Privacy Policy
We respect your privacy. This page explains what personal data we collect, why we collect it, how long we keep it, and the choices you have. Below we list the categories of personal information we collect, our purposes for using them, and our retention periods.
Last updated: December 15, 2025
1. Introduction
Bespree ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our job search platform and services.
2. Information We Collect
2.1 Personal Information
When you register for an account, we may collect:
- Name and contact information (email address, phone number)
- Profile information (location, work preferences)
- Resume and employment history
- Authentication information (through Google Sign-In)
2.2 Usage Information
We automatically collect information about your use of our services:
- Device information and browser type
- IP address (pseudonymized in logs; see Section 8) and coarse location data
- Usage patterns and preferences
- Cookies and similar technologies
3. How We Use Your Information
We use your information to:
- Provide and improve our job search services
- Match you with relevant job opportunities
- Communicate with you about our services
- Ensure security and prevent fraud
- Comply with legal obligations
4. Information Sharing
We may share your information with:
- Employers when you apply for jobs
- Service providers who assist our operations
- Legal authorities when required by law
- Business partners with your consent
We do not sell your personal information to third parties.
We also do not share personal information for cross-context behavioral advertising.
5. Google Sign-In
We use Google OAuth 2.0 to let you sign in securely with your Google account. We do not receive your Google password.
- Data we receive: your Google account ID, name, email address, and profile picture (if available).
- Scopes we request:
openid,email,profile. We do not request access to Gmail, Contacts, Calendar, Drive, or other Google data. - How we use it: solely for authentication and account creation (and to prefill your profile, if you choose). We do not post to Google or share this information with third parties without your consent.
- Token handling: we store minimal OAuth identifiers/tokens needed to maintain your session. Tokens are subject to provider expiry/rotation and are protected in our systems (e.g., encryption at rest where supported).
- Disconnect at any time: you can disconnect Google from your Bespree account in Settings, or revoke access from Google’s Third‑party access page.
Your use of Google services is governed by Google’s Privacy Policy and Terms of Service.
6. Facebook Login
If you choose to sign in using Facebook Login, we receive limited information from Facebook such as your name, email address, and profile picture (if available). We use this information solely for authentication and account creation. Your use of Facebook is also governed by Facebook’s Privacy Policy.
7. Data Security
We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction.
8. Geolocation and Analytics
This section explains how we process IP addresses and derived location data for localization, security, and analytics. We apply safeguards so that only pseudonymized information is retained.
8.1 How we collect location information
We derive an approximate location from the network connection used to access our services. Our servers receive the IP address with your request (either directly or via trusted proxies) and are configured to apply truncation before logging or storage, so only a pseudonymized IP and coarse geographic attributes are retained. We periodically review our logging configuration to ensure full IPs are not stored. We do not use third‑party geolocation APIs, GPS, Bluetooth beacons, or mobile device sensors for this purpose.
8.2 Data we process
- Ephemeral (in memory only): raw client IP used momentarily to determine geography, then discarded.
- Pseudonymized data we retain: truncated or partially masked IP addresses and coarse geographic attributes (country, region/state, time zone, EU/California indicator), plus minimal cache metadata.
- We do not store: precise street address or household-level coordinates, full IP addresses in logs/datastores, ISP/carrier identifiers, or location linked to identified profiles without a separate lawful basis.
8.3 Legal basis and transfers
We rely primarily on legitimate interests (GDPR Art. 6(1)(f)) to provide localized content, maintain security, and prevent abuse. Where local law requires consent for specific analytics features, we will request it separately. For cross‑border transfers, we rely on standard contractual clauses or other recognized safeguards. You may object to this processing at any time—see your rights below.
8.4 Retention
- Pseudonymized IP and derived geo attributes: up to 60 days.
- GeoIP cache entries (geoip-lite): up to 24 hours.
- Aggregated, non‑identifiable statistics may be retained longer for analytics and reporting.
8.5 Sharing and disclosure
We do not sell geolocation data or share it for cross‑context behavioral advertising. Access is limited to authorized personnel, service providers under appropriate agreements, and regulators when required by law.
8.6 Your choices and rights
Depending on your location, you may have rights to object, access, correct, delete, or restrict processing of pseudonymized geolocation data, and to exercise California privacy rights. To exercise these rights, contact us at privacy@bespree.com or use the options available in your account or via our contact form.
8.7 Safeguards
- Pseudonymization of IP addresses before storage or logging
- Encryption in transit; at‑rest encryption where supported by our infrastructure
- Role‑based access controls; audit logging for privacy events where implemented
- Retention schedules and deletion processes (automation where available)
- Privacy reviews for features using geolocation data
9. AI Features
Our resume builder includes optional AI-powered features to help improve your resume content. This section explains how these features work and how your data is handled.
