Privacy Policy

Last updated 7 October 2026

SuperImpress is run by YHR Technologies. This policy covers all of SuperImpress: this website, the app at app.superimpress.com, the docs at docs.superimpress.com, the MCP server your agent connects to, and the emails we send. If you have a question, write to support@superimpress.com.

What we keep

• Your account: your name, email address, and profile picture from Google, GitHub, or the email you sign in with. When you sign in with Google or GitHub, we also keep the tokens they give us for your sign-in. For each session, we keep your IP address and your browser's name.
• Your Career Record: the contact details, links, roles, projects, volunteering, education, certifications, publications, skills, and languages you give us.
• Your Target: the titles, locations, remote preference, experience, and least pay you are looking for.
• Your Work Rights: where you can work and on what terms, when each permit expires, and any security clearance you told us of.
• Your work: your Watches, decisions, notes, and applications, and the resumes, cover letters, and outreach messages you or SuperImpress write, including the name of anyone a message is addressed to and how you told us you know them.
• Your agent: which agent connected to your account, and when it made each call.
• Billing: your Plan, your Credit history, and your Dodo Payments customer and subscription IDs. We never see your card details.
• Messages: anything you send us by email.

We do not advertise, and we do not track you across the web. We count how people find, read, and use SuperImpress, and how SuperImpress itself is running, with PostHog. The list below says exactly what PostHog receives.

How we use it

We use your data only to run SuperImpress for you. That means marking which Postings fit your Target, judging them, writing resumes and letters, sending sign-in links and digest emails, taking payments, answering your messages, keeping the service running, and stopping abuse. We do not sell your data, we do not use it for advertising, and we do not train any model on it.

What goes to an AI model

Whenever Autopilot is on, on either Plan, it sends what it is answering to an AI model. It judges Postings and chooses what goes on a resume with Jev, a model from Typesafe, and when Jev cannot answer, it asks a model from Anthropic by default, or from OpenAI if we change providers. It writes cover letters and outreach messages with Anthropic's or OpenAI's model. Every call sends the Posting, with our brief on the company, or, for a Kit, the Angle and the company name you gave it.

We never send these models your name, your email address, your phone number, or any of your links, and we never send the name of someone you address a message to. Where a letter needs them, the model sees a stand-in such as {{name}}, and we put the real words back before we store it. Everything else in your Career Record goes as you wrote it, so if a bullet names your website or your email, the model reads that too. Leave them out of your bullets if you would rather they stay with us.

What else we send depends on what we are asking for. To judge a Posting, we send the city and country you are based in (never your street), your whole Target, including the least pay you will take, your Work Rights, including any security clearance, and your whole Career Record: your roles, projects, volunteering, education, certifications, publications, skills, and languages. To choose what goes on a resume, we send that same Career Record, and the part of your Target that says which titles you want and how much experience you have. To write a cover letter or an outreach message, we send the Career Record, and, when the message is addressed to someone you named, how you told us you know them. Anthropic's and OpenAI's API terms say they do not train models on this data by default, and Typesafe's terms say it does not train or fine-tune any model on it.

When you connect your own agent over MCP, it reads your data as you, and the provider that runs your agent receives what it reads. That exchange is between you and that provider, under their terms.

Who else handles your data

• Cloudflare hosts SuperImpress, including its database, files, and logs.
• Typesafe, and Anthropic or OpenAI, run Autopilot's models, as above.
• Resend sends our emails.
• Dodo Payments takes payments. It receives your name and email address at checkout, and it keeps its own payment records.
• Google and GitHub sign you in, if you choose them.
• PostHog counts how people use SuperImpress and tells us how it is running. PostHog's code is bundled into our own pages and loads nothing from PostHog, and it stores nothing in your browser: no cookie, and nothing else. The marketing and docs sites count visits and clicks without identifying anyone. In the app, and in what our servers send about what you do there or through your agent, PostHog knows you by an opaque ID, and never by your email, your name, or anything you wrote. What our servers send about you carries only IDs, counts, job board names, and choices such as your Plan; what the app sends also carries the page you are on and your browser's name, system, and screen size. What our scanner, our digests, and our queues did names no one, though an event can carry the ID of a record it is about, such as a resume's. Errors are sent with their messages only when our own code raised them; any other error is sent as its type and where in our code it happened. Your browser reaches PostHog through e.superimpress.com, so, like any website, it receives your IP address. The data is held in the EU. Deleting your account deletes your PostHog person, so the events already sent stay only under an ID that no longer belongs to anyone.

These companies may process your data outside your country, including in the United States. We share nothing with anyone else unless the law requires us to.

The SuperImpress scanner reads public job boards only. It sends nothing about you to any company.

Cookies

The app sets one cookie to keep you signed in, better-auth.session_token. While you sign in, it may also set short-lived cookies that complete the sign-in. Your browser also remembers your light or dark theme. We set no tracking or advertising cookies, so we show no cookie banner.

How long we keep it, and deleting it

We keep your data while you have an account. You can delete your account at any time from Settings. Deletion takes effect at once. It removes your Career Record, your Target, your work, your files, and your account, and it cancels Pro.

Once your account is gone, we tell PostHog to delete your person, the record that ties its events to you. Our database backups can hold copies for up to 30 days before they expire, and our servers' logs, which can quote what you wrote when something fails, expire after 7 days. Dodo Payments keeps the payment records that tax law requires.

Your rights

Wherever you live, you can ask us to show you the data we keep about you, correct it, delete it, send you a copy, or stop using it. You can correct most of it and delete all of it in the app yourself. For a copy of your data, write to support@superimpress.com, and we send it as a file within 30 days. We answer every other request within 30 days too, and we charge nothing for any of them.

Security

Every connection to SuperImpress is encrypted. There is no password to steal, because you sign in through Google, GitHub, or a link we email you. No system is perfectly secure. If we learn of a breach that affects you, we tell you.

Age

SuperImpress is for people aged 16 and over. If you believe someone younger has given us their data, write to us and we will delete it.

Changes to this policy

When we change this policy, we update the date at the top. Before a material change takes effect, we email you.