Privacy Policy
Updated October 1, 2026
botin exists to fill out job application forms for you — not to decide for you. This Privacy Policy describes how AC Dev collects, uses, stores, and protects your personal data in strict compliance with the Brazilian General Data Protection Law (LGPD, Law No. 13,709/2018), the European Union General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), and US privacy laws including the California Consumer Privacy Act (CCPA/CPRA).
1. Data Controller Identification & Contact (DPO)
The Data Controller responsible for processing your personal data is AC Dev, registered under CNPJ 42.180.462/0001-88, headquartered in São Luís, Maranhão, Brazil, ZIP 65065-450, founded by André Pinheiro. For any inquiry, request, or exercise of privacy rights, our Data Protection Officer (DPO) can be reached directly at contato@acdev.com.br.
2. Legal Bases for Processing (LGPD & GDPR)
We process your personal data based on the following legal grounds: (a) Performance of a Contract and pre-contractual measures (Art. 7(V) LGPD; Art. 6(1)(b) GDPR), to create your account, parse resumes, and automate application form filling; (b) Legitimate Interests (Art. 7(IX) LGPD; Art. 6(1)(f) GDPR), for fraud prevention, infrastructure security, rate limiting, and per-device quota enforcement; (c) Compliance with Legal Obligations (Art. 7(II) LGPD; Art. 6(1)(c) GDPR), such as connection logging under Brazil's Marco Civil da Internet (Law 12,965/2014); and (d) Special Category Data (Art. 11(I) LGPD; Art. 9(2)(a) GDPR), based on your consent, when you voluntarily include disability (PCD), diversity, or self-identification answers in resumes or application forms.
3. Personal Data We Collect
We collect: (a) Account data: name, email, and identifier obtained when you sign in with Google or LinkedIn; the LinkedIn identifier is stored only as a hash; (b) Professional data: uploaded resume (file and raw extracted text), experience, education, skills, languages, public links (LinkedIn, GitHub, portfolio), salary expectations, and work authorizations; (c) Q&A Bank: form questions and answers you provided or confirmed for reuse; (d) Application history: job URLs, company names, titles, statuses, and filled payload snapshots; (e) Technical security telemetry: extension installation ID and IP address, both stored strictly as salted cryptographic hashes (SHA-256), never in plain text; (f) Account origin: the campaign, referring site, and landing page of the first visit that led to sign-up, recorded once so we know which channel brought the account; (g) Answers the LinkedIn page already shows pre-filled from earlier applications: the extension sends them along with each question, and those that answer a question become part of your Q&A Bank, never replacing an answer you already have; (h) Job analyses: how well each job you open fits your profile, its requirements, and the tailored resumes you request; (i) Diagnostic data: error logs from the website and the extension (including the account email), the problem reports you send us, and, when a field is not filled, the form question and the reason it failed — never the value you answered.
4. Purposes of Processing
Your data is used solely to: (a) Extract and structure your professional profile; (b) Generate automated form fill plans in your browser; (c) Reuse recurring form answers via the Q&A Bank; (d) Hide unwanted companies and jobs in search feeds; (e) Safeguard system integrity, prevent abuse, and enforce usage limits; (f) Process Pro plan subscriptions and billing via Stripe; (g) When you ask for it, write a version of your resume tailored to a specific job.
5. Artificial Intelligence, Autopilot & Automated Decisions
botin uses large language models (LLMs) only as one layer of a resolution cascade when local deterministic rules (cache, Q&A Bank, skill evidence) do not yield an answer. We never send raw page HTML — only compact field descriptors. In assisted mode, the extension stops at the first uncertain field for your review. In Autopilot mode, submissions occur automatically within strict daily hard caps and randomized intervals. In Turbo Mode, affirmative or negative inferences are drawn from your verified stack. Questions about sensitive data (gender, race or ethnicity, disability, sexual orientation, religion, health, union or political affiliation, and veteran status) are never sent to AI providers: botin only fills them with an answer you have already given, and otherwise leaves them to you. In full compliance with Art. 20 of LGPD and Art. 22 of GDPR, you have the right to request human review of automated decisions affecting your interests, and you may disable Autopilot or Turbo Mode at any time in your profile settings.
