Privacy Policy

Olive Independent Study, Inc.

Last Updated: June 30, 2026

1. Introduction

This Privacy Policy ("Policy") describes how Olive Independent Study, Inc. ("Company," "we," "us," "our") collects, uses, discloses, maintains, and protects information related to individuals who use, access, or interact with the Olive platform (the "Service").

By accessing or using the Service, you acknowledge that you have read, understood, and agree to be bound by this Policy. If you do not agree with this Policy, you should not access or use the Service.

This Policy is intended to be comprehensive and to cover current and reasonably anticipated future processing activities, including AI-assisted features, analytics, and integrations with third-party systems. Some descriptions may refer to features or integrations that are not yet generally available but are included to support legal completeness as the Service evolves.

2. Scope of This Policy

This Policy applies to information collected through the Service, including:

Websites and web applications operated by Olive Independent Study, Inc.
Browser extensions published by Olive Independent Study, Inc., including the Olive Auto-Apply Chrome extension
AI-powered tools, resume processors, interview simulators, and chat systems
Communication channels and account systems
Data received from educational institutions or authorized organizational partners
Device, browser, and usage information collected automatically

This Policy does not apply to:

Any third-party websites, platforms, or applications linked to the Service
Data collected independently by universities, employers, or job boards
Employee or contractor data processed by Olive Independent Study, Inc.

3. Eligibility and Children's Privacy

The Service is intended for adults who are at least 18 years old. By using the Service, you represent that you meet this age requirement and have the legal capacity to enter into binding agreements.

We do not knowingly collect personal information from individuals under 18 years of age. If we become aware that a minor under 18 has submitted personal information through the Service, we will take reasonable steps to delete such information as soon as practicable. If you believe that a minor has provided personal information in violation of this Policy, please contact us at [email protected].

If you access the Service through a university or other educational institution, that institution may have its own policies governing eligibility, student participation, and data handling practices. This Policy governs only the processing activities performed by Olive Independent Study, Inc. through the Service. For more details about institutional integrations, see Section 16 below.

4. Definitions

For the purposes of this Policy, the following terms have the meanings set forth below:

"Account" means a unique profile created to access the Service.

"Personal Information" means any information that identifies, relates to, describes, or can reasonably be associated with an individual. This includes identifiers, professional data, usage data, and AI-processed information.

"Service" refers to the job readiness, career development, AI-powered tools, web interfaces, and accompanying technologies offered by Olive.

"User Content" includes resumes, text inputs, uploads, recordings, chat messages, and any other data submitted by users.

"De-identified Information" means information that cannot reasonably be used to infer the identity of an individual.

"Aggregated Information" means information combined with other data, rendering personal identification impossible.

5. Categories of Information We Collect

We collect information from or about you in the following broad categories. Not all categories may apply to all users, and certain categories are included for purposes of future-proofing the Service.

A. Identity and Contact Information

Full name
Email address
Authentication identifiers (e.g., tokens issued by login providers)
Profile photo or avatar (if applicable)
User account identifiers
Organization or institution affiliation (if any)

Resume content and uploaded documents
Career summary and skills
Work and academic history
Certifications, achievements, and project data
Professional preferences and career interests
Job search filters and saved roles
AI-generated embeddings or structured data derived from your profile

C. Usage, System, and Device Data

Browser type and version
Device type and operating system
IP address and general geolocation (non-precise)
Session identifiers, timestamps, and log data
Referrer URLs and interaction patterns
Crash reports and diagnostic information

D. Communication and Interaction Data

AI chat messages and voice interactions
Interview transcripts and recordings
User-initiated support messages
Content generated during onboarding, mock interviews, or job matching

E. Organization-Provided Information

If your university, educational institution, or organization partners with us, they may provide:

School or organization identifiers
User roster or enrollment confirmations
Program or cohort information
Usage insights or aggregated engagement data

F. Sensitive Information

We do not intentionally collect or process:

