Privacy Policy

1. Who we are and what this covers

This policy is issued by UnitPulse, 641, Ravi Block, Allama Iqbal Town, Lahore, Pakistan (“UnitPulse”, “we”, “us”). We provide the website at unitpulse.io, the web app at app.unitpulse.io and the UnitPulse browser extension. This policy covers all three. It doesn’t cover the job boards and other websites you visit, which have their own policies.

Where data protection law applies, UnitPulse is the controller of the personal data described here. You can reach us at contact@unitpulse.io.

2. What we collect

Account information

• Your email address and, if you sign up with a password, a hashed and salted version of it. We never store passwords in plain text.
• If you sign in with Google, Microsoft or Apple, we store the provider’s account identifier and the email address it gives us, so we can recognize you next time.
• If you turn on two-factor authentication, an encrypted authenticator secret and hashes of your recovery codes.
• Your plan, billing interval, active job platforms, usage counts and preferences.

Jobs you choose to analyze

When you run an analysis — from the extension on a job page, or by pasting a link or text into the web app — we process and store the posting’s public details (such as the title, company, description, pay, poster name and role, and any contact details shown in the listing) together with the score and evidence we generate, so your report history stays available to you.

To avoid repeating work, a completed analysis of a specific posting may be reused to answer the same posting for up to 7 days, including for a different user. What’s reused is the public job data and the evidence about it. Your identity, your CVs and your feedback are never part of that.

Uploaded resumes and ATS matching

• The resumes you upload (PDF or DOCX), the text and skills extracted from them, and which one you’ve marked active.
• They’re used only to calculate your own ATS matches. We don’t share them with employers, recruiters or anyone else, and they’re never used to train anything.

Connections you choose to make

If you connect your own Upwork developer app, we store the client ID, client secret and access and refresh tokens, encrypted at rest, so the app can fetch client details for the Upwork jobs you analyze. You can disconnect at any time, which deletes them.

Things you send us

• Feedback you attach to a report (for example “scam”, “no response”, “interviewed”, “hired”).
• Messages you send through the contact form or by email: your name, email address, any company you give, the message itself, and the IP address and browser user agent of the submission, which we keep to prevent abuse of the form.
• Your email address if you join a waitlist.

Technical data

Our servers process the usual request data needed to operate and secure a web service, such as IP address and user agent. We don’t use it to build a profile of you.

3. What we don’t collect

We don’t collect your browsing history, your private messages or DMs, or your contacts and connections. The extension doesn’t read pages other than those described in section 4, and it reads your own profile only when you click to capture it. We don’t use advertising trackers, analytics scripts or fingerprinting on this website or in the app.

4. The browser extension

The extension is how UnitPulse sees a job the way you see it. Here is exactly what it does and when.

Permissions

• storage — keeps your session token, your settings and a cached copy of the page-reading rules in your own browser.
• scripting and access to linkedin.com — lets the extension read the LinkedIn pages described below when you run an analysis.
• It also runs on supported job sites: LinkedIn, Upwork, Indeed, Glassdoor, Wellfound, ZipRecruiter, Monster, Work at a Startup (Y Combinator), Fiverr, Freelancer, Guru, Toptal and Google’s job search results, and on app.unitpulse.io only to receive your sign-in.

While you browse

• On a supported job page it reads the posting in front of you and shows a quick score calculated in your browser. No job data is sent to us until you choose to run an analysis.

When you run an analysis

• It sends the details it read from that posting to our server over HTTPS and returns your report.
• On Upwork, it includes the “About the client” details shown with the job — on the job’s own page, in the job panel of a search page, or in the job details on the apply and proposal pages.
• On Indeed, it also reads the employer’s Indeed company page linked from the posting (its facts box: CEO, founded, size, revenue, industry, headquarters and website), fetched with your own Indeed session, to check the company matches the job.
• On LinkedIn, it also reads two things about that one posting:
  • the hiring company’s LinkedIn page — its listed website, industry, company size, type and headquarters — using your own signed-in LinkedIn session, opened in a background tab for a few seconds or fetched directly, and, if those details are missing, the company’s public LinkedIn page, fetched without your session;
  • the public version of the job page, fetched without your session, to see the poster name and headline shown there, where Apply leads, and the posting’s industry, employment type and location.
  Background tabs close automatically. It never opens the poster’s or anyone else’s profile. This happens once per analysis you start — never while you’re just browsing, and never across search results or other pages.