6. Third-Party Sharing & Sub-processors
Your data is never sold, rented, or traded. We share data strictly with the following sub-processors necessary to operate the service: (a) LLM Provider: DeepSeek (DeepSeek API), which stores and processes data in the People's Republic of China. We send it your resume text, when extracting your profile, and form questions together with the parts of your profile needed to answer them — never the page's HTML. When you open a job, to list its requirements and check them against your profile, and when you ask for a resume tailored to it, we also send your profile and resume text, without your name, email, phone number or links, together with the job description. To suggest job searches, we send your job title, seniority, skills, and recent positions. DeepSeek's privacy policy provides for using the data it receives to train and improve its models, and we have no contract preventing that use. The more the Q&A Bank and deterministic rules answer, the less data reaches this provider; (b) Job fit: OpenRouter, Inc., in the United States, which provides access to TypeSafe's Jev model. When you open a job, we send it the job description, your education, positions, companies, locations, dates, skills and experience descriptions, and the Q&A Bank answers related to the job — without your name, contact details, or current salary. For tailored resumes, we also send the skills the AI inferred and the term in your profile that supports each one, to check that one follows from the other; (c) Payment Processing: Stripe Inc., handling payment transactions under PCI-DSS compliance; (d) Sign-in: Google LLC and LinkedIn Corporation, which share your name, email, and account identifier when you sign in through them; (e) Web Analytics: Google LLC (Google Analytics), only for visitors who consent to analytics cookies; (f) Hosting: a virtual server rented from RackNerd LLC in Buffalo, New York, United States, which hosts the API and the database and is administered by AC Dev itself. If any of these providers changes, this policy will be updated beforehand.
7. International Data Transfers
Your data may be transferred outside Brazil and your country of residence: (a) to the United States, where the server hosting the service and its database is located and where OpenRouter operates, as necessary to perform our contract with you (Art. 33(IX) LGPD; Art. 49(1)(b) GDPR); (b) to the United States and the European Union, by Stripe, Google, and LinkedIn, under lawful transfer mechanisms recognized by LGPD (Resolution CD/ANPD No. 19/2024) and GDPR (Chapter V), including the EU-US Data Privacy Framework (DPF) and Standard Contractual Clauses (SCCs); (c) to the People's Republic of China, by DeepSeek. China has no adequacy decision from the ANPD or the European Commission, and no Standard Contractual Clauses are in place with DeepSeek. This transfer relies on your specific and explicit consent (Art. 33(VIII) LGPD; Art. 49(1)(a) GDPR), requested before your first resume upload, which you may withdraw at any time by deleting your account.
8. Cookies & Local Storage
Strictly necessary cookies are always on: an encrypted httpOnly session cookie and a cookie to remember your language preference. When you arrive through a campaign link or from another site, we set a first-party cookie (botin_attr), valid for 90 days, holding the campaign, referring site, and landing page; it is read only if you create an account, to record where the account came from, and is never overwritten. Analytics cookies from Google Analytics (_ga, _ga_*) are set only if you accept them in the cookie banner; they measure page visits and traffic sources and are never used for advertising or ad personalization. You can withdraw consent at any time via "Cookie preferences" in the site footer, which removes those cookies. We also use Umami, a self-hosted analytics tool that sets no cookies and does not identify you. We do not use Meta Pixel or advertising trackers. The extension stores local credentials and settings securely inside your browser's extension storage.
9. Data Retention & Account Deletion
Your personal data is retained only while your account remains active. You can export a full copy of your data or permanently delete your account at any time directly in your Profile settings. Some data is deleted sooner, automatically: abandoned application sessions and job fit and requirement analyses after 30 days; resumes tailored to jobs after 90 days. When you delete your account, your profile, resume, Q&A Bank, application history, and form-filling failure records are deleted with it. Technical error logs, used to diagnose service failures, keep the email of the account that produced them. LLM cost accounting logs have user identifiers dissociated (anonymized) upon account deletion to preserve aggregate financial records without personal attribution.
10. Your Rights as a Data Subject (LGPD & GDPR)
You hold comprehensive rights under Art. 18 of LGPD and Arts. 15-22 of GDPR, including: (a) Confirmation of processing and access to your data; (b) Correction of inaccurate, incomplete, or outdated data; (c) Data portability via structured JSON download in your Profile; (d) Deletion and erasure of your account and personal data; (e) Information about public and private entities with whom data is shared; (f) Revocation of consent and objection to processing. Inquiries and requests are fulfilled free of charge within 15 days (LGPD) or 30 days (GDPR) via contato@acdev.com.br.
11. Notice for US & California Residents (CCPA/CPRA)
For residents of California and other US states: AC Dev does NOT sell your personal information and does NOT share your personal information for cross-context behavioral advertising, as defined under the CCPA/CPRA. You have the right to know what categories of personal information are collected ('Notice at Collection'), request deletion of your information, and correct inaccuracies without discriminatory treatment.
12. Children's Privacy (COPPA)
botin is exclusively intended for individuals aged 18 and older seeking employment opportunities. We do not knowingly collect personal data from children or individuals under 18 years of age. If we become aware that personal information from an underage individual was collected inadvertently, we will delete it promptly.
Questions or Privacy Requests?
To ask questions about this policy or exercise your data protection rights, email our Data Protection Officer at contato@acdev.com.br.