This policy applies to the Auto Job Apply browser extension and to aja.nextintai.com (together, the “Service”), operated by NextIntAi (“we”, “us”).
The short version
- Your AI API keys never leave your browser. They are stored locally and sent directly to the AI provider you chose. We never receive them, and they are excluded from cloud sync.
- Your resume and profile are stored on your device, and — only if you sign in with Google — also in your own row of our database so a second browser can restore them.
- We do not sell your data, show you ads, or use your resume to train any model.
- You can delete everything from within the extension at any time, or by emailing us.
What the extension stores, and where
The extension keeps the following in your browser’s local extension storage. Local storage never leaves your device unless a row below says otherwise.
| Data | Purpose | Leaves your device? |
|---|---|---|
| Profile — name, email, phone, location, links, work history, education, saved answers | Filling application forms | Only to your AI provider, and to your account if signed in |
| Résumé — pasted text and, optionally, an uploaded file | Filling forms, match scoring, resume uploads | Text only, as above. An uploaded file never leaves the device. |
| AI provider API keys | Authenticating your requests to your chosen provider | Never. Sent only to that provider, direct from your browser. |
| Learned answers — screening answers you typed once | Answering the same question automatically next time | No |
| Applied-jobs log — job title, company, URL, time, outcome, match score and reason | Showing you what was applied to and what was skipped | No |
| Settings — filters, daily cap, theme, run state | Making the extension behave the way you configured it | No |
| Sign-in session — access and refresh tokens | Keeping you signed in | No (issued by, and validated against, our auth provider) |
If you sign in with Google
Signing in is required to use the extension’s apply and fill features. When you do:
- Google returns your account ID, email address, name and profile picture URL to us. We request no other Google scopes — we cannot read your Gmail, Drive, Contacts or Calendar.
- We never see your Google password. Authentication happens in a window controlled by Google.
- Your profile and resume text are saved to a single row in our database, keyed to your account ID, so that installing the extension on another browser restores them. That row is protected by database row-level security: no other signed-in user can read or modify it.
What is sent to your AI provider
The extension has no AI of its own. It uses an API key that you supply for a provider that you choose — currently OpenAI, Google Gemini or Anthropic. When it needs to answer a form field or score a job, it sends that provider:
- Your profile details and resume text;
- The labels, placeholder text and options of the form fields on the page; and
- The job title and description, when scoring a match.
These requests go directly from your browser to that provider. They do not pass through our servers, and we have no record of them. What the provider does with the content is governed by their privacy policy and terms, not ours — please read them. Page content is always treated as data to be processed, never as instructions to be followed.
What we do not collect
- Passwords, for any site. The extension never fills password fields.
- Payment or financial information. The Service is free.
- Your browsing history, or activity on sites other than the job pages you direct it to.
- Analytics, tracking pixels, advertising identifiers or third-party cookies.
- Your AI provider API keys.
Why we are allowed to process this
Where the UK GDPR or EU GDPR applies, our lawful bases are performance of a contract (storing your profile so the Service can do the thing you asked it to do) and your consent (signing in and choosing to sync). You may withdraw consent at any time by signing out and deleting your data.
Who we share data with
We do not sell, rent or trade personal data, and we do not share it for advertising. Data reaches only these parties, each because the Service cannot work otherwise:
- Google — to authenticate you when you sign in.
- Supabase — our database and authentication provider, which stores your profile row and session.
- The AI provider you selected — as described above, direct from your browser.
We may also disclose data if required by law, or to protect the rights and safety of users, but we will not do so voluntarily.
How long we keep it
Local data stays in your browser until you delete it or remove the extension. Your synced profile row stays until you delete it or ask us to. Deleting your account removes the row immediately and permanently; backups are overwritten on their normal rotation, within 30 days.
Your choices and rights
- See everything. Settings → Export writes every stored value to a JSON file you can read.
- Correct anything. Every field is editable in Settings.
- Delete everything locally. Removing the extension from your browser erases all local data.
- Delete your synced copy. Sign out to stop syncing, or email us to have your row erased entirely.
- Stop syncing but keep using it. Local storage works on its own; sync is a convenience, not a requirement.
Depending on where you live you may also have the right to object to processing, request portability, or complain to your data protection authority. Write to us at ealisyautojobapply@gmail.com and we will respond within 30 days.
Security
Data in transit is encrypted with TLS. Your profile row is protected by database row-level security enforced on the server, so authorisation does not depend on the extension behaving correctly. API keys are held only in local browser storage and are deliberately excluded from cloud sync and from exported backup files unless you explicitly confirm their inclusion.
No system is perfectly secure, and we cannot guarantee absolute security.
Children
The Service is not directed at anyone under 16, and we do not knowingly collect their data. If you believe a child has provided us personal data, contact us and we will delete it.
International transfers
Our database and authentication provider, and the AI provider you choose, may process data in countries other than yours, including the United States. Where required, transfers rely on Standard Contractual Clauses or an equivalent safeguard.
Changes to this policy
If we change this policy materially we will update the date at the top and, where the change reduces your privacy, surface a notice in the extension before it takes effect.
Contact
Questions, requests or complaints: ealisyautojobapply@gmail.com.