Protected health information ("PHI") as defined under HIPAA
Government-issued identification numbers (e.g., SSN, passport)
Financial account numbers or credit card data
Educational records protected under FERPA, unless voluntarily submitted through resume uploads or user input
Precise geolocation data (we may collect approximate region)
Biometric identifiers used for identification

One category of sensitive information we DO collect, only when you volunteer it: demographic information (race, gender, veteran status, disability status, and sexual orientation) provided through the Olive Auto-Apply browser extension for the sole purpose of auto-filling equal opportunity employer (EEO/EEOC) questions on job application forms. See Section 5.G for the full disclosure; it is never sold, shared with third parties, or used for any purpose other than form completion.

Any other personal or sensitive information intentionally submitted by the user (including in free-form text or resume uploads) is processed in accordance with this Policy.

G. Data Collected by the Olive Auto-Apply Browser Extension

The Olive Auto-Apply browser extension collects and processes the following categories of data to provide its job application autofill functionality:

Profile data — name, email address, phone number, education history, and work experience, synced from your Olive account
Resumes and cover letters — uploaded or generated documents used to fill application forms and sent to the Olive backend for tailoring
Default application answers — work authorization status, sponsorship requirements, salary expectations, and available start date, saved to your Olive account and synced to the extension
Voluntary demographic information — race, gender, veteran status, disability status, LGBTQ+ identification, Hispanic/Latino status, and sexual orientation — saved to your Olive account, synced to the extension, and used only to auto-fill equal opportunity employer (EEO/EEOC) questions on job application forms
Job application metadata — URLs, job titles, company names, and applicant tracking system (ATS) types for applications you interact with
Form field structure — field labels and page structure from job application forms, sent to the Olive backend to generate AI-powered answers matched to each field
Fill history — a local record of your last 20 autofill attempts, including the URL, ATS type, timestamp, and success rate, stored only on your device
Fill feedback — optional user-submitted ratings, field counts, issues encountered, and comments, sent to the Olive backend to improve autofill accuracy
Authentication tokens — OAuth tokens from Google, Microsoft, or LinkedIn sign-in, stored locally in browser storage and refreshed automatically

What the extension does not collect:

Browsing history or activity on websites other than supported job application pages
Form data from pages that are not job application forms
Keystrokes, mouse movements, or screen content
Cookies from websites you visit

The extension only activates on specific applicant tracking system (ATS) domains listed in its manifest, such as Greenhouse, Workday, Lever, LinkedIn, Ashby, and others. It does not run on unrelated websites.

6. How We Collect Information

We collect information through one or more of the following methods:

A. Information You Provide Directly

Creating an account
Uploading a resume or other files
Completing forms, surveys, assessments, or profile fields
Participating in interviews or using voice-based tools
Engaging with AI chat, coaching, or recommendation features
Configuring default answers and demographic preferences in the Olive Auto-Apply browser extension
Submitting support tickets or contacting customer service

B. Automatic Collection Through the Service

Cookies, local storage, and session tokens
Browser and device metadata
Interaction data (clicks, page views, time on page)
Error logs, crash events, and system diagnostics
AI tool usage history and interaction timestamps
Form field labels and page structure extracted by the Olive Auto-Apply browser extension on supported job application pages

When you sign in to the Service or the Olive Auto-Apply browser extension using a third-party account (Google, Microsoft, or LinkedIn), we receive limited profile information from that provider, including:

Your name and email address
Profile photo (if available)
Account identifiers used for authentication

We do not access your contacts, calendar, files, or any other account data beyond what is needed for authentication. Your use of these third-party login services is also governed by their own privacy policies.

D. Information from Third Parties

We may receive information from:

Authentication providers
Educational institutions or organizational partners
Job boards or integrated job search tools
Analytics and service infrastructure partners

7. AI and Automated Processing

A. AI-Enabled Features

The Service includes AI-enabled and automated features, such as resume analysis and tailoring, interview simulations, chat-based and voice-based coaching, and job recommendations. When you use these features, your inputs (including resumes, prompts, interview answers, voice audio, chat messages, and other content) are processed by machine learning systems to generate outputs and suggestions.

