Privacy Policy
We respect your privacy. This page explains what personal data we collect, why we collect it, how long we keep it, and the choices you have. Below we list the categories of personal information we collect, our purposes for using them, and our retention periods.
Last updated: August 10, 2026
1. Introduction
Bespree ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our job search platform and services.
2. Information We Collect
2.1 Personal Information
When you register for an account, we may collect:
- Name and contact information (email address, phone number)
- Profile information (location, work preferences)
- Resume and employment history
- Authentication information (through Google Sign-In)
2.2 Usage Information
We automatically collect information about your use of our services:
- Device information and browser type
- IP address and coarse location inferred from your connection (see Section 8)
- Usage patterns and preferences
- Cookies and similar technologies
3. How We Use Your Information
We use your information to:
- Provide and improve our job search services
- Match you with relevant job opportunities
- Communicate with you about our services
- Ensure security and prevent fraud
- Comply with legal obligations
4. Information Sharing
We may share your information with:
- Employers when you apply for jobs
- Service providers who assist our operations
- Legal authorities when required by law
- Business partners with your consent
We do not sell your personal information to third parties.
We also do not share personal information for cross-context behavioral advertising.
5. Google Sign-In
We use Google OAuth 2.0 to let you sign in securely with your Google account. We do not receive your Google password.
- Data we receive: your Google account ID, name, email address, and profile picture (if available).
- Scopes we request:
openid,email,profile. We do not request access to Gmail, Contacts, Calendar, Drive, or other Google data. - How we use it: solely for authentication and account creation (and to prefill your profile, if you choose). We do not post to Google or share this information with third parties without your consent.
- Token handling: we store minimal OAuth identifiers/tokens needed to maintain your session. Tokens are subject to provider expiry/rotation and are protected in our systems (e.g., encryption at rest where supported).
- Disconnect at any time: you can disconnect Google from your Bespree account in Settings, or revoke access from Google’s Third‑party access page.
Your use of Google services is governed by Google’s Privacy Policy and Terms of Service.
6. Facebook Login
If you choose to sign in using Facebook Login, we receive limited information from Facebook such as your name, email address, and profile picture (if available). We use this information solely for authentication and account creation. Your use of Facebook is also governed by Facebook’s Privacy Policy.
7. Data Security
We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction.
8. Geolocation and Analytics
This section explains how Bespree and its infrastructure providers process IP addresses and derived location data for routing, localization, security, and analytics. We limit the location data used by the application and do not use precise device location for these purposes.
8.1 How we collect location information
Our hosting and security infrastructure receives the IP address associated with a request. Bespree may use coarse geographic attributes derived from that connection, such as country or region, to localize the service and help prevent abuse. We do not use GPS, Bluetooth beacons, or mobile device sensors for this purpose.
8.2 Data we process
- Network request data: our hosting and security providers may process the full IP address needed to route and protect a request.
- Application data: Bespree may process coarse geographic attributes and limited technical metadata for localization, security, and consent handling. We minimize or pseudonymize identifiers where supported by the relevant system.
- Manual signup record: when you create an account with email and password, Bespree stores the IP address and browser user agent used to record your acceptance of the Terms on your account.
- We do not collect for this purpose: precise street addresses, household-level coordinates, GPS location, Bluetooth-beacon data, or mobile-sensor location.
8.3 Legal basis and transfers
We rely primarily on legitimate interests (GDPR Art. 6(1)(f)) to provide localized content, maintain security, and prevent abuse. Where local law requires consent for specific analytics features, we will request it separately. For cross‑border transfers, we rely on standard contractual clauses or other recognized safeguards. You may object to this processing at any time—see your rights below.
8.4 Retention
- Operational and security records are kept under the configured retention schedules of the systems and service providers that process them. We review those schedules and minimize retained identifiers according to the purpose of each record.
- The IP address and browser user agent recorded for Terms acceptance remain on the active account and are removed with the account.
- Aggregated, non‑identifiable statistics may be retained longer for analytics and reporting.
8.5 Sharing and disclosure
We do not sell geolocation data or share it for cross‑context behavioral advertising. Access is limited to authorized personnel, service providers under appropriate agreements, and regulators when required by law.
8.6 Your choices and rights
Depending on your location, you may have rights to object, access, correct, delete, or restrict processing of network and coarse geolocation data, and to exercise California privacy rights. To exercise these rights, contact us at privacy@bespree.com or use the options available in your account or via our contact form.
8.7 Safeguards
- Data minimization and pseudonymization where supported by the relevant system
- Encryption in transit; at‑rest encryption where supported by our infrastructure
- Role‑based access controls; audit logging for privacy events where implemented
- Retention schedules and deletion processes (automation where available)
- Privacy reviews for features using geolocation data
9. AI Features
Our resume builder includes optional AI-powered features to help improve your resume content. This section explains how these features work and how your data is handled.
