Terms of Use

Last updated: September 7, 2026 · Version WR-2026-09-07

These Terms are between you and TrueBloom Ltd, the Cyprus company operating Work Remotely ("we", "us"). They cover our iOS and Android applications and related services (the "App"). Our contact details are below.

Review these Terms before using the App. Acceptance forms the service agreement. It is not blanket consent to advertising, analytics, AI processing or international transfers. The Privacy Policy explains those activities and your choices; it is a notice, not a waiver of your rights.

1. Eligibility and licence

The App is intended for adults aged 18 and over. We grant you a personal, limited, non-exclusive, non-transferable licence to use it on devices you own or control, subject to applicable Apple App Store or Google Play usage rules. Do not resell the App, interfere with its security, access another person's data or misuse the service. Restrictions on copying or reverse engineering apply only to the extent permitted by law.

2. Job listings and applications

We aggregate third-party listings. Availability, salary, remote-work status and visa sponsorship may change or be incomplete; verify them with the employer. We are not an employer or recruitment decision-maker and do not guarantee a job, interview, visa, salary or the accuracy of a listing. External applications are subject to the destination website's terms and privacy practices.

3. Free access, Premium and payments

Features, prices, currency, taxes and purchase conditions are shown before purchase. Offers differ between platforms:

• iOS: Premium is offered through Apple in-app subscriptions. The purchase screen states the billing period and renewal conditions. Manage or cancel subscriptions in your Apple subscription settings.
• Android: the current Premium offer is a one-time Google Play purchase, not a recurring subscription. Some free access can be unlocked by choosing to watch rewarded ads. The App explains the required ads before you start.
• Refunds: use the relevant store's refund controls or contact us for help. Mandatory local cancellation, withdrawal, refund and digital-content rights remain available. Immediate supply does not by itself waive statutory withdrawal rights; any legally required express request and acknowledgement must be obtained at checkout.

Deleting personal data or uninstalling the App does not cancel an Apple subscription. An Android one-time purchase has no automatic renewal. Exercising privacy rights does not require Premium or watching an ad. Any paid-feature usage limits must be disclosed; AI outputs and uninterrupted service availability are not guaranteed.

4. Your CV and ATS Optimizer

ATS Optimizer is an optional writing aid. Saving a CV sends its text to our server. Generating an optimised version sends CV text and a job description to a third-party AI provider and stores the result. Read CV & AI processing, including provider and destination details, before submitting information.

You keep your rights in your content and give us only the permission needed to process it for the features you request. Submitting a CV does not authorise publication, sale or use in our marketing. We do not automatically send CVs to employers.

Submit your own information or information you are authorised to provide. Remove unnecessary contact details about other people. Do not submit government identification numbers, payment credentials, passwords, health information, racial or ethnic origin, religious or political beliefs, trade-union membership, sexual orientation, biometric data, criminal records or other sensitive information. Agreement to these Terms does not authorise processing of such information. Contact us if you submitted it by mistake.

AI can introduce errors or unsupported claims. Review and correct every output before using it. We do not guarantee an ATS score, successful screening, an interview or employment. The App prepares documents; it does not decide whether an employer hires you.

5. Privacy choices and data requests

You may decline optional AI processing and continue using other features subject to their normal access conditions. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. Advertising choices are separate from AI choices.

Our data-request page explains how to request access, a downloadable copy, correction, deletion, restriction, withdrawal or to complain. App controls vary by version. A CV PDF or copying a visible CV is not a complete personal-data export. Uninstalling does not delete server records.

6. Changes and ending use

You can stop using the App and request deletion separately. We may restrict access where reasonably necessary to address misuse, security or legal requirements, with notice where appropriate. Your data rights and mandatory refund rights remain available.

We may update these Terms with a new version date. Material changes will be brought to your attention through appropriate notices, and renewed agreement or consent requested where required. Continued use is not consent to a new optional processing purpose.