9.1 Data we collect for AI features
When you use AI features, we collect and process resume content you provide, such as employment history, education, skills, and other sections you choose to improve with AI assistance.
9.2 How we use this data
Text you submit for AI suggestions (for example, resume sections you choose to improve) is sent to third-party AI providers acting as our service providers/processors. This data is used solely to generate suggested edits and improvements for your resume.
9.3 Your controls
AI features are opt-in. You must explicitly enable AI features before any resume content is sent to AI providers. You can enable or disable AI features anytime in your account Settings. You can build and use your resume without ever enabling AI features.
9.4 Consent tracking
When you enable AI features, we record the date and time of your consent and which feature triggered the opt-in. This helps us demonstrate that consent was freely given and allows you to withdraw it at any time with the same ease.
9.5 Data handling
- We aim to send only the content necessary to generate suggestions.
- Our agreements require AI providers to process data only to provide the service and protect it appropriately.
- Data may be retained by providers for a limited period for abuse monitoring and service integrity. For details, see the AI provider's enterprise data handling documentation.
9.6 California residents
We do not sell or share your data with third parties for their own purposes. AI providers act solely as service providers on our behalf.
10. Data Retention
We retain personal data only as long as necessary for the stated purposes.
| Category | Purpose | Retention |
|---|---|---|
| Account profile | Provide and secure your account | While account is active + 24 months after last activity |
| Applications/Resumes | Job application workflows | Until you delete, or 24 months after submission by default (you can adjust this in Settings; we may retain longer if required by law) |
| Support tickets | Customer support & QA | 24 months |
| Billing/transactions | Tax and accounting | 7 years (or local law) |
| Server logs (pseudonymized) | Security & abuse prevention | ≤ 60 days (roll/rotate) |
| Geo cache (pseudonymized) | Performance | 24 hours |
| AI consent preferences | Demonstrate valid opt-in | While account active + 24 months |
| Terms acceptance records | Legal compliance | While account active + 7 years |
Retention may be extended to comply with legal obligations or to establish, exercise, or defend legal claims.
11. Legal Bases (GDPR)
| Purpose | Legal Basis | Examples |
|---|---|---|
| Provide the service | Art. 6(1)(b) Contract | Account creation, job applications, resume builder |
| Security & fraud prevention | Art. 6(1)(f) Legitimate interests | Abuse monitoring, pseudonymized logging |
| Analytics (non-essential) | Art. 6(1)(a) Consent | Aggregated product analytics (if enabled) |
| Payments & invoicing | Art. 6(1)(c) Legal obligation | Tax, accounting retention |
Where we rely on legitimate interests, we perform a balancing test and apply safeguards (e.g., pseudonymization, limited retention).
12. Agreement and Consent Records
When you create an account, accept our Terms of Service, or provide consent for optional features (such as AI features or analytics), we may record the following to help demonstrate your acceptance/consent and to protect against fraud and abuse:
- Date and time of acceptance
- Version of Terms accepted
- IP address (pseudonymized/truncated, for fraud prevention and legal compliance)
- Browser user agent
This information helps us maintain records of Terms acceptance and optional feature consent where applicable, and helps protect against fraudulent account creation.
13. Your Rights
Depending on your location, you may have the right to:
- Access your personal information
- Rectification — correct inaccurate or incomplete data
- Erasure — delete your account and associated data
- Restriction — limit how we process your data in certain circumstances
- Portability — receive your data in a structured, machine-readable format
- Object — object to processing based on legitimate interests
- Withdraw consent — where processing is based on consent (e.g., AI features, analytics)
- Opt-out of marketing communications
- Lodge a complaint with your local supervisory authority (EEA/UK residents)
Need to delete your data? Visit our Data Deletion page for detailed instructions on how to request deletion of your personal information.
14. Cookies & Analytics
We use essential cookies for core functionality. If you consent, we also use analytics to understand product usage and improve performance. We use Google Analytics 4, which does not log or store IP addresses; it may use network information transiently to derive approximate location. You can opt out via your browser settings or cookie preferences (where available).
- Essential cookies: strictly necessary for security and sign-in.
- Analytics cookies (optional): measure usage and product performance.
See our Cookie Policy for details.
15. Children's Privacy
Our services are not intended for children. You must be at least 16 years old (or the age of digital consent in your jurisdiction) to use our services, as stated in our Terms of Service. We do not knowingly collect personal information from anyone under this age.
16. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last Updated" date.
17. Contact Us
Email: privacy@bespree.com
Postal address available upon request. For legal notices, email privacy@bespree.com and we will provide mailing details.
If you are in the EEA/UK, you may also contact your local supervisory authority.
If you have any questions about this Privacy Policy, we're here to help.
Privacy Questions?
Our team is here to help with any concerns.
Website: bespree.com