Privacy Policy
Effective: 17 June 2026 · Last updated: 21 September 2026
Tamsin reads your résumé so it can read job postings on your behalf. That only works if you hand us something genuinely personal, so this page is written to be read rather than to be survived. It says what we collect, why we collect it, everyone it reaches, how long we keep it, and how to make us delete all of it.
The four promises this whole page rests on.
- We do not sell your personal data. Not to anyone, not ever, in any sense of "sell", including sharing it for money or for anything else of value.
- We do not market to you, and we do not let anyone else market to you using what you gave us. You will get email that operates the product and nothing else.
- We do not use your data for advertising, targeted or otherwise, and we do not share it for cross-context behavioural advertising.
- We never submit an application on your behalf. There is no setting for it and no mode that enables it. Tamsin prepares. You press the button.
1. Who we are
Tamsin is operated by CannonCodeConnect LLC ("CannonCodeConnect", "we", "us"), based in Texas, United States. For the purposes of United States state privacy laws, CannonCodeConnect LLC is the controller of the personal data described here.
Tamsin is in private, invitation-only beta, and is offered in the United States and France. If you are somewhere else, please do not use it yet: we would rather say so than take your data before we are set up to give you the rights your own law entitles you to.
If you are in France — or anywhere else in the European Economic Area, the United Kingdom or Switzerland — the GDPR applies to you, CannonCodeConnect LLC is the controller under it, and section 9 sets out the legal bases we rely on, where your data is processed, and how to complain. Everything else on this page applies to you as well.
2. What we collect
Almost all of it comes from you directly, and most of it comes from one file: the résumé you upload.
| What | Specifically | Where it comes from |
|---|---|---|
| Account | Your email address. That is the whole account. Tamsin has no passwords. You sign in with a link we email you. | You |
| Your résumé | The file itself (PDF or Word), stored privately, plus what we read out of it: your name, phone number, city and state, LinkedIn and portfolio links, headline, years of experience, summary, work history, education, certifications and skills. | You |
| What you are looking for | Target job titles, role families, locations, remote preference, salary floor, and titles you want excluded. | You, or proposed from your résumé for you to correct |
| Standard application answers | The thirteen questions nearly every employer asks. Some of these are sensitive, and section 3 covers them separately. | You |
| What Tamsin produced | Tailored résumés and cover letters, the shortlist, the reasoning behind each match, and any corrections you give when a match was wrong. | Generated for you |
| Service records | Which jobs were shown to you and when, how much processing each request used, and your plan and quota history. | Automatic |
| Billing | Your Stripe customer and subscription identifiers, your plan, and whether it is current. We never see or store your card number. Your card goes to Stripe directly and stays there. | Stripe |
| Problem reports | If you use the Help button to tell us something broke, we receive the error, the page you were on, your browser and your email address, so we can fix it and reply to you. Nothing you had typed is included: not your answers, not your brief, not your résumé. Nothing is sent unless you press the button. | You |
| Technical | Ordinary server and delivery logs from our hosting and email providers, including IP address and browser, kept briefly for security and debugging. | Automatic |
What we deliberately do not collect: we set no advertising or analytics cookies and run no third-party trackers on this site. We do not buy personal data about you from anyone, and we do not build a profile of you from anything other than what you gave us.
3. Sensitive information, and your consent
Employers routinely ask questions that Texas and other states classify as sensitive personal data. Tamsin can store your answers so you do not have to retype them into every form. Three of them are sensitive as a matter of law:
- Race or ethnicity and disability status, from the voluntary EEO questions.
- Gender and pronouns, also from those questions, and kept under the same consent as the two above.
- Citizenship or immigration status, which is what "are you authorised to work in the United States?" and "will you require sponsorship?" amount to.
We also store answers about security clearance and criminal record disclosure. These may not be "sensitive" by statutory definition, but we treat them the same way, because in practice they are.
We ask before we store any of it, and the answer is optional. The EEO questions default to "Prefer not to say" and stay that way unless you change them. We store a sensitive answer only if you give us explicit consent on the form where you enter it, and we record when you gave it.
These answers are used for exactly one thing: filling in the equivalent field on an employer's own application form, for a job you chose to apply to. They are never used to rank you, to decide which jobs you are shown, to train any model, or for any purpose of ours whatsoever.
You can withdraw consent or clear the answers at any time in the app, and we will delete them. Withdrawing does not affect anything we did before you withdrew.
Outside the United States we do not ask these questions at all.
The EEO questions — race or ethnicity, veteran status, disability status and gender — exist because United States employment law asks American employers to collect them. They are not a neutral form field elsewhere: under GDPR Article 9 racial or ethnic origin is special-category data, French law restricts collecting ethnic statistics further still, and "veteran status" is an American construct that means nothing on a French form.
