Privacy policy
Effective date: 11 October 2026
This policy explains what personal data we process when you use WayToYes — the website waytoyes.com, the web app at app.waytoyes.com, the Windows desktop app and the Android app — why we process it, who we share it with and what rights you have.
Who we are
WayToYes is operated by SalesFactory OÜ, registry code 16526031, Uus-Sadama tn 21-207, 10120 Tallinn, Estonia (“we”, “us”). We are the controller of your personal data under the EU General Data Protection Regulation (GDPR). For any privacy question or request, write to support@waytoyes.com.
What data we process
- Account data: your email address and, if you sign in with Google, your name and profile picture from your Google account.
- Content you add: resumes and resume files you upload, jobs you save (descriptions, links, notes, stages), cover letters and messages you create, interview notes and transcripts.
- Purchases (Android app): when you buy a plan or a pack in the Android app, Google Play handles the payment and sends us the product, the purchase token and its status (active, renewed, cancelled), so we can turn on your plan on all your devices. We do not receive your card or other payment details.
- Interview audio (desktop app): during a live or practice interview, the app streams audio to a speech recognition service to turn it into text in real time. We do not record or store audio — not on your device and not on our servers.
- Technical data: IP address and request data needed to deliver the service and protect it from abuse, app version, and error reports (an error code and message, without your content or IP address).
- Interview connection quality (desktop app): timings and counters measured during an interview — how long the hints took to appear and how long the AI model took to start answering, how quickly our server and speech recognition responded, connection drops and error codes — together with the app version, operating system and the country of the connection. It contains no audio and no words from the conversation. It is saved with the interview and synced to our servers, so that if you report slow or missing hints we can tell whether the cause was the network, the location or the AI model. It is deleted together with the interview or your account.
- Device identifier (desktop app): a one-way hash of your computer’s system ID, sent when an interview starts. We use it to recognize your own session after a restart and to keep the free plan’s one-time allowances (such as the free live interview) from being claimed again with a new account on the same computer. The system ID itself never leaves your device. After you delete your account, the identifier is kept only as part of the minimal record described in “How long we keep data”.
We do not sell your data, we do not show ads, and we do not use your content to train AI models.
Why we process it
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating your account, signing you in, storing and syncing your data between your devices | Performance of a contract, Art. 6(1)(b) |
| AI features you request: reading resumes and job pages, tailoring resumes, drafting letters, company research, interview hints and reviews | Performance of a contract, Art. 6(1)(b) |
| Security, abuse prevention (including free plan limits per email address and device), fixing errors, investigating your support requests about interview quality, backups | Legitimate interests, Art. 6(1)(f) |
| Answering your emails and requests | Performance of a contract or legitimate interests |
| Keeping records required by law (for example, accounting) | Legal obligation, Art. 6(1)(c) |
How AI features use your data
When you use an AI feature, we send only the text needed for that task — for example, your resume and the job description to tailor the resume — to an AI model provider, and show you the result. AI results are suggestions: please review them before you send anything to an employer.
Who we share data with
We use the following service providers (processors). They process data only on our instructions and only to provide their service to us.
| Provider | What for | Location |
|---|---|---|
| Hetzner Online GmbH | Application server | Germany |
| Supabase Inc. | Database (your account and synced data) | EU (Frankfurt) |
| Cloudflare, Inc. | Website and web app hosting, network protection, file storage, background processing, sign-in emails | Global network |
| OpenRouter, Inc. and the AI model providers it routes to (such as Google) | AI features | USA |
| Deepgram, Inc. | Real-time speech recognition in interviews | USA |
| ElevenLabs Inc. | Voice of the interviewer in practice interviews (text to speech) | USA |
| ZenRows | Reading job pages from links you add, when a site blocks direct access | USA / EU |
| Amplitude, Inc. | Usage statistics of the Android app (the version of Android System WebView, country), linked to a random device identifier, without your account, content or IP address | EU |
| Functional Software, Inc. (Sentry) | Error reports from the web app and the Android app, without your content or IP address | EU |
| Google LLC | Sign-in with Google, if you choose it; payments for purchases in the Android app (Google Play) | USA |
When data is transferred outside the European Economic Area, we rely on the safeguards offered by the provider, such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
We may also disclose data if required by law or to protect our rights, and to a successor if our business is transferred.
How long we keep data and how to delete your account
- Your account and content — while your account exists.
- You can delete your account in the app: Settings → General → Delete account. We send a confirmation link to your email; once you confirm, your account, your content and your files are deleted right away, and the app erases its copy on the device where you asked for deletion. Without the app (for example, on Android after uninstalling WayToYes), email support@waytoyes.com from the email address of your account with the subject “Delete my account”; we delete the account and all data listed above within 30 days and confirm by email. An active Google Play or Paddle subscription is cancelled when the account is deleted.
- After deletion, to keep the free plan’s allowances from being claimed again, we keep a minimal record without your email address or content: a one-way hash of your email address (lowercased, without “+” tags), the date you signed up, the device identifier hash and usage counters (minutes of speech recognition and the number of AI actions), all linked to a random number instead of your account (legitimate interests, Art. 6(1)(f)).
- Database backups are kept for 30 days and then deleted automatically.
- Interview audio — not stored.
- Accounting records — as long as Estonian law requires.
Where your data is stored and how it is protected
The desktop app stores your data locally on your computer, and the web app stores a copy in your browser, so they can work offline. Synced data is stored on our servers in the EU. Data is encrypted in transit (HTTPS) and at rest by our storage providers. Access to production systems is limited to the people who operate the service.
Cookies and local storage
The website waytoyes.com does not use cookies or tracking. The web app uses a cookie and browser storage that are strictly necessary to keep you signed in, store your data on your device and remember your settings (language and theme). We do not use advertising or analytics cookies. The Android app also keeps a random device identifier on your device: once a day it sends us the version of Android System WebView with this identifier and your country (from our network provider, without your IP address), so we know which phones the app supports; we pass these statistics to Amplitude. The identifier is not linked to your account and is deleted when you uninstall the app (legitimate interests, Art. 6(1)(f)).
Your rights
Under the GDPR you have the right to access your data, correct it, delete it, restrict or object to its processing, and receive it in a portable format. You can export your resumes and letters from the app at any time and delete your account in the app’s settings. To exercise any other right, write to support@waytoyes.com from the email address of your account; we answer within one month.
You also have the right to lodge a complaint with a supervisory authority — in Estonia, the Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee), or the authority in your country of residence.
Children
WayToYes is meant for adults looking for work. It is not intended for anyone under 16, and we do not knowingly collect their data.
Changes to this policy
If we change this policy, we will publish the new version on this page with a new effective date. If the changes are significant, we will also notify you in the app or by email.
Contact
SalesFactory OÜ, Uus-Sadama tn 21-207, 10120 Tallinn, Estonia — support@waytoyes.com