To deliver these features, we share certain Personal Information with third-party AI providers that process it on our behalf:

OpenAI powers our real-time voice conversations, chat-based coaching, interview simulations, resume analysis and tailoring, and job-matching assistance. When you use these features, we (or, for live voice sessions, your device directly) send OpenAI the relevant inputs — which may include your resume and profile content, job descriptions you are working with, your interview answers, chat messages, and your voice audio during voice sessions. During an in-app voice session, audio streams directly from your device to OpenAI's real-time service so the assistant can hear and respond.
Google (including Google Cloud and Vertex AI) powers resume and profile understanding, semantic job matching and embeddings, content generation for resume tailoring and evaluation, and location autocomplete. We send Google the relevant inputs for these features — which may include your resume and profile content, job descriptions, and search queries.

These providers act as our service providers (processors): they are permitted to use your information only to provide the requested service to Olive, and not for their own independent purposes. Under our agreements with them, OpenAI and Google are contractually required to protect your Personal Information with safeguards at least as protective as those described in this Policy (including this Policy's confidentiality, security, and data-retention commitments), to restrict access to authorized personnel, and not to use your Personal Information to train their own foundation models except as needed to provide the service to Olive. Both providers process data in the United States.

We also rely on additional service providers to operate the Service, including Twilio (telephony and recorded-call processing), Mailgun (transactional email), Elasticsearch (job search), and Mapbox (location autocomplete). Where we rely on such providers, they act as service providers to us and are permitted to use your information only to provide services to the Company, subject to contractual confidentiality and security obligations. The specific providers we use may change over time; please refer to the most current version of this Policy for an up-to-date list.

In our iOS and Android mobile apps, the first time you use a feature that would send your information to a third-party AI provider, we present an in-product disclosure that explains, in plain language, what data will be shared (such as your resume content, interview answers, chat messages, and voice audio), who it will be shared with (OpenAI and Google), and how it is protected — and we ask you to agree before any data is shared. If you do not agree, that feature will not send your data to the provider and will not run.

When you use AI features through other parts of the Service, your use of those features reflects your agreement to the sharing described in this Section 7.

You can choose not to use AI features at any time. You can also request deletion of your data as described in Sections 11 and 14, including by contacting us at [email protected].

D. Accuracy and Human Oversight

AI-generated content may contain inaccuracies or reflect limitations of the underlying models. Outputs are intended to support, not replace, your own judgment. You remain responsible for reviewing and deciding how to use any AI-generated suggestions or content.

The Service does not make automated decisions that produce legal or similarly significant effects without human review. AI-generated job application answers are presented as editable suggestions — you may review, modify, or delete any AI-generated content before submitting an application.

Automated Form Actions (Browser Extension)

The Olive Auto-Apply browser extension fills job application form fields from your profile and saved answers. It does not automatically accept consent checkboxes or legal agreements — such as privacy policy acceptance, terms of service, arbitration provisions, or background check authorization — and it does not submit applications on your behalf. You review the filled application, complete any consent or legal acknowledgments yourself, make any changes, and submit it. You remain solely responsible for the content of any application you submit and for any terms or conditions you accept. You can cancel an in-progress autofill at any time.

8. Purposes for Processing Personal Information

We may use Personal Information for a wide range of operational, analytical, and compliance-related purposes. These purposes include, but are not limited to, the following:

A. Providing and Maintaining the Service

User authentication and account creation
Operating AI-driven tools such as resume parsing and interview simulation
Processing and analyzing resumes, documents, and user inputs
Generating tailored job recommendations
Supporting job search and application workflows

B. Improving, Developing, and Enhancing the Service

We analyze usage data and user interactions to:

Enhance feature performance and reliability
Develop new features and tools
Improve AI accuracy and training, including by using de-identified or aggregated information
Monitor system integrity and security