So if your profile country is not the United States, Tamsin does not show you those questions and never puts them into an application, even if an answer is already stored from before. That rule lives in the code that builds the application itself, not only in the page that displays the form, because the application is the thing that reaches an employer.
We do not sell sensitive personal data. We do not sell any personal data at all. But Texas asks controllers to be explicit about this category, so: we do not, and we have no arrangement under which it could happen.
4. What we do with it
One purpose, with parts: to operate Tamsin for you. Concretely, that means
- reading job postings against your résumé and your stated preferences, so you get a short list instead of a firehose;
- writing a tailored résumé and cover letter for a specific role you picked;
- preparing the answers for an application form so you can review and submit it yourself;
- getting you ready for an interview you have;
- running your account - signing you in, taking payment, enforcing plan limits, and emailing you about your own account and the work you asked for;
- keeping the service secure, debugging it, and meeting our legal obligations.
We do not do anything else with it. If we ever want to, we will ask first. And "ask" means a real choice, not a pre-ticked box.
5. The AI part, plainly
Tamsin uses Anthropic's Claude models to do the reading and the writing. That is not a background detail, so here is exactly what it means:
- The content of your résumé is sent to Anthropic, along with the job postings being considered and the preferences you set, every time Tamsin judges a posting or writes you a packet. There is no way to use Tamsin without this happening.
- Anthropic processes it on our instructions, as our service provider, to return a result to us.
- It is not used to train models. Our commercial API terms with Anthropic do not permit it.
- Tamsin's own logs record that a packet was produced for a user and what it cost, never the content of the packet or the résumé.
Machine output is a draft, not a verdict. A tailored résumé can get a detail wrong, and a match score is an opinion. Read anything Tamsin writes before you send it to an employer. Tamsin makes no decision that has a legal or similarly significant effect on you. It suggests jobs and drafts documents, and you decide everything.
6. Who else sees it
Only the companies that make the product run, each acting as our service provider, under contract, for our purposes only. The full list:
| Who | What they do | What reaches them |
|---|---|---|
| Supabase | Database, sign-in and private file storage (United States) | Everything in section 2, including your résumé file |
| Anthropic | The AI that reads and writes | Résumé content, your preferences, job postings (see section 5) |
| Netlify | Hosting for this site and the app | Ordinary request logs |
| Fly.io | Runs the pipeline that searches and prepares (United States) | Your brief and résumé content while a search or an application is being prepared. Nothing is stored there; it reads from Supabase and writes back |
| Stripe | Payments | Your card and billing details, which go to them and not to us |
| Resend | Sending email | Your email address and the message |
Job boards and employers. Tamsin reads publicly posted jobs. It does not send them anything about you, does not create accounts for you, and does not apply for you. An employer learns about you when you submit an application, at which point their privacy policy governs, not ours.
We will also disclose personal data if the law genuinely requires it, or to protect someone's safety or our legal rights. If Tamsin is ever sold or merged, your data may transfer with it; we will tell you before that happens and the promises on this page travel with the data.
Where our email comes from. Every message Tamsin sends comes from
tamsinjobs.com, the same domain as the links inside it. Which address it comes
from depends on what it is about: welcome@ for invitations,
jobs@ for shortlists and applications, billing@ for receipts,
hello@ for everything else and for replies.
We are spelling this out because an email carrying a sign-in link from a domain that is not
the product's is exactly the shape of a phishing message. If one ever reaches you from anywhere
other than tamsinjobs.com, it is not from us.
7. How long we keep it
| What | How long |
|---|---|
| Your account, résumé, brief and packets | Until you delete them, or you delete your account |
| Dormant accounts | After 180 days of inactivity we delete the account and everything in it. We email a warning first, at 150 days, and signing in once is all it takes to stop it. An account is never deleted this way without that warning having been sent. If we cannot reach you, we keep the account rather than delete it quietly |
| Detailed processing records | 90 days |
| The shared pool of job postings | 45 days. These are public job ads, not personal data about you |
| Billing and tax records | As long as tax and accounting law requires, after which they go |
8. Your rights, and how to use them
Texas law gives Texas residents the rights below. We extend all of them to every user, wherever you live. It is simpler for us and fairer to you, and it means we never have to ask where you live before helping you. If you are in the EEA, the UK or Switzerland you have further rights, and they are additional to these, not instead of them.
- Know and access. Confirm whether we process your data and get a copy.
- Correct. Fix anything inaccurate. Most of this you can edit yourself.
- Delete. Have your personal data erased.
- Portability. Get your data in a portable, machine-readable form.
- Opt out of the sale of personal data, of targeted advertising, and of profiling with legal or similarly significant effects. We do none of these, so there is nothing to opt out of. The right is listed so you know we considered it.
- Withdraw consent to sensitive data processing, at any time.
