Privacy Policy
Last updated August 20, 2026
GreenLight exists to send job applications on your behalf, so it necessarily holds the information those applications need, your resume, your contact details, and your answers to employers' questions. This page describes exactly what is stored, exactly who receives it, and how to get it back or deleted.
1.Who we are
Arvello Holdings LLC operates GreenLight, a service that finds job listings, grades them against criteria you set, and prepares complete applications you review and submit yourself. For privacy law purposes we are the controller of the information described here. You can reach us at support@greenlightapply.com, or by mail at 4539 N 22nd St Ste N, Phoenix, AZ 85016.
2.What we collect
Everything below is information you give us directly, or that we generate from it.
- Account details. Your email address and a password, handled by our authentication provider. We never see your password in readable form.
- Identity and contact information. Name, preferred first name, pronouns, email, phone, and mailing address. Applications ask for these, so we store them to fill those fields.
- Work eligibility and preferences. Employment status, current employer, work authorization, whether you need visa sponsorship, earliest start date, willingness to relocate, and travel tolerance.
- Your resume and the Claim Vault. The resume file you upload, plus the individual facts extracted from it that you review and confirm. Confirmed facts are the only source the system is permitted to answer employer questions from.
- Writing samples and voice profile. Samples of your own writing, and a derived profile of your style, used so cover letters sound like you rather than like a machine.
- Your search criteria. Target titles, compensation floor, remote and location requirements, and the employers you have blocked with Employer Shield.
- Voluntary demographic answers (EEO). Gender, race and ethnicity, veteran status, and disability status. These are entirely optional and default to “decline to self-identify.” See section 4.
- Application records. For each application: the job, the answers it carried, the cover letter, screenshots taken before and after submission, and a copy of the page as it appeared. This is what makes a receipt a receipt, it is evidence for you, and you can view or delete it.
- Billing information. Your plan, usage count, and billing period. Card numbers go directly to our payment processor and never touch our servers.
- Notices we send you. Copies of the trial and billing emails we are required to send, kept so we can show a disclosure was delivered and when. Delivery is handled by our email provider, listed below.
- Service logs. Records of sweeps, grading runs, and AI calls made on your behalf, used for reliability and cost control.
- Newsletter signup email. Collected only if you subscribe to The Green Light, our free Sunday letter. Optional, kept separate from your account, and every issue carries an unsubscribe link.
- Usage and device data. Pages visited, signup steps completed, browser and device type, and interaction recordings on our own site, as described in the cookies and analytics section below.
3.How we use it
- To grade job listings against the criteria you set.
- To find matching roles and fill out job applications in your name for you to review and send, which is the core service you are purchasing.
- To write cover letters and resume revisions drawn strictly from facts you have confirmed.
- To identify a likely hiring contact after you apply and draft an outreach message for you to review and send yourself.
- To operate your account, take payment, and provide support.
- To keep the service working and honest, retry logic, per-employer success rates, and spend limits.
We do not sell your personal information, we do not share it with advertisers, and we do not use it to build profiles for anyone other than you.
4.Demographic (EEO) answers, how they are handled
Many employers include voluntary self-identification questions required by U.S. equal employment opportunity reporting. Because we complete applications for you, we store your chosen answers so those fields can be filled the way you want them filled.
- They are optional. Every one defaults to “decline to self-identify.”
- They are used for exactly one purpose: completing an employer's own voluntary EEO form. If a form has no such question, the data is never used.
- They play no part in how jobs are graded, ranked, or selected for you.
- They are never sent to our AI provider. The information given to the AI model is limited to job descriptions, your confirmed resume claims, your writing samples, and work-eligibility answers.
- You can change or clear them at any time in your profile settings.
5.Who we share it with
Employers. This is the point of the service. When you submit an application, the information on that application, your name, contact details, resume, answers, cover letter, and any voluntary EEO answers you provided, goes to that employer and their applicant tracking system. Once it is with them, their privacy practices govern it, not ours. Employers you add to Employer Shield are excluded, and that exclusion means an application to that company is never even prepared under your name.
Service providers. We use a small number of vendors to run the product:
| Provider | Purpose | What they receive |
|---|---|---|
| Supabase | Database, file storage, and authentication | All account data, resumes, and application records |
| Vercel | Application hosting | Request logs and traffic metadata |
| Anthropic | AI grading, cover letters, and resume review | Job descriptions, your confirmed resume claims, writing samples, and work-eligibility answers; your name only where a letter or outreach note is signed with it; never your address, phone number, or demographic answers |
| Stripe | Payment processing | Email and billing details, card numbers go directly to Stripe and are never stored by us |
| Inngest | Background job scheduling | Internal record identifiers |
| Railway | Hosting for the application-submission worker | Application form contents during submission, including your identity fields and resume file in transit |
| Resend | Transactional email (trial and billing notices) | Your email address and the contents of those notices |
| beehiiv | Newsletter delivery for The Green Light | Email addresses of newsletter subscribers, and whether they opened or clicked, held by beehiiv as our newsletter provider |
| PostHog | Product analytics on our own site | Pageviews and product-usage events; tied to your account only after you sign in; inactive unless an analytics key is configured |
| Microsoft (Clarity) | Session replay on our own site, used to find broken and confusing screens | Interaction recordings: scrolling, clicks, and page structure; inactive unless a replay key is configured |
Our AI provider does not use data submitted through its API to train its models. We may also disclose information if required by law, or as part of a merger or acquisition, in which case we will tell you before your information becomes subject to a different policy.
