Privacy Policy

Last updated 2 November 2026

1. Who we are

Tildea (tildea.ai) helps you build a career profile, write resumes and cover letters for specific jobs, prepare for interviews and track applications. It is run by Kamyar Zeinalipour, in Italy, who is the data controller: the person responsible for your data under the EU General Data Protection Regulation (GDPR) and Italian data protection law.

Write to privacy@tildea.ai about anything on this page.

2. The short version

We keep what you put into Tildea (your profile, jobs and documents) so the service can work. We do not sell it, show you ads, or use tracking or analytics tools.
When Tildea writes or checks a document for you, or reads a resume you import, your profile and the job are sent to DeepSeek, an AI company based in China. Section 4 says exactly what is sent.
In Settings you can download everything we hold for you as one file, or delete your account. Deletion happens at once.

3. What we collect and why

WhatWhy, and on what legal basis

Your account: email address, name, and your password (stored only in scrambled, hashed form by our sign-in system) or your Google or LinkedIn sign-in. Passkeys if you add one: the device's name and a public key. Which version of the Terms of Service you accepted, and when.To give you an account, and to show which terms we agreed. Basis: the contract between us (GDPR Art. 6(1)(b)).

Your profile: everything you enter or import, such as work history, education, skills, publications, links and contact details. Some fields are optional and personal: date of birth, gender, nationality and home address. If you add references, their names and contact details.Every resume and letter is written from it. Basis: contract. Only add references who have agreed to be listed.

Jobs and documents: the jobs you save (including descriptions and your notes), the resumes, cover letters, emails and interview preparation written for them, and your answers in mock interviews.To write, keep and show you your documents. Basis: contract.

Resume files and links you import. The file itself is not kept: we read its text (scanned PDFs are read on our own server), show you what we found, and keep only what you choose to add.To fill in your profile. Basis: contract.

Payments, if you buy a plan: your Stripe customer number, plan and subscription status. Card details go to Stripe directly and never reach us.To give you what you paid for. Basis: contract, and our legal duty to keep accounting records.

Usage counts: which feature you used and when (for example, “resume built”).To apply your plan's limits and show you your usage. Basis: contract.

Security and error records: sign-in and form attempt counters (your email or IP address and a count), and error reports, which can include your IP address, browser and the page you were on.To stop abuse and fix faults. Basis: our legitimate interest in keeping the service safe and working (Art. 6(1)(f)).

Messages you send us, through the contact form or by email.To answer you. Basis: our legitimate interest in answering, or the contract if you are a user.

Reminder emails' settings and history, if you switch reminders on in Settings.To send the reminders you asked for, once each. Basis: contract. Switch them off in Settings at any time.

4. AI: what is sent to DeepSeek

Tildea uses one AI model provider, DeepSeek (api.deepseek.com). It is used when you build a resume, write a cover letter, email or interview preparation, improve a line, practise a mock interview, translate a document, import a resume, or press Suggest answers on an application form in the browser extension.

For these, our server sends DeepSeek the job description and your whole profile, including the optional personal fields above and any references, along with your email address. For an import it sends the text of your file, what you pasted, or what we read from your links. For a mock interview it sends your answers. For Suggest answers it sends the form's questions that are still empty, the job text from that page, and your name with the parts of your profile a resume would show (not your email or the optional personal fields). Questions about you, such as your right to work, salary, age, disability or consent, are never sent: only you answer those.

DeepSeek is based in the People's Republic of China. See section 6.

We do not use your data to train AI models. How long DeepSeek keeps what it receives, and what it may use it for, are set by DeepSeek's own terms.
What the AI writes is a draft for you to check and change. Tildea checks facts and figures in drafts against your profile, but the AI can still be wrong. Nothing is sent to an employer unless you send it.
The AI makes no decisions about you. Match scores are estimates to help you decide which jobs to pursue and what to improve; they are not shared with employers.

5. Who else receives data

We use these services to run Tildea. Each receives only what is listed, and only when that feature is used.

ServiceWhat it receives, and when

DeepSeek (China)Your profile, the job and your documents, for every AI feature (section 4).

StripeYour email address, Tildea account number and the plan you buy, when you pay. Stripe handles your card.

ResendYour email address and the email's content, when we email you: reminders you switched on, and replies to your messages. Sign-up confirmations and password reset links go through our sign-in system's email service.

Google, LinkedInOnly if you choose to sign in with them: they tell us your name, email address and profile picture.

Cloudflare TurnstileWhen you open the sign-up or password reset page, your browser loads a check from Cloudflare that tells people from bots. Cloudflare sees your IP address and browser.

Google FontsWhen a resume template is shown, your browser loads its typeface from Google, which sees your IP address.

Clearbit and company websitesCompany logos on your saved jobs, and on the extension's score card, are loaded by your browser from Clearbit (logo.clearbit.com) or the company's site, which see your IP address.

Tavily, DuckDuckGoWhen a resume is built, search queries about the company (its name, the job title and location), to research it. Nothing about you.

LinkdAPIOnly if you give a LinkedIn link when importing: your LinkedIn username, to fetch your public profile.

