Privacy Policy
Last updated October 23, 2026. This policy explains what Lil Sally collects, why, who it goes to, how long we keep it, and what you can do about it.
The short version. Lil Sally applies to jobs for you, so she has to use your resume and profile to fill out applications and send them to the employers you choose. That's what your data is for. We don't sell it, we don't use it for advertising, we don't run ad trackers on our site, and you can have your account and data deleted at any time by emailing support@elegylabs.com.
1. Who we are
Lil Sally is a service of Elegy Labs LLC ("Elegy Labs," "we," "us"). This policy covers Lil Sally on elegylabs.com and Lil Sally inside ChatGPT. It doesn't cover employers' or job sites' own practices once you've applied, or Sara, our other product, which has its own terms. Questions: support@elegylabs.com.
2. What we collect
Information you give us
- Account: your name, username, email address and password (stored only as a one-way hash), or your Google account's name and email if you sign in with Google.
- Resume: the file you upload (each version you upload is kept so you can switch back) and the text we read from it.
- Application profile: what job applications ask for: contact details, location, links (LinkedIn, GitHub, portfolio), education, work history, skills, work authorization and sponsorship, start date, work setting, pay expectation, and anything else you add.
- Voluntary self-identification (optional): some employers ask optional demographic questions (gender, race/ethnicity, veteran status, disability, sexual orientation, transgender status, pronouns). Unless you change them on your Profile, Sally answers "decline to self-identify" (or "I don't wish to answer") for gender, race/ethnicity, veteran status and sexual orientation, and "No" for disability and transgender status. You can change any of these on your Profile at any time. We use them only to answer those questions on applications you send.
- What you tell Sally: your messages to her, the searches you set up, things you ask her to remember, and answers to application questions.
- School email (optional): if you sign up with a partner school's email for student perks.
Information created when Sally works for you
- Applications: the postings Sally found, what she entered on each form, a screenshot of each filled form, and whether it was sent.
- Your application email address: applications go out with an email address Sally manages for you. Emails that employers send to it (confirmations, security codes, interview requests, rejections) are received and read by our systems so Sally can finish applications, flag next steps and forward what matters to your real inbox.
- Job-site accounts: some employers' sites (such as Workday) require an account. Sally creates one using your application email address. Its password is stored encrypted.
- Credits and payments: your credit balance and history. Card payments are handled by Stripe; we never see or store your full card number.
Information collected automatically
- Security data: IP address and browser information when you sign in, and at sign-up a device fingerprint (a hash of browser characteristics) so one device can't open unlimited free accounts, plus a Cloudflare Turnstile bot check.
- Service logs: records of what the service did (for example, a search ran or an application was sent), used to keep Sally working and to fix problems.
- Local storage: our site stores your sign-in token in your browser so you stay signed in. We don't use advertising or analytics cookies.
3. How we use it
- To do what you ask: find postings, fill out and submit applications in your name, create the job-site accounts those applications need, handle the replies, and show you what was sent.
- To run your account: sign-in, credits, payments, student perks, and emails such as your morning summary and next-step alerts.
- To keep the service safe: preventing fraud, abuse and fake sign-ups, and securing accounts.
- To fix and improve Lil Sally, using service logs and the outcomes of applications.
- To meet legal obligations.
We don't sell your personal information, share it for cross-context behavioral advertising, or use your resume or applications to train AI models.
4. Who receives it
| Employers you apply to, and their job sites (Greenhouse, Workday) | Everything an application needs: your resume, profile answers and application email address. This is the point of the service. Once received, the employer's own privacy practices apply. |
|---|---|
| OpenAI (API) | Your resume, profile and the postings, so AI can read your resume, answer application questions, judge which postings fit, power Sally's chat, and sort incoming emails. Under OpenAI's API terms, API data isn't used to train their models by default. |
| OpenAI (ChatGPT), only if you connect Lil Sally to ChatGPT | What Sally sends back to your ChatGPT conversations (your searches, applications, credits and the parts of your profile ChatGPT asks for). ChatGPT conversations are covered by OpenAI's own privacy policy. Your street address and voluntary self-identification answers are never sent to ChatGPT. |
| Google Cloud | Hosting and storage for the service, its database and its logs. |
| Vercel | Hosting for the elegylabs.com website. |
| Twilio SendGrid | Sending our emails, and receiving the emails employers send to your application address. |
| Stripe | Payments and billing. |
| Cloudflare | The bot check (Turnstile) at sign-up. |
| Decodo | A network provider that routes Sally's web browsing while she applies. Application traffic to job sites is encrypted (HTTPS). |
| Sign-in, if you choose Continue with Google; and web fonts on our site. |
These providers process data for us under their own terms and only to provide their services. We may also disclose information if the law requires it, to protect the rights and safety of our users or others, or as part of a merger, acquisition or sale of assets (in which case this policy continues to apply to your data).
5. How long we keep it
- Account, profile, resumes, applications and screenshots: while your account is open.
- When you ask us to delete your account: we delete it from our active systems within 30 days. Service logs expire on their own, and records we must keep by law (such as payment records) are kept only as long as required.
- Applications already sent can't be recalled: employers keep what they received under their own policies.
6. Your choices and rights
- See and edit: your profile, resumes, memories, searches and applications are all in your dashboard.
- Delete: remove memories and resumes in the app, or email support@elegylabs.com from your account's email address to delete your whole account.
- Get a copy: email us and we'll send you a copy of your data.
- Disconnect ChatGPT: remove Lil Sally in ChatGPT's settings at any time. That ends its access right away.
- Stop applications: pause or stop any search, or turn on dry run so Sally fills forms without sending them.
Depending on where you live (for example, California under the CCPA, or the EU/UK under the GDPR), you may have rights to access, correct, delete or port your data and to object to or restrict some processing. Email support@elegylabs.com to use them; we won't discriminate against you for doing so. We'll verify the request comes from you, usually by replying to the email address on your account. Where the GDPR applies, we process your data to perform our contract with you (running the service you asked for), for our legitimate interests (security and improving the service), with your consent (optional self-identification answers), and to meet legal obligations. You may also complain to your local data protection authority.
7. Security
Data is encrypted in transit, passwords are stored as hashes, job-site passwords are encrypted, every account's data is kept separate from every other account's, and access to production systems is limited. No system is perfectly secure; if a breach affects your data, we'll notify you as the law requires.
8. Age
Lil Sally is for people 16 and older, and isn't directed to children under 13. If you believe a child under 13 has given us personal information, email support@elegylabs.com and we'll delete it.
9. Where data is processed
We and our providers process data in the United States. If you use Lil Sally from elsewhere, your data is transferred there.
10. Changes
We'll update this page when our practices change and change the date at the top. If a change is significant, we'll tell you by email or in the app before it takes effect.
11. Contact
Elegy Labs LLC · support@elegylabs.com