Privacy Policy

1. Who we are

IStartMonday, Inc., a Delaware corporation, doing business as I start Monday ("I start Monday.", "we", "us"), operates istartmonday.com and the related applications and services described in these policies (the "Service"). Contact us at support@istartmonday.com or 2260 Homestead Ct, Unit 205, Los Altos, CA 94024.

2. Scope

This Privacy Policy applies to personal information processed through the Service. It does not govern third-party job sites, employer application systems, Google, Stripe, LinkedIn, or other services that have their own privacy policies. It also applies to creators in our partner program and to people who sign up with a creator's code or link.

3. Where your information is stored

Your career work is saved in your private account on our servers, so the same profile and documents are available on every device where you sign in. This includes:

• Original files you upload, such as resumes, cover letters, and certificates, up to 8 MB each
• Extracted facts, Master Profile drafts, and approved profile snapshots
• Generated CVs, Cover Letters, Annual Plans, Interview Cheat Sheets, and package answers, with every saved version, your edits, and any conflicting copy we keep so an edit is never silently lost
• Target roles, preferences, recent searches, job states, match scores, and application history

Access to this content is restricted to your account. Our admin tools do not display your career content. Production access is limited as described in Section 12.

Your browser keeps a cached copy of your saved work and a short queue of changes the server has not yet confirmed, so the app loads quickly and keeps working through brief connection drops. Signing out does not clear this cache. To remove it, clear this site's data in your browser. If you choose a download folder, the folder permission and any PDF or DOCX copies you download stay on your device and under your control.

When you ask for an AI feature, we send the content that task needs to an AI provider, as described in Section 8.

4. Personal information we process

• Account and authentication data. Name, email address, account identifiers, verification status, sign-in method (email and password, or Google), and authentication records. Our authentication provider stores a password hash; we never receive your plain-text password.
• Career and application content. Uploaded files, resume text, extracted facts, your Master Profile, target roles and exclusions, your work authorization and visa sponsorship answer, salary expectations, portfolio and LinkedIn links, instructions, generated documents and their versions, revision requests, package answers, and other content you add. This content is saved in your account as described in Section 3.
• Job and application data. Job titles, companies, descriptions, URLs, salary and location information, search keywords and locations, match scores and explanations, saved or archived status, application events, interviews, offers, tasks, and notes.
• Google account data. If you sign in with Google: your Google account identifier, name, email address, and profile image link as provided by Google. If you connect Gmail: the connected address, the permissions you granted, and encrypted authorization credentials, as described in Section 7.
• LinkedIn profile data. If you add your LinkedIn profile URL, the public profile information our lookup provider returns for it.
• Payment and credit data. Stripe customer and transaction identifiers, purchase amount, currency, status, receipts, refunds, promotional credits, and credit-ledger events. Stripe, not I start Monday., receives full card details through its hosted checkout.
• Support and feedback. Messages, tickets, bug reports, suggestions, a contact email for feedback sent without an account, and image attachments you choose to send (PNG or JPEG, up to 5 MB each).
• Consent records. Your acceptance of these policies at signup and your cookie choices, with the version and time.
• Acquisition data. How you found us, saved once with your account: the campaign tag of the link you opened (for example a channel name), the referral or creator code if you used a link or typed a code, the first page you landed on without any query string, the website you came from (host name only, never the full address), and when. We use it only to count which channels bring people to the Service. We do not use it for advertising or to follow you across other sites, and it is deleted with your account.
• Analytics data, only if you allow Analytics in the cookie banner. Google Analytics sets cookies in your browser and receives the pages you view (the address without its query string, except campaign tags), the website you came from (host name only), your browser, device, screen size, and language, your approximate location (country, region, and city, which Google Analytics derives from your IP address without storing the address), and whether you reach the end of a page. We do not send Google Analytics your name, e-mail address, account identifier, documents, profile, search keywords, or the links you click. For pages inside the app, record identifiers are removed from the address before it is sent.
• Page view counts. Our own server counts page views without cookies and without storing anything in your browser. For each page you open, the Service sends one request to our server, and we save the page address without its query string (inside the app, with record identifiers removed), the website you came from (host name only), the campaign tag of the link you opened, whether the device is a phone, a tablet, or a computer, the browser family, the time, and a one-way hash of your IP address and browser details combined with a secret key and the day. The IP address and browser details themselves are not saved, and because the day is part of the hash, it cannot follow you from one day to the next. These records are not linked to your account and are not sent to Google or any other analytics provider. This count does not depend on your cookie choice.
• Creator link visits. When you open a link that carries a creator code, our server counts the visit for that creator. We save the code, the day, the first page you landed on without any query string, the website you came from (host name only), and a one-way hash of your IP address combined with a secret key and the day. The IP address itself is not saved for this count, and because the day is part of the hash, it cannot follow you from one day to the next. Each IP address is counted once per code per day. This count does not depend on your cookie choice.
• Creator referral records. If you create an account with a creator's code, we record which creator the code belongs to, the date, the bonus credits we granted, and, for each payment you make, the commission we calculate for that creator. These records are kept with our billing records (Section 11).
• Creator program data. If you join the partner program: the social links you enter, the payout method (PayPal or Zelle) and the payout e-mail address or phone number you give us, your codes, the version of the Partner Program Terms you accepted and when, the clicks and sign-ups your codes bring, your commissions, reversals, and payouts, and, if we ask for one, a tax form and the tax identification number on it.
• Technical and security data. IP address, browser, operating system, device and session identifiers, timestamps, browser-storage values, request metadata, rate-limit counters, error records (which may include your account identifier and the error text), and security or audit logs. Our logging is designed to exclude the text of your documents.