GitHub, Google Scholar, other sites you linkOnly if you give the link when importing: our server reads that page.

We also share data when the law requires it, for example in answer to a court order.

6. Data sent outside the EU

Tildea's own database and servers hold your data. Some of the services in section 5 are based outside the European Economic Area. In particular, DeepSeek is in China, a country for which the European Commission has not decided that data protection is adequate. Using Tildea's AI features means your profile and documents are sent there.

Write to privacy@tildea.ai to ask where a particular service processes data.

7. How long we keep it

Your account, profile, jobs and documents: until you delete them, or your account. A free account that goes unused for a long time (never less than 30 days) may be deleted: we email you first, wait at least 14 days, and keep it if you sign in.
Resume build progress (which holds the finished documents while the page collects them): 15 minutes.
Sign-in and form attempt counters: 25 hours.
Error reports: 90 days after the error was last seen.
Payment records are kept by Stripe for as long as tax and accounting law requires.
Messages to us: until the matter is closed. Ask us and we delete them sooner.

8. Your rights, and how to use them

Get a copy of your data: Settings, then Export my data, downloads one file (JSON) with everything we hold for your account: your profile, every document in full, your jobs, mock interviews, notifications, usage counts, sign-in devices and messages you sent us.
Correct it: edit your profile and documents at any time.
Delete it: Settings, then Delete account. Your account and everything in it are removed at once and cannot be restored, so export first if you want a copy. Any subscription is cancelled. What remains: Stripe's payment records, messages you sent us, and our staff's log of actions on accounts, with your account number removed.
Object, restrict, or ask about anything else: write to privacy@tildea.ai. We answer within one month; if a request is complex we may need up to two more months, and we will tell you so within the first month.

You can also complain to the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or to the authority where you live or work.

9. Cookies and browser storage

Tildea itself sets no cookies. It keeps a few things in your browser's own storage, all needed for the site to work as you use it:

Your sign-in session, so you stay signed in.
Your choices: that you have seen the cookie notice, your theme, template settings, drafts you have not saved yet, and which days you used Tildea (for the streak on your dashboard; the last 90 days).
If the browser extension is installed, its ID, so the site can talk to it.

There are no analytics, advertising or tracking tools. Cloudflare Turnstile, on the sign-up and password reset pages, may store data in your browser to tell people from bots. Fonts and logos loaded from other sites (section 5) are requests from your browser to those sites.

10. The browser extension

The Tildea extension is optional. It keeps in your browser: your sign-in, a copy of your profile, the jobs you scored (title, company, score and page address, up to 50) and your autofill answers. Those answers can include sensitive things you choose to enter, such as disability, veteran status or ethnicity for equal-opportunity forms; they stay in your browser and are never sent to Tildea. Signing out of the extension clears all of it.

Scoring a job: the job description and the page's address are sent to Tildea only when you press Score this job, or for every job you open if you switch on automatic scoring.
Saving a job sends its title, company, description and address to your Career Hub.
Reading your LinkedIn profile: only when you ask, from the import panel. The extension opens your own profile in a background tab, reads its text and sends it to Tildea for the import (section 4).
Filling a form: only when you press Fill with Tildea. It types your profile, your autofill answers and your saved answers into that page. What you then submit goes to that employer, under their own privacy policy.
Suggesting answers: only when you press Suggest answers. The questions still empty and the page's job text go to Tildea and DeepSeek (section 4). The suggestions are put into the form, marked for you to check, and are not kept by Tildea. We record that you used the feature, to count it against your plan.
Attaching a resume: when you press Attach, Tildea makes a PDF of the resume or cover letter you chose and the extension puts it into that form's upload.
Saved answers: answers you choose to save from a form are kept with your Tildea account, so the next form asking the same thing can offer them. You can change or delete them on the extension's Autofill answers page, and deleting your account deletes them. Questions about you are never saved this way.
Reporting a form: only when you press This form was not filled well and then Send. It sends the page's address, the form's field names and which fields were filled, never what is in them. We use it to make filling forms work better.

11. When our staff see your data

A small number of staff accounts can look up user accounts to give support, handle billing and stop abuse. The most senior staff can sign in as you to see a problem as you see it. Each time, this is recorded with who did it, when and from which IP address. Staff read messages sent to our support addresses.

12. Security

All connections to Tildea are encrypted (HTTPS), and browsers are told to use nothing else.
Database rules let an account read and change only its own data.
Passwords are stored only in hashed form. You can sign in with a passkey instead.
Sign-in, sign-up, password reset and forms limit repeated attempts.

No system is perfectly secure. If a breach puts your data at risk, we will tell you and the Garante as the law requires.

13. Children

Tildea is for people aged 16 and over. We do not check ages. If you think a child under 16 has an account, write to privacy@tildea.ai and we will delete it.

14. Changes to this policy

When this policy changes, the date at the top changes. If a change affects how we use data you have already given us, we will email you before it takes effect.

Questions about your data

Write to privacy@tildea.ai. The Terms of Service cover the rest of our agreement with you.