6.Information about other people
The outreach feature necessarily holds a small amount of information about people who are not GreenLight users: for a hiring manager we identify on one of your applications, we store their name, job title, and public LinkedIn profile URL, plus whether we confirmed they still hold that role and when.
- All of it comes from information those people published on a public professional profile. We do not buy contact data, and we do not store their email address or phone number.
- It exists for one purpose: showing you who to contact and drafting a message for you to send. It is never sold, never used to build a profile of them, and never shared with another user.
- Suppression lists are scoped to you, not shared across accounts. A global list keyed on someone's profile URL would compile a cross-user record of who has been contacted, which is third-party data aggregation we deliberately do not do.
- We never message anyone on your behalf. You send from your own account, so the person receives a message from you, not from us.
- We keep hiring-manager information only while it is relevant to your outreach. It is deleted with your account, and sooner on request from you or from the person it describes.
- If you are not a GreenLight user and want the information we hold about you removed, email support@greenlightapply.com and we will delete it.
7.How long we keep it
- Account and profile data is kept while your account exists, so the service can keep working for you.
- Application records and receipts are kept while your account exists, because their value is being able to look back at what was sent. You can delete individual records at any time.
- If you close your account, we delete your personal data within 30 days, except where we must keep records for tax or legal reasons.
- We cannot retract an application you have already submitted to an employer. To have that removed you would need to contact the employer directly.
8.Your rights and choices
You can view and edit most of your information directly in the app, your profile, Claim Vault, writing samples, Employer Shield, search criteria, and demographic answers are all editable at any time. Beyond that you may request:
- A copy of the personal information we hold about you, in a portable, machine-readable format.
- Correction of anything inaccurate.
- Deletion of your account and its data.
- That we stop processing your information, which in practice means pausing or closing your account.
Email support@greenlightapply.com and we will respond within 30 days. We will not charge you or degrade your service for exercising these rights.
We verify a request by matching the email address on the account, and an authorized agent can submit one for you with proof you said so. If we decline a request we tell you why, and you can appeal by replying to our response; depending on your state you can also escalate to your state attorney general.
California residents. You have the rights described above under the CCPA/CPRA, including the right to know, delete, and correct, and the right not to be discriminated against for exercising them. We do not sell or share personal information as those terms are defined by the CCPA. Some of what we collect, your demographic answers in particular, is “sensitive personal information.” We use it only for the purpose described in section 4 and never to infer characteristics about you.
EU/UK residents. The service is operated from and hosted in the United States. If you use it from the EU or UK, your information is transferred to and processed in the United States. Our legal basis is performance of our contract with you, and your consent for the optional demographic answers, which you may withdraw at any time.
9.Security
Data is encrypted in transit and at rest by our hosting provider. Every table holding your data enforces row-level security, so one account cannot read another's records even in the event of an application bug. Files, resumes, letters, and application evidence, are stored in access-controlled buckets rather than public URLs.
No system is perfectly secure. If a breach affects your personal information, we will notify you and any required regulator without undue delay.
10.Cookies, analytics, and session replay
We use cookies and similar storage for two jobs. The first is keeping you signed in; those are strictly necessary and the service does not work without them. The second is understanding how our own site is used so we can fix what confuses people. For that we use PostHog for product analytics, which pages are visited and which steps of signup are completed, and Microsoft Clarity for session replay, which reconstructs how a page was used: scrolling, clicking, tapping. Automated agent traffic is filtered out before either tool sees it.
What we do not do: no advertising cookies, no cross-site tracking, and none of this data is sold or shared for advertising. Because we do not sell or share personal information, opt-out rights aimed at selling have nothing to bite on, but we treat a Global Privacy Control signal as a valid opt-out request anyway. Your browser can block non-essential cookies and signing in will still work.
11.The GreenLight Assist browser extension
GreenLight Assist is an optional Chrome extension that fills, in your own browser, the job applications GreenLight has prepared but cannot submit because the site requires a human verification step. It is a companion to your account, not a separate service, and everything in this policy applies to it.
- What it receives. When you open an application from its queue, the extension requests that one application's data from your account: your name and contact details, your standing answers to screening questions, the cover letter written for that role, and a temporary link to your resume. This is the same information the application itself will contain.
- What it sends back. When you submit the application, it reports the values that were filled and the confirmation text shown by the job site, so your receipt is complete. That report goes only to GreenLight, and nowhere else.
- Where it runs. Only on the job-board domains GreenLight supports, which are listed in the extension's manifest, and only in tabs you opened from your queue. It does not read, record, or transmit your browsing on any other site, and it has no analytics of its own.
- What it never touches. Password fields are skipped. It does not solve or interact with CAPTCHAs, and it never clicks a submit button, so nothing is sent under your name without your own click.
- What it stores. Only the pending application data for a tab you have open, held in browser session storage and discarded when you close the tab or quit the browser. Removing the extension removes it entirely; your GreenLight account is unaffected.
Your account session is what authorizes it. The extension has no login of its own and cannot see anything you are not already signed in to see.
12.Children
GreenLight is for adults seeking employment and is not directed to anyone under 18. We do not knowingly collect information from children. If you believe a minor has given us information, contact us and we will delete it.
13.Changes
If we change this policy in a way that materially affects how your information is used, we will email you before it takes effect. The date at the top of this page always reflects the current version.
Questions about any of this go to support@greenlightapply.com. See also our Terms of Service.