Privacy Policy

Last updated: 29 September 2026

In one line: we collect only what it takes to find you jobs, tailor your resume and draft outreach on your behalf. We do not sell your information, and you can delete all of it at any moment. If that ever changes we will say so here before it takes effect.

Who we are

Tagishoti is operated by Yalabo Group. The business is not yet incorporated as a company, so there is no company registration number at this stage — we will update this section once it is. For any privacy question, write to us at info@yalabo.io.

What we collect

• Account details: your email address. You can sign up with a Google account, in which case we also receive your name and profile picture, or with an email and password — in which case the password is stored encrypted by our identity infrastructure provider and is not accessible to us.
• Your career information: resume files you upload and the content extracted from them, along with your professional LinkedIn profile details: experience, education, skills and anything else you chose to share.
• Your preferences: the kind of role you are looking for, location, salary range and whatever else you set in the service.
• Your activity in the service: which jobs we showed you, what you approved, what you rejected, and which outreach was sent — and if someone replied, both the fact of the reply and its content (see "Connecting your LinkedIn account").
• Technical information: basic usage data on the site and in the app, for operating and improving the product. Details in "Measurement and analytics".
• If you bought a paid plan: your payment details are handled by our payment provider and are not stored by us. We keep only your subscription status and billing history.
• If you left your details on the contact page: your name, your email address, a phone number if you gave one, and whatever you wrote in "How can we help?" — so we can get back to you.

Why we use it

• To find jobs that match your profile.
• To tailor a version of your resume to each job.
• To find relevant contacts at companies and draft outreach for you. Nothing is ever sent without your explicit approval.
• To operate the service, support you, and improve match quality.
• To send you updates about the service. You can unsubscribe at any time.
• To show examples from the service on our site — such as a reply an outreach received — always with names and every detail that could link them to you removed.

The legal basis for use is your consent and our provision of the service you asked for. You may refuse or withdraw consent at any stage, though parts of the service may not work without it.

Connecting your LinkedIn account

The LinkedIn connection is the broadest permission you grant us, so it should be clear exactly what is read through it:

• Your profile — experience, education and skills, so we understand what you are looking for and what to emphasise.
• Your connections list, to find which of them works at a company you are applying to.
• Searches on LinkedIn on your behalf — we run people searches through your account, filtered to the company you are applying to and to how far someone is from you in your network, to find who there might help. LinkedIn job pages are read the same way.
• Other people's public profiles at those companies, to judge who is positioned to move your application forward.
• LinkedIn conversations — for one purpose only: to detect that someone replied to outreach you sent. Without it the follow-up sequence would keep sending reminders to people who already answered you. When a reply is detected we store its content so we can show it to you in the service.

Actions on your behalf — a connection request or sending a message — happen only after you approve them one by one. You can disconnect at any moment from your account settings, and disconnecting also removes the connection at the provider that brokers it.

If your account is inactive for seven days we disconnect the LinkedIn connection automatically. Data already collected stays in your account until you delete it.

Who we share it with

We do not currently sell or rent personal information. Should that ever change, we will update this policy and tell you before it takes effect, and where the law requires your consent we will ask for it first rather than rely on this notice. We share information only with providers who operate the service for us, and only to the extent required:

• Supabase — the database, authentication, and resume file storage.
• Vercel — hosting for the site and the app.
• Anthropic and OpenAI — the AI models that tailor resumes and draft outreach. Resume content and job details are sent to them for that purpose. Both providers undertake not to train models on data submitted through their business APIs.
• Unipile — the provider that brokers the connection to your LinkedIn account.
• Mixpanel — usage measurement. See the next section.
• Google — signing in with a Google account, and details left in the "let's talk" form are stored in a Google Sheet and emailed to us.
• Third parties where required by law.

Most of these providers operate outside Israel, so information is transferred to and stored abroad.

Beyond these providers there is one further sharing: sharing your profile with Vort. Part of it applies to everyone who has accepted this Privacy Policy; the part that names you and says how to reach you happens only if you explicitly opt in.

Sharing your profile with Vort

VORT.AI LTD (company no. 517334215) of Tel Aviv, Israel, helps find people inside a company who may be able to refer you to a job. What is shared with Vort comes in two layers, and each has its own condition. If you have not accepted this version of the Privacy Policy (last updated 29 September 2026), nothing at all is shared with Vort — even if the Vort consent in your account is active.

