Privacy Policy

Last updated: September 4, 2026

This Privacy Policy explains how 1stStep.ai ("we," "us," or "our"), operated from New Jersey, collects, uses, discloses, retains, and protects information when you use our platform at app.1ststep.ai or the 1stStep.ai Job Agent Chrome extension (together, the "Service").

1. Information We Collect

We do not ask the Chrome extension to collect or fill government IDs, Social Security numbers, health information, precise geolocation, employer passwords, passkeys, one-time codes, CAPTCHA answers, signatures, attestations, or answers about protected traits. The extension also excludes hidden fields, password fields, checkboxes, radio buttons, and final-submit controls from its approved-field workflow. Location preferences that you choose to save may be stored in your encrypted applicant vault.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the 1stStep.ai service
• Tailor your resume and generate AI outputs in response to your requests
• Find and deduplicate job opportunities that match criteria you choose
• Provide an explicit match assessment before filling approved fields on a supported employer page
• Authenticate and secure the extension-to-app handoff, prevent replay, and preserve a recoverable application checkpoint
• Verify your subscription status and enforce plan usage limits
• Respond to your support inquiries
• Send you transactional emails (e.g., payment receipts, renewal reminders) where applicable
• Comply with legal obligations under New Jersey and applicable federal law

We do not use your resume, job descriptions, or personal information to train AI models, build advertising profiles, or sell to third parties.

3. How Your Data Is Processed

When you request resume tailoring, job matching, or an application package, the information needed for that request is sent over HTTPS to our Vercel serverless functions. An approved AI provider may process the minimum resume, profile, job-description, and instruction content needed to produce the requested output. We do not use that content to train our own models.

If you enable secure backup or use Job Agent features, confirmed profile facts, documents, job-search preferences, application workspace records, and consent records are stored server-side in tenant-partitioned encrypted records. Encryption keys remain in server-only production configuration. The Chrome extension does not keep a reusable copy of your applicant vault or resume documents.

When the extension is enabled and you visit a supported Greenhouse page, it automatically reads the active listing's URL, job title, company, location, and job description so it can recognize the job and show its user-facing controls. That detected listing is held in Chrome session storage. It is not sent to 1stStep.ai merely because you visited the page.

When you choose to start the supervised fill workflow, the extension sends app.1ststep.ai the exact page URL and a value-free description of eligible form fields, such as field labels, types, options, and internal references. The server authenticates the signed-in session, reverifies the public job, checks your approval and application session, and calculates a match assessment. If the application is eligible, the server returns only the confirmed values approved for those fields and, where applicable, the approved resume file for that exact application. The extension does not retain those returned candidate values or resume bytes as a reusable profile.

After filling, the extension reports which approved field keys succeeded or failed so the Service can preserve the checkpoint. It does not send the entered values back in that completion report and does not click the employer's final submit control. The user must review the employer page and decide whether to submit.

4. Third-Party Services

We work with the following third-party providers who may process your data:

Public applicant-tracking services such as Greenhouse may be queried to verify a public job listing. When you direct the extension to fill an employer form, the approved values are written into that employer-controlled page and therefore become visible to the employer site's systems. The extension does not press the final submit control. We do not allow our service providers to use your data for our advertising or to sell it on our behalf.

5. Data Retention

Encrypted applicant-vault records, consent records, preferences, and schedules may be retained for up to 365 days after their most recent use. Application runs, generated-document objects, notifications, and related workflow records generally expire within 30 to 90 days. Content-free operational and spend measurements generally expire within 8 days, and signed extension handoff tokens expire within minutes.

The extension keeps the currently detected job in Chrome session storage for the browser session. A captured job awaiting delivery to the app is designed to be short-lived and removed after acknowledged delivery or expiry; because browser cleanup runs when the extension is active, an expired entry may remain locally until the next cleanup event, until you clear extension data, or until you uninstall the extension. Approved candidate values and resume bytes returned for a fill are used transiently and are not saved by the extension as a reusable profile.

Revoking an individual saved fact prevents its future use but may retain its prior encrypted version until the containing vault expires or the account is deleted. An account-deletion request removes the active tenant records and private objects controlled by 1stStep, subject to provider processing time and records that must be retained for security, payment, tax, dispute, or other legal obligations. Some payment and email-suppression records are maintained by the applicable provider under its own retention requirements.

6. Your Privacy Rights

Depending on where you reside, you may have the following rights regarding your personal data. To exercise any of these rights, email us at support@1ststep.ai. We will respond within 45 days; if we need more time, we will notify you and may extend the response period by an additional 45 days.

New Jersey residents have rights under the New Jersey Data Privacy Act (N.J.S.A. 56:8-166.1 et seq., effective January 15, 2025), including the rights listed above. If we deny your request, you may submit an appeal by emailing support@1ststep.ai with the subject line "Privacy Rights Appeal." We will respond to appeals within 60 days and will provide a written explanation of our decision. If your appeal is denied, you may contact the New Jersey Division of Consumer Affairs at njconsumeraffairs.gov.

California residents have rights under the California Consumer Privacy Act (CCPA), including the rights listed above. We will respond to verifiable consumer requests within 45 days.