C. Communicating with You

Sending administrative notices
Responding to support inquiries
Providing onboarding guidance
Sending optional service updates or informational messages (unless you opt out)

D. Security, Fraud Prevention, and Compliance

Detecting unauthorized access or misuse
Monitoring system integrity
Complying with legal obligations or requests
Enforcing our Terms of Service and investigating potential violations

E. Organizational and Academic Partner Functions

If you access the Service through a participating university or institution:

We may provide aggregated engagement metrics to administrators
We may verify enrollment or institutional affiliation
We may support institution-specific job-matching frameworks

F. De-Identified and Aggregated Data Uses

We may create and use de-identified and aggregated data for analytics, system improvement, trend analysis, and other research-related purposes. This data does not identify individual users and may be shared with institutions, partners, or publicly in research reports.

We may share Personal Information under the circumstances described below. We do not exchange Personal Information for money. However, as described in Section 10, we use third-party advertising technologies that share limited information with advertising partners for conversion measurement and retargeting. Under California and other state privacy laws, this "sharing" for cross-context behavioral advertising may be treated as a "sale" or "share" even though we receive no money for it. You can opt out of this sharing at any time — see Section 10.C and Section 18.

A. Service Providers and Vendors

We use third-party providers to support the Service, including:

Hosting and infrastructure providers
Authentication services
Analytics platforms
AI processing engines and model inference partners
Document processing and file storage vendors

These providers may have access to Personal Information only as necessary to perform services on our behalf and are bound by contractual obligations to maintain confidentiality and security. For the specific AI providers we use (OpenAI and Google), the categories of data we share with each, the protections they are contractually required to maintain, and the consent we obtain from you before sharing, see Section 7 (AI and Automated Processing).

B. Educational or Organizational Partners

If you access the Service through a participating institution:

We may share aggregated or de-identified engagement metrics to help institutions evaluate program effectiveness
Limited user-level information may be shared if explicitly authorized or required to deliver institution-specific features

C. Legal, Regulatory, and Compliance Disclosures

We may disclose Personal Information if required to:

Comply with applicable laws or regulatory obligations
Respond to lawful governmental or judicial requests
Protect the rights, safety, or property of the Company or users
Prevent fraud, abuse, or unauthorized use of the Service

We may share Personal Information for any other purpose disclosed to you at the time of collection if you consent to such sharing.

10. Cookies, Local Storage, and Tracking Technologies

We use cookies, browser local storage, and similar technologies to operate the Service, remember your preferences, understand how the Service is used, and measure the effectiveness of our advertising. Some of these technologies are third-party advertising pixels and cookies that "share" limited information for cross-context behavioral advertising, as described in Section 10.A below. Under California and other state privacy laws this sharing may be treated as a "sale" or "share" even though we receive no money for it, and you can opt out at any time as described in Section 10.C.

A. Categories of Technologies We Use

Strictly Necessary — Authentication tokens (Firebase Auth session cookies), CSRF protection for third-party sign-in (e.g., LinkedIn OAuth state), and other security-critical state. These are required for the Service to function and are not subject to opt-out.
Functional — User-interface preferences (theme), search filters, onboarding progress, referral-source attribution, and other state stored in browser cookies, localStorage, or sessionStorage to provide a continuous experience across visits.
Analytics — We use Google Analytics 4 (via Firebase Analytics), a first-party measurement implementation, to understand aggregate product usage (which features are used, where users encounter friction). We have configured this implementation to avoid the use of Google Signals and cross-site advertising integrations.
Advertising — We use third-party advertising technologies to measure the effectiveness of our advertising and to show relevant ads. Today this includes the Reddit pixel, and we may add Meta and Google advertising pixels in the future. When these are active, we share limited information with these partners for conversion measurement and retargeting: the pages (URLs) you visit on the Service, your IP address, your browser/device information (user-agent), and a pseudonymous internal account identifier. We do not share your name, email address, resume content, or other sensitive personal information with advertising partners, and advertising pixels are suppressed on sensitive or health-adjacent pages. Under California and other state privacy laws this "sharing" for cross-context behavioral advertising may be treated as a "sale" or "share" even though we receive no money for it. You can opt out at any time — see Section 10.C below.