• Layer 1 — a profile that does not name you. Shared for every user who has accepted this version of the Privacy Policy, and not conditioned on the separate Vort consent below. It contains: a pseudonymous identifier (not your user id in our systems, and it cannot be reversed), the target company and job title of the jobs you saved or unlocked in Tagishoti, role title, seniority, department, location, employment history, education, skills, the state of your Vort consent, and the date the record was last updated. It does not contain your name, your email address, your phone number, your CV file or your LinkedIn profile URL.
• Layer 2 — who you are and how to reach you. Shared only if you additionally gave the separate Vort consent — "I agree that recruiters and employers may contact me with job offers through Vort". It adds your name, your email address, your phone number and your CV file, and alongside them the evidence of that consent: when you gave it, which version of the wording you were shown, and how it was given. That consent is optional, you can withdraw it at any time in your account settings or by writing to us, and your use of Tagishoti does not depend on it. In neither layer do we share your private messages or your account credentials.
• What Vort does with it: Vort may present your profile to its customers, who are recruiters and employers, for employment opportunities, and may use the data to maintain and improve its own data and products. Vort is not a provider operating on our behalf — it acts as an independent controller of the data it receives and decides for itself how it is used.
• How the data moves: Vort pulls the records from our server over an authenticated, encrypted connection. The transfer is pull-only on their side.
• What happens when you withdraw: withdrawing the Vort consent stops Layer 2; Layer 1 continues to be shared under this Privacy Policy. We relay the withdrawal to Vort within 48 hours. Vort stops presenting your record to its customers within 5 business days, and deletes it within 30 days. A record already delivered to a Vort customer cannot be recalled — Vort notifies that customer of the withdrawal.

Finding a referral path to a job. Separately from that consent, when you ask us to find a referral path for a particular job, we send Vort the target company and job title along with your past employers and schools — without your name and without contact details — so Vort can return people who may be able to refer you.

Measurement and analytics

We use Mixpanel to understand how the service is used. The data is sent to the company's European Union servers, not to the United States. We link activity to your user identifier and to your email address.

The measurement is deliberately narrow: sensitive screens are not reported at all, addresses of specific jobs are stripped before sending, and we do not run session recording.

How long we keep it

We keep your information for as long as your account is active. When you delete your account, deletion is immediate — the identity record, the resume files in storage, the profile, the preferences, the jobs and the outreach are all removed at that moment, and the LinkedIn connection is disconnected at the provider.

Two things remain after deletion, and we would rather say so up front:

• An operational log recording that an action of a given type occurred, with the user identifier and the time. It does not contain resume content, outreach content or conversation content.
• Information we are required by law to keep, if and for as long as such an obligation exists.

Profile snapshots taken from LinkedIn are kept for as long as the account is active, and are deleted along with it.

Your rights

Under the Israeli Protection of Privacy Law, 5741-1981, as amended by Amendment 13, you are entitled to review the information held about you, to request its correction if it is inaccurate, and to request its deletion. To exercise any of these rights, contact us by email and we will handle the request within a reasonable time.

Information security

We take accepted measures to protect information, including encryption in transit, access control, and separation between environments. That said, no online service is entirely immune, and we cannot guarantee absolute security.

Cookies

We use essential cookies that hold your session in the service — without them you cannot stay signed in — a Mixpanel measurement cookie, and a cookie recording which link first brought you to us, so we can tell which of our own content reaches people. There are no advertising-network cookies on this site, we do not follow you across other sites, and we do not sell information to advertisers. You can block cookies in your browser, but you will not be able to sign in to the service.

The Cookie Policy lists every cookie by name: what it does, how long it lasts, and which ones depend on your consent and which do not.

Minors

The service is intended for people aged 18 and over. We do not knowingly collect information about minors below that age.

The angel program

An angel is an employee who chose to offer themselves as a way in for candidates interested in jobs at their company. Joining is voluntary, and the data collected about angels is narrower than what is described above:

• From LinkedIn — sign-up uses Sign In with LinkedIn, which provides only a member ID, full name, email address, and profile picture. We have no access to your contacts or messages, and we cannot act on your behalf in any way.
• From you — the employer you confirmed (to verify it we read, with your consent, the employment details on your public profile — once when you join and roughly every 90 days), the roles you chose to appear on, your contact preference, and an apply link if you attached one.
• What job seekers see — your name, picture, title, employer, and the way you chose to be reached. Your email address is never shown: email messages are relayed through us, and the sender's name and address are shared with you so you can reply.
• Removal and deletion — leaving the program takes one click from the angel dashboard and removal is immediate. Deleting your account also deletes all angel details.

The full detail — the infrastructure providers the data is held with, usage measurement and cookies, and revoking access from the LinkedIn side — is in the angel privacy policy.

Changes to this policy

If we update this policy we will update the date at the top of the page, and for a material change we will also notify you directly.

This page is a translation. In case of any discrepancy, the Hebrew version prevails.