7. Cookies and Local Storage

1stStep.ai uses a secure, HTTP-only session cookie for signed-in access and may use browser localStorage or sessionStorage for device-local workflow state. Information is transmitted to our servers when you request cloud backup, matching, tailoring, extension handoff, application preparation, export, deletion, or another server-backed feature.

The Chrome extension uses Chrome session storage for the currently detected job and Chrome local storage for a short-lived captured-job handoff. The extension authenticates server requests through the open app.1ststep.ai tab and its HTTP-only session cookie; it does not read or store that cookie, a bearer token, passwords, complete applicant-vault records, or reusable resume documents. Stripe may set cookies for fraud prevention and payment processing.

8. Chrome Extension

Single purpose. The extension's single purpose is to help a signed-in user review a supported Greenhouse job, understand its match assessment, and fill ordinary application fields with values the user has already confirmed. It is not a general browsing monitor, job-board scraper, credential manager, or autonomous application-submission tool.

Complete functional outline. The extension:

• Opens the 1stStep.ai setup page after installation so the user can sign in and configure the Job Agent.
• Recognizes supported Greenhouse job and application pages and extracts the active job title, company, location, description, requisition context, and page URL.
• Shows the detected job in the extension interface and lets the user correct a missing title or company.
• Lets the user paste a job description manually when a supported page does not provide one.
• Adds a visible 1stStep.ai action on supported job pages and can open the detected job in the 1stStep.ai resume-tailoring, cover-letter, or application-preparation workflow.
• Checks through an open 1stStep.ai tab whether the user has an authenticated session and access to Job Agent features. The extension does not read or store the HTTP-only session cookie.
• Uses a unique, short-lived capture identifier to deliver a selected job to the correct 1stStep.ai page and removes the captured job after acknowledged delivery or expiry.
• When the user requests filling, scans the supported application page for eligible text, email, telephone, URL, select, textarea, and approved resume-upload fields.
• Excludes hidden controls, password controls, submit controls, checkboxes, radio buttons, credentials, government identifiers, protected-trait questions, compensation acceptances, signatures, attestations, CAPTCHA and verification fields, and other consequential fields.
• Sends a value-free description of eligible fields to 1stStep.ai. Existing answers typed into the employer form are not included in that field-schema request.
• Requires the server to authenticate the user, verify consent and plan access, match the exact application session, recheck that the public Greenhouse requisition is still valid, and rate-limit the request.
• Shows a match-confidence score and tailoring justification. If the verified evidence does not support a credible match or meet the minimum filling threshold, it returns the user to review without candidate values.
• Requires a separate user action before filling approved fields.
• Receives only the approved values and, when applicable, the integrity-checked PDF resume associated with that exact application handoff.
• Fills eligible fields on the employer-controlled page and reports only which approved field identifiers succeeded or failed so the application checkpoint can be preserved.
• Leaves unsupported or consequential questions unanswered and never clicks the employer's final submit control.

Permissions used.

When it operates. The extension is limited to app.1ststep.ai and supported Greenhouse pages. On a supported page it detects the current job locally so it can present relevant controls. Website content is transmitted to 1stStep.ai only when needed for a user-facing action that you initiate, such as opening the job in 1stStep.ai or starting the supervised fill workflow.

What it does not do. The extension does not collect general browsing history, run on unrelated sites, execute remotely hosted code, bypass employer security controls, answer consequential questions, sell data, use data for personalized advertising or credit decisions, or automatically submit applications.

Limited Use. 1stStep.ai's use and transfer of information received through the Chrome extension complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. We use extension data only to provide or improve the disclosed single purpose and related security, reliability, and support operations. We do not transfer it to advertising platforms, data brokers, or information resellers. We do not permit people to read user-specific extension data unless you explicitly authorize access for support, access is necessary to investigate abuse or a security incident, access is required by law, or the data has been aggregated and anonymized for lawful internal operations.

Your controls. You can stop page access by disabling or uninstalling the extension, clear local extension data through Chrome, and request access to or deletion of server-side personal data by contacting us as described below. Uninstalling the extension does not automatically delete records stored in your 1stStep.ai account.

9. Data Security & Breach Notification

We use HTTPS for data in transit, authenticated encryption for protected server-side records, tenant-scoped access controls, revocable sessions, bounded access tokens, rate limits, and server-only provider credentials. Passwords, OTPs, CAPTCHA answers, and full payment card numbers are not stored by 1stStep. However, no method of internet transmission or electronic storage is 100% secure, and we cannot guarantee absolute security.

In the event of a security breach affecting your personal data, we will notify affected New Jersey residents as required under the New Jersey Identity Theft Prevention Act (N.J.S.A. 56:8-163). Notification will be made in the most expedient time possible and without unreasonable delay, and no later than 30 days after we discover the breach, unless a law enforcement agency determines that notification would impede a criminal investigation.

10. Children's Privacy

1stStep.ai is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has submitted personal information to us, please contact us and we will promptly delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date at the top of this page. For significant changes, we will make reasonable efforts to notify you by email or through a notice in the app at least 30 days before the changes take effect. Continued use of the service after changes are posted constitutes your acceptance of the updated policy.