Privacy Policy

Introduction

MASSÉ ("we," "us," or "our") is operated by IdeaByHuman. We're committed to protecting your privacy and being transparent about how we handle your data. This Privacy Policy explains what information we collect, how we use it, and your rights when you use themasse.com and our related services.

Information We Collect

Account Information: Email address, password (stored as a secure hash), and profile details you provide.
Job Search Data: Target companies, outreach drafts, application pipeline entries, and contact imports. All job search data is encrypted using AES-256-GCM field-level encryption before storage. This means your target companies, outreach drafts, and contacts are encrypted even from us.
Payment Information: Payment processing is handled entirely by Stripe. We never see or store your full card numbers.
Usage Data: Feature usage and session activity, used to improve the service.
Technical Data: IP address and browser type, collected for security purposes.

How We Use Your Information

Provide the job search intelligence platform and its features
Generate AI-powered company research and outreach drafts
Process payments and manage your subscription
Send service emails (password resets, important account updates)
Analyze usage patterns to improve features and reliability

We do not sell your personal information. Full stop.

AI Processing and Third-Party Services

Anthropic (Claude AI): Powers company research, signal analysis, outreach drafting, and interview prep generation. Anthropic does not use customer data to train models under commercial terms.
Google AI (Gemini Flash): Used for automated signal screening as part of company monitoring. When Scout scans your target companies, headlines are routed through Gemini for relevance filtering before deeper analysis. Job search data processed via Gemini is subject to Google's commercial API terms. We do not send personally identifiable information to Gemini — only company names and public headline text.
Google (Gmail OAuth): When you connect your Gmail account, MASSÉ sends outreach emails via the Gmail API on your behalf. We store an encrypted OAuth refresh token to enable this. We do not read your inbox, access your contacts, or process any email content beyond what you explicitly draft and send within MASSÉ.
Supabase: Database and authentication hosting.
Stripe: Payment processing. Stripe's privacy policy governs payment data.
Render: Backend API hosting infrastructure.
Cloudflare: CDN, hosting, and security services.
Resend: Transactional email delivery (password resets and system notices).

Encryption and Privacy by Design

All job search data — including your target company list, outreach drafts, contact imports, and application notes — is encrypted using AES-256-GCM before it is stored in our database. The encryption key is maintained separately from the application layer. This means that even in the event of a database breach, your job search activity cannot be read. It also means that MASSÉ employees and operators cannot read your job search data. Your search is private by design.

Data Retention

Account data: Retained while your account is active. Deleted within 30 days of account deletion.
Job search data: Deleted when your account is deleted.
Payment records: Retained for 7 years as required by tax regulations.
Contact imports: Deleted with your account or upon request at any time.

Your Rights

You have the right to:

Access the personal data we hold about you
Correct inaccurate information
Request deletion of your account and data
Export your data in a portable format
Opt out of marketing communications at any time

To exercise any of these rights, contact us at privacy@themasse.com.

California and International Users

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to delete it, and the right to opt out of sale. We do not sell personal information. To exercise your CCPA rights, contact privacy@themasse.com.

If you are located in the European Economic Area (EEA) or United Kingdom, you may have additional rights under the General Data Protection Regulation (GDPR), including the right to access, rectify, restrict, or erase your personal data, and the right to data portability. To exercise your GDPR rights or to lodge a complaint, contact privacy@themasse.com.

Cookies

MASSÉ uses session cookies for authentication and preference storage. We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

Security

We implement multiple layers of security: AES-256-GCM field-level encryption for all job search data, HTTPS for all data in transit, secure password hashing, and regular security reviews. No system is perfectly secure — but we've designed MASSÉ so that even a database breach would not expose your job search activity.

Children's Privacy

MASSÉ is intended for professionals 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, please contact us at privacy@themasse.com.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we'll update the "Last Updated" date at the top and, for material changes, send a notice to the email address on your account. Your continued use of MASSÉ after changes become effective constitutes your acceptance of the revised policy.

Contact Us

Privacy questions, data requests, and deletion requests:

privacy@themasse.com