7. Responsibility and mandatory rights

We will provide the service with the care required by applicable law. Where the law permits, we do not promise uninterrupted availability, error-free third-party listings or particular AI results. Nothing excludes liability that cannot lawfully be excluded, including applicable consumer remedies and compensation for unlawful processing of personal data. You do not assume our legal duties as a controller.

8. Store-specific provisions

The service agreement is with TrueBloom Ltd, not Apple or Google. We are responsible for App support and product, consumer and intellectual-property claims as required by law. Apple has no obligation to provide maintenance or support. If the iOS App fails to conform to an applicable warranty, you may notify Apple and Apple may refund the App purchase price under its rules; other warranty obligations remain with us to the extent required by law. Apple and its subsidiaries are third-party beneficiaries of the iOS licence and may enforce it. Applicable third-party store terms and lawful export restrictions also apply.

9. Law, complaints and contact

These Terms are governed by the laws of the Republic of Cyprus, without depriving you of mandatory protections in your country of habitual residence. You may use the courts, regulators and other remedies available under applicable law. These Terms do not impose mandatory arbitration, waive class or collective remedies or prevent a privacy complaint.

Privacy Policy

Last updated: September 7, 2026 · Version WR-2026-09-07 · iOS and Android

TrueBloom Ltd, at the Cyprus address above, is the controller of the personal data described here. No email account registration is required to browse, but the service is not anonymous. Device identifiers and usage records can be associated with a CV and are personal data.

1. Information collected

We receive information from you, the App and its SDKs, and the relevant store or notification service:

• Device and security: a random app device ID, platform, app version, session-token hashes, expiry/revocation and activity timestamps. These associate records with your installation and protect API access. The ID is pseudonymous, not anonymous. Network services also receive IP addresses and connection/request metadata.
• CV and AI data: the CV text you save, including any name, contact details, employment, education and skills you include; previous submitted originals; generated versions, related job IDs/titles, company names and timestamps. A pasted job description is processed for the request and can itself contain personal data.
• Alerts and push: alert names, country, industry, keywords, enabled status and notification timestamps; APNs or FCM push tokens, platform and time zone. These are stored on our server.
• Activity: feature/screen events, job IDs, search text or deep-link values, paywall and purchase events, error codes, app/OS version and locale. Server analytics use a hash of the app device ID, which does not make these records anonymous.
• Purchases: product identifiers, entitlement status and purchase-related events. Apple server notifications can include transaction IDs, storefront and notification payloads stored for purchase operations and troubleshooting. Apple and Google handle payment credentials; we do not receive your full card number from their billing flows.
• Android advertising: AdMob and its configured partners may process advertising identifiers, IP-derived approximate location, device information and ad interactions for delivery, measurement, fraud prevention and personalisation where permitted by your choices.
• Local data: favorites, AI text saved with favorites, preferences and queued analytics. Device backup services may back up some of these records.
• Support: your email address, message and attachments when you contact us. An AI report button opens your mail app; review its contents before sending.

We do not need your precise GPS location or address-book access for these features.

2. Purposes and legal grounds

Processing in the context of our Cyprus establishment is subject to EU GDPR regardless of where you live. Other applicable laws may add protections. For processing governed by EU or UK GDPR, we distinguish these purposes:

• Contract: necessary device/session processing, saving a CV at your request, retrieving results, operating chosen alerts and administering purchases.
• Consent: optional AI generation and sharing of the relevant text after your affirmative permission. Terms acceptance alone is not that permission. Ad-related device access and personalisation also require separate consent where the law requires it.
• Legitimate interests: proportionate abuse prevention and necessary troubleshooting to protect the service, subject to a balancing of interests and your rights.
• Product analytics: activity records help us understand feature usage. Where device access or processing requires consent, that consent is required. Any lawful exemption or legitimate-interest basis must meet its own conditions and respect objection rights. Existing versions do not yet have a dedicated analytics switch; contact us to object or restrict processing.
• Legal obligations: applicable record-keeping duties and rights requests. Proportionate records needed to resolve a dispute may also rely on legitimate interests.

