Privacy Policy

Kitsun is a resume and job-application service operated by Hartogh Labs. Hartogh Labs is the controller of the personal data described in this policy.

Privacy questions and requests can be sent to info@hartoghlabs.com.

Depending on the features you use, Kitsun handles:

• Account and authentication data: your email address, account identifier, sign-in session, preferred language, and basic account settings. Kitsun uses passwordless email sign-in and does not store a Kitsun password.
• Resume and profile data: information you enter or import, such as your name, contact details, profile, work history, education, skills, languages, projects, references, and profile photo.
• Application data: vacancy text and URL, employer and contact details, application status, deadlines, notes, cover letters, and files you attach.
• Connected mailbox data: if you choose to connect Gmail or Google Workspace, your mailbox address, encrypted OAuth tokens, relevant message identifiers and threads, and the sender, recipient, subject, body, attachments, and timing of messages matched to your saved applications. Kitsun also sends application emails you explicitly compose and submit.
• Billing data: subscription status and the customer, subscription, and price identifiers supplied by Paddle. Payment-card details are collected and handled by Paddle, not stored by Kitsun.
• Community and feedback data: challenge submissions, public-post URLs, ratings, review text, and your publication consent when you choose to use those features.
• Technical and security data: essential cookies, request information, timestamps, rate-limit counters, and server or error logs needed to operate, diagnose, and protect the service.

The extension has one purpose: to let you save the vacancy in your active browser tab to Kitsun and, if you choose, compare it with your latest CV and create a tailored CV copy.

Data accessed and transmitted

• The text you selected on the active page, or otherwise the visible page text, limited to the first 20,000 characters.
• The active page URL.
• Your existing Kitsun sign-in session, used only to authenticate the request to kitsunresume.com.
• For Tailor my CV, the contents of your most recently edited CV that are needed to perform the comparison.

When access happens

Page access starts only after you click the extension icon and then click one of its save or tailor buttons. The activeTab and scripting permissions allow the packaged extension code to read the current tab for that action. The host permission for kitsunresume.com lets it securely call the Kitsun service. The extension does not run persistent content scripts and does not execute remotely hosted code.

What happens to the data

Kitsun extracts useful vacancy fields, stores the vacancy in your account, and, when you request tailoring, compares the vacancy with your CV and saves a tailored copy and fit analysis. Relevant vacancy and CV content may be processed by the AI providers described below to perform these requested functions.

We use personal data to:

• provide the account, resume editor, vacancy capture, matching, tailoring, cover-letter, job-tracking, email, and export features you request;
• authenticate you and keep your data separated from other users;
• process subscriptions and maintain your service entitlement;
• prevent abuse, enforce usage limits, investigate failures, and keep Kitsun reliable and secure;
• respond to support or privacy requests and comply with legal obligations; and
• publish a review only if you expressly allow publication and Kitsun chooses to publish it.

Our main legal basis under European data-protection law is that processing is necessary to provide the service you request. We rely on consent for optional mailbox access and review publication, legitimate interests for proportionate security and service reliability, and legal obligations where the law requires processing. You can disconnect an optional mailbox or withdraw optional publication consent at any time.

We do not sell or rent personal data. Data is disclosed only when needed to provide or secure Kitsun, when you direct us to do so, or when the law requires it. The main categories of recipients are:

• Supabase for authentication, database, and file storage.
• Vercel for hosting, server execution, and the Vercel AI Gateway.
• AI model providers selected through the Vercel AI Gateway to analyse or transform the resume, vacancy, cover-letter, or relevant application-email content when you invoke an AI feature.
• Google to authenticate and operate the optional Gmail connection you approve.
• Paddle to provide checkout, billing, tax handling, invoices, and subscription management.

These providers may process data in countries outside your own. Where required, we rely on applicable contractual and legal safeguards for international transfers. We may also disclose data to authorities when legally required, or in connection with a merger, acquisition, or sale of assets subject to appropriate safeguards.

Kitsun's use of information received through Chrome extension permissions is limited to providing and improving the extension's clearly disclosed, user-facing vacancy-saving and CV-tailoring features.

• We do not use or transfer this data for personalised, retargeted, or interest-based advertising.
• We do not sell this data or use it to determine creditworthiness.
• We transfer it only as necessary to provide or improve the requested feature, for security, to comply with law, or as part of a business transfer with appropriate safeguards.
• Humans do not read this data unless you give specific consent for support, access is necessary for security or legal compliance, or the data has first been aggregated and anonymised for internal operations.

Kitsun's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Account content is generally kept while your account is active and until you delete it or your account. You can delete individual CVs, jobs, cover letters, attachments, and mailbox connections from the service.

When you delete your account, Kitsun immediately attempts to cancel an active subscription, revoke connected Google access, remove stored files, and delete account records. Limited copies may remain temporarily in provider backups or security logs until their normal expiry. We may keep information longer where required for tax, accounting, dispute, fraud, security, or other legal obligations, and then delete or anonymise it when no longer needed.

Kitsun uses HTTPS for data in transit, access controls that isolate each user's records, private file storage, encrypted Google OAuth tokens, rate limits, and restricted server-side credentials. No system is completely secure, but we work to use safeguards appropriate to the nature of the data.

If you believe your account or data is at risk, contact us promptly at info@hartoghlabs.com.

You can:

• review and edit your account, CV, and application data in Kitsun;
• delete individual content or your complete Kitsun account;
• disconnect Google mailbox access in Kitsun or revoke it from your Google account;
• uninstall the extension at any time, which stops any future extension access to active pages; and
• ask for access, correction, deletion, restriction, objection, or a portable copy of your personal data where applicable.

Send a request from your account email address to info@hartoghlabs.com. We may need to verify your identity. If you are in the EEA, you may also complain to your local data-protection authority.

Kitsun is a professional resume and job-application service and is not directed to children under 16. If you believe a child has provided personal data without appropriate permission, contact us so we can investigate and remove it.

We may update this policy when Kitsun's features, providers, or legal obligations change. We will update the date at the top and provide an additional notice when a change materially affects how personal data is used. Extension data practices will also be kept consistent with the disclosures shown in the Chrome Web Store.

Hartogh Labs, operator of Kitsun
Email: info@hartoghlabs.com
Website: hartoghlabs.com