5. How we collect information

• Directly from you when you create an account, upload files, build a Master Profile, search, generate documents, track applications, pay, contact support, or join the partner program.
• From connections you authorize, including Google and Stripe.
• From our LinkedIn profile-lookup provider when you add your LinkedIn URL, and from web pages you ask us to read, such as a portfolio link.
• Automatically from your browser, the application, and our security infrastructure.
• From job boards, employer sites, public web pages, and search or data providers used to find job opportunities.

6. How we use information

• Create and secure your account, save your work, and keep it in sync across your devices.
• Extract facts from your sources, build your Master Profile, and generate and revise the documents you request.
• Search for jobs, rank and explain matches, and maintain your application history.
• Create Gmail drafts when you ask, if you connected Gmail.
• Process purchases, keep an auditable credit ledger, prevent fraud, and restore credits after verified technical failures.
• Provide support, diagnose and fix errors, enforce storage and usage limits, protect the Service, and comply with law.
• Count which channels and pages bring new accounts, using the acquisition data in Section 4.
• Count visits and see which pages are used, with Google Analytics, only if you allow Analytics (Section 10).
• Count visits and see which pages and channels bring them, with the page view counts in Section 4.
• Run the creator partner program: attribute a sign-up to the creator whose code you used, grant the bonus credits, calculate and reverse commissions, show that creator the limited information listed in Section 9, pay creators, and detect self-referral and fake sign-ups.
• Improve product reliability using aggregated or de-identified operational information. We do not use your career documents or Google data for advertising, and we do not use them to train AI models.

7. Google and Gmail data

Sign in with Google is optional. If you use it, Google shares your account identifier, name, email address, and profile image link with us and our authentication provider.

Connecting Gmail is optional and separate from signing in. When the feature is available to your account, we request only the Gmail permission to create drafts (gmail.compose) and basic sign-in scopes (openid and email). We use it only to create follow-up draft emails in your Gmail account when you ask. You review and send each draft yourself. The Service does not read, search, send, label, or delete your email. Authorization credentials are encrypted before we store them.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the user-facing features described here. It is not sold, not used for advertising, not used to determine creditworthiness, and not used to train AI models. We do not allow people to read Google user data except with your permission for a specific support request, when needed to investigate security or abuse, when required by law, or when the data is aggregated and no longer identifies you.

You can disconnect Gmail in Settings > Integrations. Disconnecting asks Google to revoke our access and deletes the stored credentials right away. You can also revoke access in your Google Account security settings. Drafts already created stay in your Gmail until you delete them. Deleting your I start Monday. account does not delete anything in Gmail.

8. AI processing

When you ask for an AI feature, we send the information that task needs. Depending on the feature, this can include the text or images of a file you uploaded, your approved Master Profile or relevant facts, a job description, your target preferences, your instructions, or an existing document you ask us to revise.

Our AI providers are OpenAI (primary) and Anthropic (used when the primary provider is unavailable). Under their API terms, they do not use API inputs or outputs to train their models by default, and we have not opted in to such use. They may keep inputs and outputs for up to 30 days for abuse monitoring and legal compliance and then delete them.

