Legal
Last updated 17 September 2026
GrabOpportunity is a job-search service operated from Canada. It finds job openings, scores them against your CV, writes tailored application documents, and — through an optional browser extension — fills application forms on employers’ own websites.
We are the controller of the personal data described here. You can reach us through the support form.
Only what the product needs to do the job you asked it to do.
| Category | What it includes | Why |
|---|---|---|
| Account | Email address and a hashed password. | To sign you in. We never store the password itself. |
| Profile | Name, phone, LinkedIn URL, city, country, postal code, street address, current employer and job title, notice period, years of experience, and your stated preferences about work you want. | These are the answers application forms ask for. They are filled in from here so you type them once instead of on every application. |
| CVs and documents | Résumés you upload, and the tailored résumés and cover letters we generate. | To score jobs against your experience and produce documents for each application. |
| Answer library | Answers you have given to application questions, saved when you choose to save them. | So a question you have already answered is not asked again at the next employer. |
| Activity | Jobs scored, jobs dismissed, applications tracked, credits spent. | To rank your feed, show your history, and bill accurately. |
| Work authorisation | Your stated status for countries you selected. | To answer “are you authorised to work in X?” correctly rather than guessing. |
We do not collect your date of birth for any application purpose, we do not track you across other websites, and we run no advertising trackers.
Many application forms ask voluntary questions about gender, race or ethnicity, veteran status and disability. These are the most sensitive data the product touches, so they are handled differently from everything else:
We never infer these answers. If you have not given one, the field is left at “decline to state” — it is not guessed from your name, your photo, or anything else.
Scoring a job and writing documents use Claude models running on Amazon Bedrock. When you ask for one of those, what is sent is:
What is not sent, ever:
Amazon processes this to return a result and does not use it to train models. We do not use your data to train any model of our own.
The extension is optional. It only runs on a page when you are on a supported job board, or when you click its toolbar button on some other careers page — that click is the permission, and it applies to that one tab.
The fields of the application form in front of you — their labels, types and options — and the page’s address, title and company name, which are used to match the posting to a job in your feed. It reads nothing else on the page.
Only the answers to the form it is looking at, already resolved on our server. Your full profile is not sent into the page. A content script runs inside the employer’s website, so it is given the minimum it needs and nothing more.
If you choose to save a sign-in for an applicant-tracking system so you do not retype it, that sign-in is kept in your browser’s local extension storage. It stays on your machine, is never sent to us, and is never synced between your devices.
Be aware: browser extension storage is not encrypted at rest. This is the weakest point in the design, which is why saving a sign-in is opt-in per site and off by default. If that trade-off does not suit you, do not save credentials and the extension will simply ask nothing of you.
We do not sell or transfer data obtained through the extension to third parties, do not use it for anything other than the job-application feature it exists for, and do not use it to determine creditworthiness or for lending.
We do not sell your personal data. It reaches only these processors, each for one purpose:
| Who | What they receive | Why |
|---|---|---|
| Amazon Web Services | Everything the service stores, as our hosting provider; plus CV and job text for AI scoring via Bedrock. | Hosting and AI processing. |
| Stripe | Your email and payment details, entered on Stripe’s own form. | To take payment. Card numbers never reach our servers. |
| Employers you apply to | Whatever their application form asks for, which you review before sending. | Because you chose to apply. Their own privacy policy governs what happens next. |
We may also disclose data where the law requires it. If we are ever compelled to, we will tell you unless we are legally prevented from doing so.
Our servers are in the United States (AWS, N. Virginia), and the AI models we use run in United States regions. If you are in Canada, the EU, or the UK, your data is therefore processed outside your country and is subject to the laws of the United States, including lawful access by US authorities.
We consider this a material fact rather than boilerplate, which is why it has its own section. If it is not acceptable to you, please do not upload your CV.
You can, at any time:
Use the support form for anything the app does not let you do yourself. We answer within 30 days. If you are in Canada and we have not resolved your concern, you may complain to the Office of the Privacy Commissioner of Canada.
Traffic is encrypted in transit with TLS, and the disks holding your data are encrypted at rest. Passwords are stored hashed, never in plain text. Access to production systems is limited to those who need it.
No service can promise to be unbreakable, and we will not pretend otherwise. What we can say is what we have deliberately chosen not to hold: no card numbers, no date of birth used for applications, and no equal-opportunity answers anywhere near an AI model.
If we change this policy in a way that materially affects you, we will say so in the app rather than quietly updating the date at the top.
Questions about this policy, or a request about your data, go through the support form.