Privacy policy

Seal the Offer is run by OceanX Consulting Pty Ltd (ABN 67 615 055 368). We're a company in New South Wales, Australia. In this policy, “we” and “us” mean OceanX Consulting Pty Ltd, trading as Seal the Offer.

We are responsible for your personal information. Under EU and UK law, we are its “controller”. Questions about privacy? Email [email protected].

What you give us

• Your email address, to sign you in and send you your codes and your kit. If you use Google to sign in, Google also gives us your name and profile picture.
• Your resume. We read the text from your PDF or Word file, or the text you paste. We keep that text and the file's name, not the file.
• The job ad, as pasted text, a link, a file or photos. We keep its text and its link. We read photos and then throw them away: we never store the images.
• Your changes and answers: stories you edit, answers you give to our questions, ticks on your checklist, and questions you add.
• What an interview asked, if you tell us after it.
• Messages you send us, such as a refund request.

What we make for you

Your rules checklist, stories, free preview, Interview Kit, company brief and any application documents, such as a cover letter. Example stories and answers we make up for you are kept too, and are always labelled.

What we collect as you use the site

• Your country. Cloudflare works it out from your IP address, so we can show the right price.
• Your IP address and browser type. We save them with your sign-in session. We also use your IP address to limit how often anyone can ask for codes or start jobs. This stops abuse.
• A device code. A random code in a cookie, so each device gets one free preview. We store only a scrambled form (a “hash”) of it.
• Payment records. Stripe handles your card. We never see or store your card number. Stripe tells us what you bought, the price, your card's country and how you paid (for example, by card).
• AI usage logs. For each AI step, we log the step, the model, the time it took, its cost and whether it worked. These logs never hold your resume, the ad or what the AI wrote.
• Error logs. When something breaks, our server records the error so we can fix it.
• A friend's ratings. If a friend practises with you, we keep their 1 to 5 ratings and notes, and show them to you. We don't ask for their name or email.

Sensitive details

We don't ask for your date of birth, ID documents or bank details. Please leave sensitive details, such as your health or religion, out of your resume unless the job needs them. If you include them, we use them only to prepare your materials, because you chose to give them to us.

• To run the service you asked for: read the ad, check its rules, and write your preview, stories, kit and documents.
• To sign you in and keep your account safe.
• To take payments and give you what you bought, such as a pass, a gift or a discount.
• To set a fair price for your country. After you pay, we note your card's country to spot prices bought from abroad through a VPN.
• To stop abuse, such as people making extra accounts for more free previews.
• To email you: sign-in codes, receipts, news that your kit is ready, and reminders you can turn off.
• To fix problems and control our costs, using error logs and AI usage logs.
• To predict questions better. If you tell us what an interview asked, we may keep the questions, with nothing that identifies you.
• To follow the law, such as keeping tax records.

We never sell your personal information. We never use it to train AI models, and our AI provider doesn't either. We don't use it for advertising.

If you're in the European Union, the European Economic Area or the UK, the GDPR (or UK GDPR) applies. It asks us to give a legal reason for each use.

• Our contract with you: to run the service, sign you in, take payments and send emails about your account.
• Our legitimate interests: to keep the service safe, stop abuse, set fair prices, fix problems, control costs and predict questions better. We weigh these against your rights, and you can object.
• The law: to keep tax and payment records, and to answer lawful requests.
• Your consent: for anything we ask you to agree to. You can take your consent back at any time.

If your resume holds sensitive details, we use them only because you chose to include them. We use them only to prepare your application.

We follow the Australian Privacy Principles in the Privacy Act 1988. You can ask to see or correct the personal information we hold about you, and we'll reply within 30 days.

You can paste an ad and add a resume without giving us your email. You need an email address to see your free preview or buy a kit.

We may send your information overseas, as Where your data goes explains.

We share your data only with companies that help us run Seal the Offer, and only what each one needs. Each may use it only to provide its service to us.

Anthropic

Its Claude AI models read your job ad and resume and write your kit. Anthropic doesn't use data sent through its API to train its models.

Stripe

Takes payments. With Stripe Managed Payments, Stripe is the merchant of record: the seller on your receipt. Stripe then also looks after your payment data under its own privacy policy.

Resend

Sends our emails, such as your sign-in codes.

Cloudflare

Runs our domain, protects the site from attacks and bots, and tells us which country you're in.

Hostinger

Rents us the server that runs the app and holds our database, in a data centre operated by Hostinger.

Backblaze

Stores our encrypted nightly backups, which we keep for 30 days.

Evomi

A proxy service. We use it only to open a job-ad link you gave us, when the job site blocks our server. It never gets your name, email or resume.

Google

Signs you in, if you choose Continue with Google. Emails you send to [email protected] are kept in our Google mailbox.