If you add a LinkedIn profile URL, we send that URL to EnrichLayer, a profile-data provider, which returns the public profile information for it. We keep the returned profile in a temporary cache for up to 24 hours; the facts you keep become part of your saved account. If you add a portfolio or other web link, our servers fetch that page directly, along with up to three pages it links to on the same site, such as an About or Resume page. When we cannot read one of these pages directly, for example because the site shows its content only after a browser runs its scripts, we send that page's address to Jina AI, a page-reading service, which opens the page and returns its text. We send only page addresses, and we ask Jina AI not to cache or log these requests.

Background tasks pass through a temporary queue. Completed tasks leave the queue right away and failed tasks within about one hour. A copy of each finished document is also cached for up to 24 hours, in addition to the copy saved in your account. We keep AI request metadata (model, token counts, cost, timing, and status, without the text) for cost accounting and reliability.

AI output can be inaccurate or incomplete. Match scores and generated documents are decision-support tools for you. They are not sent to employers as hiring decisions, and I start Monday. does not make employment decisions for employers.

9. When we disclose information

We use the service providers below. They process personal information only to provide their services to us under their contract terms. We update this list before a materially different provider receives personal information.

• The creator who referred you. If you create an account with a creator's code, that creator's dashboard shows: a masked form of your e-mail address (the first and last characters of the name before the @ and the full domain, for example da***iy@gmail.com), the date you signed up, whether you have made a first document or a purchase, the number of documents you generated by type, the date you were last active, and the dates and amounts of your purchases and refunds, with the commission the creator earns. The creator never sees your name, full e-mail address, documents, profile, or searches. The Partner Program Terms forbid creators to try to identify or contact you with this information.
• At your direction. For example, when you open an employer's application site, download or export a document, create a Gmail draft, or authorize Google.
• Legal and safety reasons. When reasonably necessary to comply with law, protect rights and safety, investigate fraud or abuse, or secure the Service.
• Business transaction. In connection with a financing, merger, acquisition, reorganization, or sale of assets, subject to applicable notice and consent requirements. Google user data is transferred only as permitted by Google policy.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising, and we do not disclose career documents or Google data to data brokers or advertisers. Showing the creator who referred you the information in this section is how we report the commission we owe that creator. We receive nothing for it, and it is not a sale of personal information.

10. Cookies, Do Not Track, and Global Privacy Control

We use cookies and browser storage needed to keep you signed in, protect the Service, remember your choices, and cache your saved work, as listed in the Cookie Policy. We do not use advertising cookies or cross-site tracking. If you allow Analytics in the cookie banner, we use Google Analytics to count visits and see which pages are used, and a first-party cookie remembers how you found us for 90 days. Google Analytics does not load unless you allow Analytics. Turning Analytics off stops it and removes its cookies from that browser. Its advertising features are turned off. Separately, our own server counts page views without cookies and without storing anything in your browser (Section 4). That count does not depend on your cookie choice. Because we do not sell or share personal information for cross-context behavioral advertising, Do Not Track and Global Privacy Control signals do not change our current practices. If that changes, we will honor legally required opt-out signals. The code from a creator or referral link is kept in your browser's local storage for up to 60 days so the bonus can be applied when you sign up. It delivers the bonus you opened the link for, so it does not depend on your cookie choice.

11. Data retention

We keep personal information for the periods below. We do not delete saved account content automatically on a schedule: it stays while your account is active so you can use it on any device. A legal hold, fraud investigation, chargeback, or legal requirement may extend a period.

12. Security

We use administrative, technical, and organizational safeguards designed for the information we hold, including encryption in transit (TLS), our providers' encryption at rest, additional encryption of Google credentials, private file storage with no public links, account-scoped access rules in the database, role-based admin access, secret management, rate limits, storage limits, logging, and incident response. We limit direct production access to people who need it for operations, security, or support you authorize. No system is completely secure, and we cannot guarantee that unauthorized access or loss will never occur. On a shared computer, clear this site's data after you sign out.