Deleting your account
You can delete your account from inside the app: Billing → Delete this account. You type your email address to confirm, and it happens straight away. Nothing is queued for review and nobody has to approve it. It removes your résumé file, every packet Tamsin generated, your brief, your answers and your account itself. The files are deleted from storage, not merely hidden. It cannot be undone. Records we must keep for tax or accounting reasons survive; nothing else does.
Making a request
Email hello@tamsinjobs.com from the address on your account. We will respond within 45 days, and may extend once by another 45 days where the request is complex, and we will tell you if that happens. There is no charge, unless requests become excessive or repetitive.
We may need to verify it is really you. If we cannot verify you, we may have to decline, which protects you, since the whole point is that nobody else can ask for your data.
If we say no
You can appeal. Reply to our decision and say you are appealing. We will review it and give you a written answer within 60 days. If we still refuse, you may complain to the Office of the Texas Attorney General at texasattorneygeneral.gov, or to your own state's Attorney General. In France, complain to the CNIL at cnil.fr/fr/plaintes; elsewhere in the EEA, to your own supervisory authority.
9. If you are in France, the EEA, the UK or Switzerland
This section is the GDPR one. It adds to everything above rather than replacing it. CannonCodeConnect LLC is the controller. We have no establishment in the European Union and have not appointed an Article 27 representative; you can reach us at hello@tamsinjobs.com and we answer in English or in French.
Why we are allowed to process it
| What | Legal basis |
|---|---|
| Your account, résumé, brief, shortlist, the documents Tamsin writes and the answers it prepares | Performance of a contract (Art. 6(1)(b)). This is the product. Without it there is nothing to run. |
| Operational email — sign-in codes, your results, billing | Performance of a contract (Art. 6(1)(b)). We send no marketing. |
| Keeping the service up, preventing abuse, and the logs that make that possible | Legitimate interests (Art. 6(1)(f)) — ours in running a service that works, balanced against your interest in not being logged more than necessary. We log actions, not the contents of your résumé. |
| Billing and tax records | Legal obligation (Art. 6(1)(c)). |
| Special-category data — race or ethnicity, health or disability, and the rest of the EEO block | None, because we do not process it. Those questions are not asked outside the United States and never reach an application. See section 3. |
Where your data goes, and why that is lawful
Your data is processed in the United States. Our database and file storage are hosted in US East, our worker runs in the United States, and the model that reads your résumé is operated by Anthropic in the United States. That is a transfer outside the EEA and we are not going to bury it.
Every processor in section 6 is engaged under a written data processing agreement, and the transfer mechanism we rely on is the European Commission's Standard Contractual Clauses, as incorporated in each of those agreements. We keep the list of processors in section 6 current, and we will tell you before adding one that changes where your data lives.
If you would rather your résumé were never processed in the United States, do not use Tamsin — today there is no version of it that does not, and we would rather tell you that plainly than let you find out from this paragraph after you had uploaded it.
Your rights under the GDPR
In addition to the rights in section 8, you have the right to restrict processing (Art. 18), to object to processing based on legitimate interests (Art. 21), and to withdraw consent at any time without affecting what was lawful before you withdrew (Art. 7(3)). We answer within one month, extendable by two further months for a complex request, and we will tell you if we need them.
You also have the right to lodge a complaint with a supervisory authority. In France that is the CNIL: cnil.fr/fr/plaintes. You can do that without asking us first, although we would like the chance to fix it.
Automated decisions
Tamsin ranks job postings and explains why. It does not make a decision about you. Nothing it produces has a legal or similarly significant effect on you within the meaning of Article 22: it decides what to show you, you decide what to apply to, and an employer — not Tamsin — decides whether to interview you. You can change your brief at any time and see every posting that was screened out, with the reason. The scoring is never used to set a price, refuse you service, or limit what you can do.
10. How it is protected
- Your files live in private storage. There is no public link to them.
- Every table carries row-level security, so the database itself enforces that you can only reach your own rows. It is not left to application code to remember.
- Data is encrypted in transit and at rest by our infrastructure providers.
- The administrative key that could bypass those rules never reaches a browser. It lives only in our backend.
- Sign-in is by emailed link. There is no password to steal from us, because we have none.
No system is perfectly secure, and we will not pretend otherwise. If a breach affects you, we will notify you and the authorities as the law requires.
11. Children
Tamsin is for adults looking for work. It is not for anyone under 18, we do not knowingly collect data from under-18s, and if we discover we have, we will delete it. If you believe a child has given us data, email us and we will remove it.
12. Changes
If we change this policy we will update the date at the top. For a change that materially affects your rights or how we use your data, we will email you before it takes effect. We will not rely on you noticing a new date on a page you have no reason to revisit.
13. Contact
CannonCodeConnect LLC, Texas, United States.
Privacy requests and everything on this page:
hello@tamsinjobs.com
See also our Terms of Service.