A CV and alerts are optional, but the relevant feature needs the associated data. We do not use the CV workflow to make hiring or other legally significant decisions about you.

3. CV & AI processing

Saving uploads CV text to our server, associated with your app device ID. The current service also keeps prior submitted originals. Optimisation sends CV text and the selected or pasted job description to a third-party AI service. Quality checks and corrections can involve additional AI calls containing original and generated text. Results are stored on our server and may be saved locally with a favorite or exported by you.

Current AI provider and destination

Recipient: DeepSeek, a provider based in the People's Republic of China. We do not intentionally add your app device ID or push token to AI requests; personal details within your text are still sent. See DeepSeek's published privacy information. Its general policy is not a guarantee of the retention, training or contractual terms applicable to our API use. We do not promise zero provider retention or no provider training without verified, applicable contractual commitments.

Send only information needed for tailoring and remove sensitive information and third-party contact details. You can decline AI processing. To withdraw permission for future AI processing, stop making AI requests and contact us through the data-request page. You can separately request deletion of stored CVs. Withdrawal does not cancel a purchase or undo earlier lawful processing.

4. Recipients and international processing

• Infrastructure/support providers: hosting, database, backup, security and email services needed to operate the service and handle requests.
• DeepSeek: the text described above, for generation and checking; processing can take place in China.
• Apple: App Store/StoreKit and APNs; Apple privacy information.
• Google: Play Billing, Firebase Cloud Messaging, Android backups where enabled, and AdMob/consent services; Google privacy information and Firebase privacy information.
• Other recipients: advisers or authorities where disclosure is legally required or necessary for legal claims with appropriate safeguards.

Recipients may process information outside your country, including in China and the United States. The processing ground and the international-transfer mechanism are separate requirements. General Terms acceptance or routine AI consent does not replace legally required transfer safeguards. Contact hello@truebloom.ltd for the destinations, recipients and safeguards applicable to your data and how to obtain a copy. This notice does not claim that a particular standard contractual clause or adequacy mechanism covers every provider.

We do not put CVs into advertising requests or automatically send them to employers. When you open an external job link, share a PDF or send an email, that recipient processes what you provide under its own practices.

5. Android ads and US privacy choices

Android offers optional rewarded ads through AdMob; iOS currently has no AdMob integration. Google's User Messaging Platform manages applicable advertising notices and choices. On Android use Settings → Ad privacy options when available. Device advertising-ID settings provide additional controls. Choosing to watch an ad is not by itself consent to personalisation.

We do not sell CVs. Advertising disclosures can nevertheless be a "sale", "sharing" or targeted advertising under some US state laws without a monetary sale. We therefore do not make a blanket claim that no personal data is sold or shared. Use available ad privacy controls or request an opt-out of sale, sharing and targeted advertising. Applicable law may also provide authorised-agent, appeal and opt-out preference-signal rights. A browser signal does not necessarily change choices inside a separate mobile app.

6. Retention and deletion

• CV, previous originals and AI history: retained until deleted in the current service; there is no automatic inactivity expiry yet. CV deletion covers these three categories in the active resume database. Showing the latest 50 results does not mean older records were deleted.
• Analytics: configured for cleanup of records older than 180 days on a weekly schedule, not necessarily on the exact 180th day.
• Sessions: daily cleanup removes records whose refresh expiry or revocation is more than 30 days old. Token expiry is not immediate record deletion.
• Alerts and push: retained to operate alerts until removed or replaced. CV deletion does not remove them. Disabling OS notifications does not itself erase server tokens.
• Purchase, support and security records: retention depends on operational purpose and applicable record-keeping or claim requirements. Ask us for the period and reason for a particular record.
• Backups and provider copies: active-database deletion is not instant deletion from every backup or provider system. When handling a request, we will explain retained categories, their reason and applicable schedule. Copies you exported or shared remain under your or the recipient's control.