Only when you switch it on or click

• Profile capture. On your own Upwork profile, a bar offers to save that profile to UnitPulse. It reads the page only when you click.
• LinkedIn profile PDF. If you upload the PDF LinkedIn makes of your profile (Save to PDF), we read it once and keep your profile details (headline, summary, skills, positions, education). The file itself is not stored.

The extension never posts, applies, messages, connects or clicks anything on your behalf, never reads lists of jobs or other people’s profiles, and does nothing on its own in the background.

5. Using UnitPulse with Claude (MCP connector)

You can connect your UnitPulse account to Claude, Anthropic’s AI assistant, so Claude can use UnitPulse for you while you chat. This only happens if you add the UnitPulse connector in Claude and approve it on our sign-in page, and it uses the open Model Context Protocol (MCP).

• The access we issue. When you select Allow, UnitPulse issues Claude OAuth access and refresh tokens limited to the permissions you approved. We store only hashed versions of these tokens, never the tokens themselves. Access tokens expire after an hour and refresh tokens after 30 days, and you can revoke them at any time in Settings → Connected apps.
• What we receive. Only what Claude sends when it uses one of our tools: the job text and links you ask it to check, optional structured job details such as the title, company or platform, and the ids of your own reports or CVs. A job analyzed this way is processed exactly like one you analyze in the web app (see section 2).
• What we return. Tool results, such as scores, report details, client details, CV match results and summaries of your profile and CVs, are returned into your Claude conversation. That conversation is hosted by Anthropic under its own terms and privacy policy, which govern what happens to it there.
• Retention and deletion. Reports created through Claude are kept like any other report in your account (see section 12). Disconnecting Claude revokes its tokens, and deleting your account deletes those reports and tokens along with the rest of your data.
• Team accounts. If your account belongs to a UnitPulse team, the team’s managers can see the jobs you analyze, including jobs analyzed through Claude.
• What we never access. UnitPulse has no access to your Claude chat history, your other conversations or Claude’s memory. We only see the requests Claude sends to UnitPulse.

6. How we use your information

• To provide the service: score jobs, build reports, keep your history, calculate ATS matches, sign you in.
• To enforce plan limits, count usage and handle billing.
• To keep the service secure and prevent abuse, including of the contact form.
• To answer your support messages.
• To improve accuracy of the checks, using the feedback you choose to give.
• To meet legal obligations.

Where the GDPR applies, we rely on performance of a contract (providing the service you signed up for), our legitimate interests (keeping the service secure, improving checks, answering your messages) and, where relevant, legal obligation.

7. Public-source lookups we make to verify a job

To check whether a company, a role or a poster is real, our server queries public-information sources. Depending on the job, these can include:

• Domain registration records (RDAP) and DNS records, including mail configuration.
• Certificate transparency logs and the Internet Archive, for a domain’s history.
• Public company references, such as Wikidata and a public company-name lookup.
• A web-search provider (Brave, Serper, Google Programmable Search or DuckDuckGo), including a search for a short, distinctive phrase from the posting to see whether the same text is published by a different employer.
• The employer’s own website, careers page and public hiring board (Greenhouse, Lever, Ashby, Workable or SmartRecruiters).
• On Professional and Enterprise plans, the careers and contact details the company publishes on its own website, to show the best way to apply.

We send those services only the query terms the check needs — a company name, a domain, a job title, a short phrase from the posting, or the poster’s name as shown in the listing. We never send them your email address, your password, your CV or your account identity.

