and similar technologies

We use two kinds of cookies and similar storage on the web app:

Essential. Required for the site to work: authentication and session management through Clerk. These are always on, because without them you cannot sign in or stay signed in.

Analytics. DataFast measures page views and product interactions on the website. Outside the UK, the European Economic Area, and Switzerland, DataFast uses an analytics cookie so we can recognize return visits and attribute marketing. In those countries we ask before setting that cookie. If you decline, we do not load DataFast. We do not track you across other sites, and we do not send your email or name to DataFast. After you sign in, we send your account id so we can see how signed-in people use Hotfix. When an employer buys Featured on the web, we may pass an anonymous DataFast visitor id through our payment provider so revenue can be attributed to traffic sources. The iOS app does not send product analytics to DataFast. You can change your analytics-cookie choice from Cookie settings in the footer.

We do not sell your data, and we do not engage in cross-site tracking or behavioral advertising profiles on the web app.

Why we are allowed to use your data

If you are in the UK, the European Economic Area, or another place with similar rules, the law requires us to have a legal basis for each use of your personal information. Ours are:

• To perform our contract with you. Running your account, saving your alerts and watchlist, sending the job-match notifications you asked for, processing an employer Featured purchase, and submitting an application you chose to send. Without this we cannot provide the service you signed up for.
• Your consent. Marketing email such as Hotfix Weekly and push notifications, and analytics cookies if you are in the UK, the European Economic Area, or Switzerland. You can withdraw consent at any time, and withdrawing does not affect anything done before you withdrew.
• Our legitimate interests. Keeping the service secure, preventing abuse, fixing errors, and understanding product usage on the website through DataFast so we can improve Hotfix. After you sign in, that includes attaching your account id to those events. We use these only where your interests and rights do not override them.
• Legal obligation. Keeping records we are required to keep, and responding to lawful requests.

We do not use your personal information for automated decision-making that produces legal or similarly significant effects about you. AI Search and alert matching decide which jobs to show you; they do not make decisions about you, and no employer sees your data through them.

International data transfers

Hotfix operates from the United States. If you use Hotfix from outside the US, your personal information is transferred to and processed in the US, and by the third-party providers listed above, which are also primarily US-based.

The US does not have an adequacy decision from the UK or the European Commission that covers every recipient. Where we transfer personal information out of the UK or the EEA, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where the UK GDPR applies), incorporated into our agreements with the providers who process data for us. You can contact us for more detail about the safeguards applied to a specific transfer.

Your rights and data control

You have the right to access, update, or delete your personal data at any time. You can delete your uploaded resume, update your profile information, request a full export of your data, or request complete account deletion. These actions can be performed from Account or by contacting us.

Depending on where you live, you may also have the right to: object to processing we base on legitimate interests; restrict processing while a dispute is resolved; receive your data in a portable, machine-readable format; withdraw consent at any time; and not be discriminated against for exercising any of these rights. We do not charge for exercising them, and we respond within the time the applicable law allows.

If you are in the UK or the EEA and you think we have handled your data wrongly, you can complain to your local data protection authority: in the UK, the Information Commissioner's Office. We would rather you contact us first so we can put it right, but you do not have to.

Data retention

We retain your data for as long as your account is active and as needed to provide our services. When you delete your account, all associated personal data, profile information, alerts, recent searches, AI Search prompts, watchlist, resume data, and application records are permanently removed from our systems. Analytics events in DataFast are not keyed to your email or name; we do not send those identifiers to DataFast.

Children’s privacy

Hotfix Jobs is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If we discover that an account belongs to a child under 13, we will promptly delete the account and all associated data.

Changes to this policy

We may update this privacy policy from time to time. We will notify users of significant changes via email or in-app notification. Continued use of Hotfix Jobs after changes constitutes acceptance of the updated policy.

Contact

If you have questions about this privacy policy or how we handle your data, please contact us.