Chrome Extension Privacy Notice

Version 1.0 — Effective 24 April 2026

This notice explains how the ApplicantGrid Chrome extension (“the Extension”) handles your data. It supplements the main ApplicantGrid Privacy Policy, which governs all ApplicantGrid services; the general policy continues to apply to any data saved into your account through the Extension.

1. What the Extension Does

The Extension adds a browser-action popup. When you click its icon on a supported job-board page, it reads publicly-visible job information from that page (job title, company, location, salary when shown, description, and the page URL) and — after you press “Save to ApplicantGrid” — sends it to your ApplicantGrid account. Saved jobs land in a “Saved” bucket for you to review or apply to later.

2. Data We Collect Through the Extension

• Authentication data: your ApplicantGrid email and password, used only at sign-in. We store the resulting Supabase session tokens (access + refresh) in chrome.storage.localso the popup can call our API without asking you to sign in again. Nothing else is kept in browser storage.
• Job data: title, company, location, salary, description, canonical URL, and the source board identifier (e.g. “linkedin”, “indeed”). Read from the active tab’s DOM only after you click the Extension icon — never in the background.
• Your account’s recent saved jobs: the popup displays up to five of your own recently saved jobs, fetched from our API on popup open. This data never leaves your account.

3. What the Extension Does NOT Do

• No background scraping. The Extension’s scripts only run inside the active tab, only after you click the toolbar icon.
• No analytics, no tracking pixels, no third-party SDKs.
• No advertising, no sale of data, no data sharing with third parties beyond the processors listed in the main privacy policy.
• No reading of unrelated browsing. Host permissions are limited to ApplicantGrid’s own domain, Supabase, and the supported job boards.
• No passwords or credentials are captured from any page.

4. Host Permissions

The Extension requests access to the following hosts. Each is used for the single stated purpose; no other functionality reads from these domains.

• app.applicantgrid.com — call our own REST API to save jobs and load your recent list.
• *.supabase.co — authenticate you against our Supabase-hosted auth service.
• linkedin.com, indeed.com/indeed.co.uk, google.com, reed.co.uk, stepstone.de/.at/.ch, xing.com, infojobs.net/.it, totaljobs.com — read the currently-open job posting so the popup can pre-fill the save form.

5. Where Data Is Stored

Job and account data you save through the Extension are stored in our Supabase project hosted in Stockholm, Sweden (EU). Row-Level Security ensures that each user can only access their own records. See sections 5, 7, and 10 of the main privacy policy for retention periods, processors, and security controls.

6. Your Rights and Removal

You have the full set of GDPR rights described in section 8 of the main policy (access, rectification, erasure, portability, objection, complaint to the BayLDA). To delete data saved via the Extension, either remove individual applications from your dashboard or request account deletion at privacy@applicantgrid.com. Removing the Extension from Chrome clears its local session tokens but does not by itself delete data already saved to your account.

7. Changes

Material changes to this notice will be communicated via our dashboard or by email at least 14 days in advance.

8. Contact

Privacy: privacy@applicantgrid.com

Support: support@applicantgrid.com

Controller: M2Talents — Mo Mohamed, Munich, Germany