9.1 Data we collect for AI features
When you use AI features, we collect and process resume content you provide, such as employment history, education, skills, and other sections you choose to improve with AI assistance.
9.2 How we use this data
Text you submit for AI suggestions (for example, resume sections you choose to improve) is sent to third-party AI providers acting as our service providers/processors. This data is used solely to generate suggested edits and improvements for your resume.
9.3 Your controls
AI features are opt-in. You must explicitly enable AI features before any resume content is sent to AI providers. You can enable or disable AI features anytime in your account Settings. You can build and use your resume without ever enabling AI features.
9.4 Consent tracking
When you enable AI features, we record the date and time of your consent and which feature triggered the opt-in. This helps us demonstrate that consent was freely given and allows you to withdraw it at any time with the same ease.
9.5 Data handling
- We aim to send only the content necessary to generate suggestions.
- Our agreements require AI providers to process data only to provide the service and protect it appropriately.
- Data may be retained by providers for a limited period for abuse monitoring and service integrity. For details, see the AI provider's enterprise data handling documentation.
9.6 California residents
We do not sell or share your data with third parties for their own purposes. AI providers act solely as service providers on our behalf.
10. Data Retention
We retain personal data only as long as necessary for the stated purposes. The periods below describe the lifecycle currently operated by Bespree; provider-managed logs and backups may follow separate documented schedules.
| Category | Purpose | Retention |
|---|---|---|
| Account profile | Provide and secure your account | While the account is active; removed from Bespree's active systems when account deletion is processed. We do not currently run an automatic inactivity purge. |
| Personal workspace data | Job application workflows | Until you delete an item or your account, or while needed to provide the service. This includes resumes, cover letters, applications, interview-prep records, and resume shares. |
| Support communications | Customer support & QA | While needed to respond, maintain service and security, meet legal obligations, or handle claims. Messages are also subject to the retention settings of our email provider. |
| Billing/transactions | Tax and accounting | As required by applicable tax, accounting, and other legal obligations. Limited transaction records may remain after account deletion. |
| Operational/security logs | Security & abuse prevention | Under the configured retention schedules of the relevant system or service provider; identifiers are minimized where supported. |
| AI request audit logs | Security and service integrity | Up to 90 days under an automated expiry schedule; deleted earlier when account deletion is processed. |
| Account consent and Terms fields | Account controls and compliance | Stored on the account while it is active and removed with the account. For manual signups, these fields include the signup IP address and browser user agent used to record Terms acceptance. |
| Deletion-request records | Document and resolve provider-initiated requests | Kept while needed to document and resolve the request. We are reviewing a fixed minimization and expiry schedule for these records. |
Retention may be extended to comply with legal obligations or to establish, exercise, or defend legal claims.
11. Legal Bases (GDPR)
| Purpose | Legal Basis | Examples |
|---|---|---|
| Provide the service | Art. 6(1)(b) Contract | Account creation, job applications, resume builder |
| Security & fraud prevention | Art. 6(1)(f) Legitimate interests | Abuse monitoring, pseudonymized logging |
| Analytics (non-essential) | Art. 6(1)(a) Consent | Aggregated product analytics (if enabled) |
| Payments & invoicing | Art. 6(1)(c) Legal obligation | Tax, accounting retention |
Where we rely on legitimate interests, we perform a balancing test and apply safeguards (e.g., pseudonymization, limited retention).
12. Agreement and Consent Records
When you create an account, accept our Terms of Service, or provide consent for optional features (such as AI features), we record limited account fields needed to operate those choices:
- Date and time of acceptance or consent
- Version of Terms accepted, where applicable
- Whether AI features are enabled and the consent source
- For manual signups, the IP address and browser user agent used when the Terms were accepted
These fields are stored on the active account and removed with the account. Technical request data used for security and abuse prevention is described in Section 8.
13. Your Rights
Depending on your location, you may have the right to:
- Access your personal information
- Rectification — correct inaccurate or incomplete data
- Erasure — delete your account and associated data
- Restriction — limit how we process your data in certain circumstances
- Portability — receive your data in a structured, machine-readable format
- Object — object to processing based on legitimate interests
- Withdraw consent — where processing is based on consent (e.g., AI features, analytics)
- Opt-out of marketing communications
- Lodge a complaint with your local supervisory authority (EEA/UK residents)
Need to delete your data? Visit our Data Deletion page for detailed instructions on how to request deletion of your personal information.
15. Children's Privacy
Our services are not intended for children. You must be at least 16 years old (or the age of digital consent in your jurisdiction) to use our services, as stated in our Terms of Service. We do not knowingly collect personal information from anyone under this age.
16. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last Updated" date.
17. Contact Us
Email: privacy@bespree.com
Postal address available upon request. For legal notices, email privacy@bespree.com and we will provide mailing details.
If you are in the EEA/UK, you may also contact your local supervisory authority.
If you have any questions about this Privacy Policy, we're here to help.
Privacy Questions?
Our team is here to help with any concerns.
Website: bespree.com