8. Information about people other than you

A job posting usually names someone: a recruiter, a hiring manager, a client. To answer “is this real?”, our reports may include public information about that person or company — their name and stated role as the job shows them, and contact details their employer has published for applicants. We rely on our legitimate interest, and the interest of the person reading the report, in preventing fraud and wasted applications.

• On LinkedIn, the poster’s name and headline come from the public version of the job page (section 4). We don’t read the poster’s profile.
• Reports are private to the person who ran them. We don’t publish, sell or syndicate them.
• Every item shows where it came from, so it can be checked and challenged.
• UnitPulse never contacts the people named in a report.
• If you’re named in a report and want it reviewed, corrected or removed, email contact@unitpulse.io.

9. Sharing and service providers

We don’t sell your data. We share it only with providers that run parts of the service for us:

Paid plans are sold through Creem (Armitage Labs OÜ, Estonia), our merchant of record: the seller on your receipt, which processes your payment under its own privacy policy. We share with Creem your email address, the plan you choose and an internal account reference, so your payment can be matched to your account. Your card details go to Creem directly and never reach us.

We may also disclose information if the law requires it, to protect our rights or someone’s safety, or as part of a merger or acquisition — in which case this policy continues to apply until you’re told otherwise.

10. What we never do

• We never sell your personal data.
• We never rent, trade or share your data for advertising, and we don’t let third parties use it for their own purposes.
• We never train AI on your data. Our scoring and ATS matching use no AI at all.
• We never use your accounts to post, apply, message, connect or click on your behalf. Our servers never sign in to job platforms or read them in bulk; the only signed-in reading is the extension’s, for an analysis you start (section 4).
• We never present a score as an accusation. Reports show likelihood and evidence, and we don’t support using UnitPulse to harass, discriminate against or defame anyone.

11. Cookies and local storage

We use cookies only to keep you signed in to the web app and to remember interface preferences such as a collapsed sidebar. There are no advertising or analytics cookies, so there’s no cookie banner to dismiss. The extension stores your session token and settings in your browser’s extension storage, not in cookies.

12. How long we keep data

13. Security

• Passwords are hashed and salted (scrypt) and never stored or transmitted in plain text.
• Two-factor secrets and Upwork credentials are encrypted at rest with AES-256-GCM.
• Traffic between your browser, the extension and our servers is encrypted in transit with HTTPS.
• Reports, CVs and settings are tied to your session — you can only see your own.
• You can add two-factor authentication to your account at any time.

No online service can promise perfect security, but we work to protect your information with reasonable safeguards.

14. International transfers

We operate from Pakistan, and our providers operate in the United States and the European Union. Your information is processed in those countries, which may not be where you live. Where the GDPR applies, transfers rely on the European Commission’s standard contractual clauses or another approved safeguard.

15. Your rights and choices

1. Access and portability. Ask for a copy of the personal data we hold about you.
2. Correction. Ask us to fix anything inaccurate, including in a report that mentions you.
3. Deletion. Delete your account from Profile in the web app. That permanently removes your reports, feedback, CVs and their files, connected credentials and sessions. You can also ask us to do it.
4. Objection and restriction. Object to processing based on our legitimate interests, including appearing in reports.
5. Complain. If you’re in the EEA or UK, you can complain to your local data protection authority.

If you’re a California resident: we don’t sell or share personal information as those terms are defined by the CCPA/CPRA, and we don’t discriminate against anyone who exercises their rights. To exercise any right, email contact@unitpulse.io from the address on your account, or use the contact form. We respond within the time the applicable law allows, normally within 30 days.

16. Children

UnitPulse isn’t directed to, or intended for, anyone under 16.

17. Changes to this policy

We may update this policy as the product changes. When we do, we revise the “last updated” date above, and for material changes we’ll give notice in the app or by email before they take effect.

18. Contact

Questions, requests or concerns about your data? Email contact@unitpulse.io. It’s the only email address we use, and it’s read by the team. Post: UnitPulse, 641, Ravi Block, Allama Iqbal Town, Lahore, Pakistan.