A few people may also see some of your data:

• A friend you send a practice link to sees your questions and what a strong answer includes. Never your resume.
• A creator whose code you use sees only your country and what you bought.
• Courts, police or regulators, if the law requires it, or to protect someone's safety.
• A new owner, if Seal the Offer is ever sold. This policy would still apply to your data.

We're in Australia, but most of the companies that help us are based in the United States. Cloudflare works from data centres around the world. So your data is likely to be handled in the United States and other countries.

When data from the EU or UK leaves those places, we use the safeguards the law allows. One is the European Commission's standard contract terms, with the UK's addendum. Another is the EU–US Data Privacy Framework, for companies that have joined it.

We take reasonable steps to make sure each company protects your information as the Australian Privacy Principles require.

We keep data only as long as we need it. In detail:

Guest work

What you do before you sign in is deleted 7 days after you start, unless you sign in. Signing in moves it to your account.

Your account

Your resume, stories, jobs, previews, kits and documents stay until you delete your account.

Files and photos

Never stored. We keep only the text we read from them, and the file's name.

Sign-in sessions

Until you sign out, or 30 days after you last used the site, whichever comes first.

Sign-in codes

They stop working after 10 minutes, and we delete them a day later.

Limit counters

Deleted within 2 days.

Practice links

They stop working after 7 days. A friend's ratings stay with your kit until you delete it.

Backups

Encrypted, and deleted after 30 days.

Payment records

Our record of each order (what you bought, when, the price and the card's country) is deleted with your account. Stripe, which sells to you as the merchant of record, keeps its own payment records as tax laws require.

AI usage logs

Kept to track our costs. They hold no content, and we remove the link to you when you delete your account.

Emails to us

Kept while we need them to help you.

Wherever you live, you can:

• See and download your data. In Settings, choose Download my data. You get one file with your account, resume, stories, jobs, rules, previews and kits. For anything else we hold, email us.
• Correct it. Edit your stories and job details in the app, or add a new resume. Email us to change anything else, such as your email address.
• Delete it. In Settings, choose Delete my account. We delete your data at once and email you to confirm. Copies in backups are gone within 30 days. We keep payment records as the law requires.
• Object, or ask us to limit how we use your data.
• Take back your consent, where we asked for it.
• Move your data. The download is a standard JSON file that other services can read.

It's free. We reply within 30 days. We may first check that the request is really from you. For example, we may ask you to email us from your account's address.

These rights come from the GDPR in the EU and UK, and from the Privacy Act in Australia. India's Digital Personal Data Protection Act, 2023 gives you similar rights, including naming someone to act for you. If you live in California or another US state with a privacy law, you have similar rights. We won't treat you differently for using them.

We use only the cookies the site needs to work. We don't use analytics or advertising cookies.

Sign-in

__Secure-app.session_token keeps you signed in, for 30 days after your last visit. Before you sign in, it links you to the work you've started.

Device

app_device is a random code, kept for 1 year, so each device gets one free preview. We store only a scrambled form of it.

Google sign-in

__Secure-app.state lasts 5 minutes, and only if you use Google to sign in. It keeps that sign-in secure.

Cloudflare, which protects the site, may also set a security cookie to tell people from bots.

If we ever add analytics or advertising cookies, we'll ask for your consent first, and update this page.

Seal the Offer is not for anyone under 16. We don't knowingly collect data from children under 16. If you think a child has used it, email [email protected] and we'll delete their data.

• Everything between you and us is encrypted (HTTPS).
• Our server takes web traffic only through Cloudflare. Admin access needs a security key, and password logins are turned off.
• We don't use passwords. Sign-in codes are stored scrambled, work once and expire in 10 minutes.
• Practice links and device codes are stored only in scrambled form.
• Every page checks that the data it shows belongs to you.
• Our backups are encrypted.

No system is perfectly safe. If a data breach puts you at risk, we'll tell you, and the regulators, as the law requires. Found a security problem? Email [email protected].

AI writes your materials, but it never makes decisions about you with legal or similarly serious effects. See How we use AI for each step that uses it.

Please tell us first, at [email protected]. We'll reply within 30 days. If you're not happy with our answer, you can complain to:

• In Australia: the Office of the Australian Information Commissioner (OAIC), at oaic.gov.au.
• In the UK: the Information Commissioner's Office (ICO), at ico.org.uk.
• In the EU or EEA: the data protection authority in your country.
• Anywhere else: your local data protection authority.

When what we do changes, we'll update this page and the date at the top. If a change matters to you, we'll email you before it takes effect.

OceanX Consulting Pty Ltd, trading as Seal the Offer, New South Wales, Australia. Email: [email protected].