Privacy Policy
Last updated: March 22, 2026
Table of Contents
Introduction
1Fillr ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Chrome extension and website.
For the Chrome extension, profile data is stored locally on your device by default. 1Fillr relies on AI-assisted processing as a core part of its autofill service. When you use AI-powered classification, profile processing, or form filling, relevant profile data and form field content are transmitted securely to our API so we can generate autofill results. Please read this Privacy Policy carefully before using the Service.
Information We Collect
Information You Provide
We collect information that you voluntarily provide to us:
- Account Information: When you create an account, we collect your email address and any profile information you choose to provide.
- Form Data: The 1Fillr extension stores information you enter into job application forms (such as your name, email, phone number, education, and work experience) to enable auto-filling functionality.
- Payment Information: When you make a purchase, payment information is processed by our payment provider (Paddle). We do not store your complete payment card details.
- Communications: If you contact us, we may collect information contained in your messages.
Automatically Collected Information
When you use our website, we may automatically collect:
- Usage Data: Information about how you use our website, including pages visited and actions taken on the site.
- Device Information: Browser type, operating system, and device identifiers.
- Log Data: IP address, access times, and referring URLs for website requests.
The Chrome extension does not sell browsing history. It reads page content and form field information only to deliver autofill features requested by the user.
Data Security
Important: Your personal information is protected with industry-standard encryption, both in transit (TLS/SSL) and at rest. We implement strict access controls to ensure your data is secure.
How We Use Your Information
We use the collected information for the following purposes:
- To provide, maintain, and improve the Service
- To process transactions and send related information
- To send administrative information, updates, and security alerts
- To respond to your comments, questions, and support requests
- To monitor and analyze usage patterns and trends
- To detect, prevent, and address technical issues and fraud
- To comply with legal obligations
Legal Basis for Processing (GDPR)
If you are in the European Economic Area (EEA), we process your personal data based on the following legal grounds:
- Contract Performance: Processing necessary to provide the Service you requested.
- Legitimate Interests: Processing for our legitimate business interests, such as fraud prevention, security, and service improvement.
- Consent: Where you have given explicit consent for specific processing activities.
- Legal Obligation: Processing required to comply with applicable laws.
Data Sharing and Disclosure
We may share your information in the following circumstances:
- Service Providers: With third-party vendors who perform services on our behalf (payment processing, analytics, hosting).
- Legal Requirements: When required by law or to respond to legal process.
- Protection of Rights: To protect our rights, privacy, safety, or property.
- Business Transfers: In connection with a merger, acquisition, or sale of assets.
- With Your Consent: For any other purpose disclosed to you and with your consent.
We do not sell your personal information to third parties.
Third-Party Services
Our Service uses the following third-party services:
| Service | Purpose | Privacy Policy |
|---|---|---|
| Supabase | Authentication & Database | View |
| Paddle | Payment Processing | View |
| Vercel AI Gateway | AI Form Field Classification | View |
| Google Analytics | Website Analytics | View |
| Vercel | Website Hosting | View |
AI-Powered Features
1Fillr relies on AI-assisted processing as a core part of field recognition, profile normalization, and form filling. When you use AI-powered features, the following applies:
Form Field Classification
When classifying form fields, our extension sends form field metadata (such as field labels, field names, placeholder text, and dropdown options) to our AI service. Your personal answers are not always required for classification requests, but relevant page content may be included when necessary to classify the requested field accurately.
AI Form Filling
When you use AI-powered form filling, the extension sends your profile data (such as name, email, work history, education, and skills) along with form field information to our AI service, so it can intelligently match and fill fields. This means:
- Your profile data is transmitted to our AI service through secure, encrypted connections
- Relevant form field content and page content may also be transmitted when needed to generate the requested autofill result
- AI features require your explicit consent and, for authenticated features, sign-in
- Data is processed with a Zero Data Retention (ZDR) policy — it is not stored after processing
- Data is used solely for the purpose of generating form fill values
LinkedIn Profile & Resume Processing
When you import your LinkedIn profile or upload a resume, we use AI-assisted data cleaning to normalize and structure your information:
- Your profile data (name, work history, education) is sent to our AI service for structuring
- Imported profile data is processed only to structure and normalize your information for autofill use
- The processed data is stored locally on your device for use in auto-filling
Data Processing Locations
AI processing may occur in data centers located in the United States. Vercel is certified under the EU-US Data Privacy Framework (DPF), ensuring adequate protection for data transfers from the EU/EEA.
Data Retention
We retain your personal information for as long as necessary to provide the Service and fulfill the purposes described in this policy, unless a longer retention period is required by law.
- Account Data: Retained until you delete your account.
- Website Usage Data: Typically retained for 26 months, then anonymized or deleted.
- Transaction Records: Retained for 7 years for legal and accounting purposes.
Your Rights
Depending on your location, you may have the following rights:
For All Users
- Access your personal information
- Correct inaccurate data
- Delete your account and associated data
- Export your data
For EEA Residents (GDPR)
- Right of Access: Request a copy of your personal data.
- Right to Rectification: Request correction of inaccurate data.
- Right to Erasure: Request deletion of your data ("right to be forgotten").
- Right to Restriction: Request restriction of processing.
- Right to Data Portability: Receive your data in a portable format.
- Right to Object: Object to processing based on legitimate interests.
- Right to Withdraw Consent: Withdraw consent at any time.
- Right to Lodge a Complaint: File a complaint with a supervisory authority.
For California Residents (CCPA)
- Right to know what personal information is collected
- Right to know if personal information is sold or disclosed
- Right to opt-out of the sale of personal information
- Right to request deletion of personal information
- Right to non-discrimination for exercising CCPA rights
To exercise any of these rights, please contact us at [email protected].
Data Security
We implement appropriate technical and organizational measures to protect your personal information, including:
- Encryption of data in transit (TLS/SSL)
- Encryption of sensitive data at rest
- Regular security assessments
- Access controls and authentication
- Employee security training
However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.
International Data Transfers
Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws.
When we transfer data from the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.
Children's Privacy
Our Service is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by:
- Posting the new Privacy Policy on this page
- Updating the "Last updated" date
- Sending you an email notification (for significant changes)
We encourage you to review this Privacy Policy periodically.
Contact Us
If you have questions about this Privacy Policy or our privacy practices, please contact us:
- Email: [email protected]
- Data Protection Officer: [email protected]