Privacy notice

Last updated 30 September 2026

We built Throughline to keep as little personal data as possible. You never need an account to see your score. This notice explains what we collect, why, how long we keep it, who else handles it and what your rights are under the Data Privacy Act of 2012 (Republic Act No. 10173).

Who is responsible

Throughline is the personal information controller for this service. For any privacy question or request, contact our support address.

What we collect, why, and for how long

Resume and job description (free check): used only to compute your score, and your tips if you are signed in, while you wait. They are processed in memory and never stored in a database, on disk or in logs. Basis: your request for the service.
AI tips, tailoring, Polish, cover letters and interview prep: the text is sent to an AI model through OpenRouter with provider data collection turned off. In resume text, we replace email addresses and phone numbers we detect with placeholders, and withhold government ID numbers (SSS, TIN, PhilHealth, Pag-IBIG, UMID, passport and similar) and labeled lines such as birth date, age, sex, civil status, religion, height, weight and health. Masking may miss unusual formats. Your name and work history are sent, because the tips and rewrite need them. We do not keep the tips after you leave the page. When you press Polish in the builder, only that line and its role or school are sent, with the same masking. When you write a cover letter or prepare for an interview, your tailored resume (masked the same way) and the job post you paste are sent, and for a cover letter also the company and hiring manager name you type. Job-post text and names you enter in those fields are not masked, so avoid including sensitive details there.
Tailored resumes: when you tailor a resume we keep the result (your reworded resume, which includes your contact details) and the keywords taken from the job post. It is available for 30 days, then expires; scheduled cleanup deletes expired records where the database supports it. You can delete it at any time from My resumes, and it is deleted with your account. A cover letter or interview prep you create for a tailored resume is kept with it and deleted with it. We do not store your original upload or full job post text on our server, including the post you paste for a cover letter. Temporary copies may remain in your browser. Basis: our contract with you.
Built resumes: when you build a resume while signed in, we keep what you type (including your contact details) so you can edit and download it. Each one is kept until you delete it or your account, is included when you download your data, and you can have up to ten. Basis: our contract with you.
Applications you track: what you enter about each job application (company, role, job link, status, dates and notes) and which tailored resume you linked. Kept until you delete it or your account, and included when you download your data. Basis: our contract with you.
Builder drafts: if you build a resume without signing in, the draft stays only in your browser's storage on that device. We receive it only when you sign in to save or download it.
Account (optional): your email address, the display name Google provides if you sign in with Google, and your credit history. Kept until you delete your account. Basis: our contract with you.
Purchases, when enabled: PayMongo hosts the payment page, and we do not receive your card or wallet details. We keep a record of each purchase (pack, amount, time, status and PayMongo's reference). Paid purchases are kept as long as tax and accounting law requires. Unpaid checkouts are scheduled for deletion after 90 days where database cleanup is available. Basis: our contract with you and our legal obligations.
Abuse protection: Cloudflare Turnstile checks that you are not a bot, and we count requests per network. The counter stores a one-way hash of your IP address (for IPv6, of its network prefix) that expires within hours, never the address itself. Basis: our legitimate interest in keeping the service available.
Service metrics: our own logs record only counts, timings, scores, categories and error codes, never your resume, job description, email or name. Our hosting provider keeps standard request logs, including IP addresses, for a short period.
Visit counts: Vercel Web Analytics counts page views, the page you came from, and your country, browser and device type. It sets no cookies and does not identify you or follow you across other sites. Basis: our legitimate interest in knowing which pages help people.
Earlier pack interest: if you used the “I’d buy this” button while it was available, we saved the pack you chose with your account to understand demand. We no longer ask for this on the pricing page. The record is included in your data export and deleted with your account. Basis: your consent when you selected it.
Sign-in round trip: if you press "Sign in to tailor", a copy of your text is kept in that browser tab so you do not have to paste it again. It can be used for up to 30 minutes; an unread copy may remain until the tab closes or you clear site data. This browser copy is sent to us only if you continue.
Waitlist: if you join, your email is stored by our form provider (Formspree), used only to tell you when paid packs open. It is separate from your Throughline account, so deleting your account does not remove that email; contact us to remove it at any time. Basis: your consent.

Sensitive personal information. Our service does not need your age, birth date, civil status, religion, health details or government ID numbers. We suggest leaving them out of your resume. If they are in it, we remove the ones we detect before resume text is sent to the AI provider, but automated masking may miss unusual formats. Do not include these details unless needed. Review and remove any sensitive details that appear in a tailored or built resume you save.

Automated processing. Your match score is calculated automatically by fixed, published rules. It is advice for you only: we do not send it to employers or use it to make any decision about you.

Cookies and browser storage

Sign-in uses necessary cookies, and Cloudflare Turnstile may use its own storage for bot checks. We use no first-party analytics or advertising cookies; Vercel Web Analytics does not use cookies. A few things are kept in your own browser, as described above. Our cookie policy lists each one and how long it lasts.

These providers process data for us under their own security terms. Some of them process it outside the Philippines.

Vercel (hosting and visit counts, United States and global edge network)
Supabase (accounts, credit history, purchases, earlier pack interest, tailored and built resumes, cover letters, interview prep and tracked applications; Singapore)
OpenRouter and the AI model providers it routes to (tips, tailoring, cover letters and interview prep; mainly the United States; data collection turned off)
Upstash (hashed rate-limit counters only)
Cloudflare (Turnstile bot check)
Google (only if you choose Google sign-in)
PayMongo (payments; Philippines)
Formspree (waitlist; United States)

Job listings on our jobs pages link to other websites, which have their own privacy policies. We send them nothing about you, but they may collect data when you visit them.

We do not sell personal data, and we do not use advertising trackers.

How we protect it

All traffic is encrypted in transit (HTTPS), and the database is encrypted at rest.
Row-level security in the database means each account can reach only its own records. Server-only keys never reach your browser.
Responses that carry resume text are marked never to be cached.
Deleting your account removes your sign-in, profile, tailored and built resumes (with their cover letters and interview prep) and tracked applications. Credit history and paid purchase records may remain for accounting with the account ID removed. Browser storage on your device and a separate waitlist email are not cleared by account deletion.

Your rights

Under the Data Privacy Act you have the right to:

be informed about how your data is processed (this notice);
access your data, and get it in a portable format: use Download my data on your account page;
correct inaccurate data: edit a tailored resume directly, or contact us;
object to processing, and have your data erased or blocked: delete a tailored resume or your whole account yourself, or contact us;
withdraw consent at any time, without affecting processing done before;
be compensated for damages caused by unlawful processing; and
file a complaint with the National Privacy Commission (privacy.gov.ph) if you think we mishandled your data. We would be grateful for the chance to fix it first: our support address.

Children

Throughline is for job seekers aged 18 and over. Younger users, such as students looking for OJT, may use it only with a parent or guardian's permission. If you believe a child gave us personal data without that permission, contact our support address and we will delete it.

Data breaches

If a personal data breach requires notification under NPC rules, we will notify affected people and the Commission within the required period, generally 72 hours after we learn of it or reasonably believe it occurred.

Changes

If we change how we handle personal data, we will update this page and its date before the change takes effect.