Local favorites may contain saved AI CV text, separate from server history. Android backup rules include favorites and general preferences but exclude the identity/session store. The iOS device ID is stored in Keychain and may survive reinstalling. Uninstalling is not a reliable way to erase all personal data. Request full deletion if that is your intention.

7. Your rights and requests

Subject to applicable law, you may request confirmation/access, correction, deletion, restriction, blocking or anonymisation, object to processing, withdraw consent, obtain a portable copy of eligible data and complain to a regulator. Rights have conditions and legal exceptions. We will explain any refusal, limitation or required retention and available challenge routes.

Use the data-request page, email hello@truebloom.ltd or write to our Cyprus address. No subscription, installed App or new account is required. Ordinary rights requests are free. Proportionate verification may be needed before disclosure or deletion; do not send passwords, session tokens, full payment details or a fresh CV as proof.

We cannot retrieve data that exists only on your device. We will identify available server data, explain local steps and arrange a copy of the data you are entitled to receive. Complete automated export is not currently available. If your app version hides deletion behind Premium or a consent screen, contact us; no purchase or renewed AI consent is necessary to request deletion.

8. Regional information and deadlines

• EU/EEA and Cyprus: GDPR and national law apply. The usual response period is one calendar month; permitted extensions must be explained within that period. Complain to your local authority or the Cyprus Commissioner for Personal Data Protection.
• UK: UK GDPR and the Data Protection Act 2018, as amended, apply where within scope. Rights requests usually require a response within one calendar month, subject to lawful verification, clarification and extensions. You may complain to us or the ICO. Where UK complaint requirements apply, we acknowledge a privacy complaint within 30 days and respond without undue delay.
• USA: applicable federal and state laws may provide access, deletion, correction, portability, opt-outs and appeals. CCPA/CPRA applies only where its scope requirements are met. Covered California requests usually have a 45-day substantive response period, subject to lawful extension; opt-outs have shorter rules. Contact the California Privacy Protection Agency or your state regulator. We do not penalise exercise of applicable privacy rights.
• Brazil: LGPD provides confirmation, access, correction, sharing information, withdrawal and, where applicable, portability, anonymisation, blocking or deletion. Simplified confirmation/access is provided immediately where possible; a full Article 19 response is due within 15 days. Other requests follow their applicable rules. You may contact the ANPD.
• Argentina: Law 25.326 provides access within 10 calendar days and correction, updating or deletion within 5 business days, subject to its conditions. You may seek protection from the AAIP.
• India: applicable information-technology and data-protection law governs requests. DPDP Act 2023 and Rules 2025 have phased commencement; as of this notice, core notice, consent and rights provisions are scheduled for May 13, 2027, not already fully operative. As relevant provisions apply, rights include information access, correction/erasure, grievance redressal, withdrawal and nomination. A statutory portability right is not assumed. Contact us for requests or grievances.

These regional descriptions are not mutually exclusive. Where more than one law applies, a longer period under one law does not displace a shorter applicable deadline under another. We explain any lawful extension or verification requirement. You may contact us in your preferred language.

9. Security, children and updates

App-to-server and AI API connections use HTTPS. We use access controls and dedicated protections for session credentials. No system can guarantee absolute security. We investigate incidents and notify authorities and individuals when required by law.

The App is intended for adults aged 18 and over. Do not submit a child's CV or other personal data. Contact us if you believe a child used the service or submitted data so we can investigate and address it.

We update this notice as processing changes, with additional notice or fresh consent where required. Publication of an update is not retroactive consent.

10. These web pages

Our host receives connection information when serving pages. These legal and data-request pages use local styles and do not load advertising or analytics scripts. Other project pages may load fonts or styles from Google and a content-delivery network, which receive connection information. An email link opens your mail app; nothing is submitted until you send it.