13. Your choices and privacy rights

• Access and export. Settings > Privacy & Data > Export my data downloads, as a JSON file, your saved workspace, version history, conflicting copies, links to your original files (each link works for 5 minutes), completed generated documents, profile tasks, applications, support tickets, credit ledger, and payment records. For other records, such as search history, job states, match results, consent records, or your Gmail connection details, email us. Records about the creator program, such as a creator profile, commissions, and payouts, are not in that file: email us for them.
• Correction. Edit your profile, facts, preferences, and documents in the app, or ask us to correct account data.
• Deletion of your account. Settings > Privacy & Data > Delete account sends us a deletion request. We verify that it comes from the account holder, usually by confirming through your account email, and complete it within 45 days of receiving it. If we need more time, up to another 45 days where law allows, we will tell you why. Until the deletion is completed you can still sign in, and anything you add in the meantime is deleted too. Deletion removes your saved career content, original files, generated documents, search and application history, support tickets, and Gmail connection, blocks sign-in, and replaces your email address with a placeholder. We keep the records Section 11 lists as kept after deletion, and deleted data can remain in backups until they expire. If you are a creator, deletion also suspends your partner profile and erases your social links and payout details. We keep commission and payout records as Section 11 says.
• Deletion of specific items. To have a specific original file, document version, or other saved item erased without deleting your account, email us. We complete verified requests within 45 days.
• Google. Disconnect Gmail in Settings > Integrations and revoke access in your Google Account.
• Browser cache. Clear this site's data in your browser to remove the cached copy on that device.
• Marketing email. If we send you marketing email, use its unsubscribe link. Account and transaction messages may still be sent.
• Other rights under applicable state or national law, which may include access, correction, deletion, portability, opt-out, limiting certain uses of sensitive information, non-discrimination, and appeal.

Submit a request through Settings > Privacy & Data or email support@istartmonday.com. We confirm receipt within 10 business days and respond within 45 days, extendable once by up to 45 days with notice where law allows. We may verify your identity and authority before acting. An authorized agent may submit a request where law permits. If we deny a request, you may appeal by replying with the subject line "Privacy Appeal." We respond to appeals within 45 days.

14. Supplemental U.S. state privacy notice

This section supplements the rest of this Privacy Policy for residents of California and other U.S. states with comprehensive privacy laws. Some of these laws may not apply to a business of our size. We still offer every verified user the rights and timelines in Section 13, subject to security and legal exceptions.

In the preceding 12 months we collected the categories below and disclosed them for business purposes to the service providers listed in Section 9. Sources and purposes are described in Sections 5 and 6, and retention in Section 11.

We have not sold personal information or shared it for cross-context behavioral advertising in the preceding 12 months, and we do not use it for targeted advertising. We use sensitive personal information only to provide the Service you request, secure it, and comply with law, and not to infer characteristics about you. Because we do not engage in those activities, we do not offer a sale, sharing, targeted-advertising, or sensitive-information opt-out. If that changes, we will provide the legally required controls before the change takes effect.

We do not discriminate against a user for exercising an applicable privacy right. We may need to verify the requester and may deny or limit a request where law permits, including when identity cannot be verified, records must be retained, or disclosure would harm another person. To appeal a denial, reply to the decision with the subject line "Privacy Appeal." We do not currently provide a financial incentive in exchange for personal information. Promotional credits, referral rewards, creator bonus credits, and creator commissions are governed by their offer terms and are not payment for selling personal information.

15. Sensitive information

Career documents can contain sensitive information, and our work authorization question asks whether you need visa sponsorship. We use that answer only to match jobs and prepare the documents you request. Do not upload Social Security numbers, passport or driver's-license numbers, financial-account credentials, medical records, full birth dates, biometric identifiers, or other information an application does not need. We do not use sensitive information to infer characteristics about you or to make employment decisions.

16. International processing

The Service is operated from the United States. We and our providers process information in the United States and the European Union, and may process it in other countries where those providers operate. If you use the Service from outside the United States, your information is transferred to and processed in the United States or the European Union, where privacy law may differ from the law where you live. The Service is directed to users in the United States and is not directed to residents of the European Economic Area, United Kingdom, or Switzerland. Before actively offering the Service in a jurisdiction that requires additional notices, legal bases, representatives, or transfer safeguards, we will implement them.

17. Children's privacy

The Service is for adults and is not directed to children. You must be at least 18 to create an account. We do not knowingly collect personal information from anyone under 18. If you believe a minor provided information, contact support@istartmonday.com.

18. Changes and contact

We may update this policy as the Service changes. For a material change, we post the new version with its effective date, notify you by email or in the app, and ask for your consent where law requires it, including before we use information collected earlier in a materially different way or begin a new use of Google user data.

Privacy questions and requests: support@istartmonday.com. Operator: IStartMonday, Inc., a Delaware corporation. Mailing address: 2260 Homestead Ct, Unit 205, Los Altos, CA 94024.