B. Managing Cookies and Similar Technologies

You may use your browser settings to block or delete cookies and clear local storage at any time. Disabling strictly necessary cookies will prevent you from signing in or using core features of the Service.

C. Your Advertising Choices and Universal Opt-Out

You can opt out of the advertising "sharing" described above at any time, in either of two ways:

Use the "Your Privacy Choices" / "Do Not Sell or Share My Personal Information" link in our website footer and on our homepage; or
Toggle off the Advertising controls in your Privacy & Security settings.

We recognize and honor the Global Privacy Control (GPC) browser signal as a valid opt-out preference signal for all U.S. visitors, regardless of the state in which they reside. If your browser or browser extension is configured to send a GPC signal, we treat you as opted out of advertising sharing automatically and disable advertising pixels and analytics event collection for your session — no separate action is required. You can verify GPC is enabled at globalprivacycontrol.org.

We also recognize and honor browser or device signals that indicate a visitor is a minor; where such a signal is present, we treat the visitor as opted out of advertising sharing.

D. Do-Not-Track Signals

Because no uniform industry standard exists for interpreting the legacy Do-Not-Track (DNT) header, we do not act on DNT specifically. We treat the Global Privacy Control signal (described above) as the operative universal opt-out, consistent with current California Attorney General enforcement guidance.

11. Data Retention

We retain Personal Information for as long as reasonably necessary to fulfill the purposes outlined in this Policy, including:

Providing and improving the Service
Maintaining account activity and records
Complying with legal, regulatory, or contractual obligations
Resolving disputes or enforcing agreements

Retention periods may vary depending on the nature of the information. For example:

Resume uploads, job preferences, interview transcripts, and AI interactions are retained while your account is active.
When you delete your account yourself, we promptly remove or replace the information that directly identifies you (such as your name, email address, profile links, and demographic answers) so the account can no longer be attributed to you. The remaining de-identified and aggregated information may be retained indefinitely for analytics, service improvement, and research as described in this Policy. You may request a full erasure of the underlying content (including resume files and voice recordings) through our support channels; full erasures are reviewed and carried out by an administrator.
Voice recordings are retained for service and model improvement only where you have given an explicit opt-in; otherwise they are removed when you request a full erasure.
System logs and diagnostic information may be retained for security or operational purposes.
Backups may store certain information for a limited period after deletion for disaster recovery.

Browser Extension Data Retention

Local extension data (stored in chrome.storage) — including default answers, demographic preferences, fill history, and authentication tokens — is deleted when the extension is uninstalled or the user signs out.
Backend data (profile, application history, fill feedback) — retained while your account is active. When you delete your account, directly identifying information is removed or anonymized; de-identified data may be retained as described in the "Data Retention" section above. A full erasure may be requested through our support channels.
Fill history — stored locally only, limited to the last 20 entries, and overwritten automatically as new entries are added.

When retention is no longer necessary, we will delete, anonymize, or de-identify the data, unless we are legally required to retain it.

12. Security Practices

We implement a combination of administrative, technical, and physical safeguards designed to protect Personal Information from loss, unauthorized access, misuse, alteration, or destruction. These security measures may include:

Encryption of data in transit using SSL/TLS
Access controls and authentication mechanisms
Monitoring for unusual activity or unauthorized access attempts
Secure cloud infrastructure protected by industry-standard safeguards
Routine backups and disaster recovery systems
Vendor and partner security due diligence

Despite these efforts, no method of electronic transmission or storage is completely secure. You use the Service at your own risk. We encourage users to follow best practices for account security, including safeguarding login credentials.

13. Your Privacy Rights

Depending on the jurisdiction in which you reside (such as California), you may have specific rights regarding your Personal Information. These rights may include, where applicable:

Right to Know: Request disclosure of categories and specific pieces of Personal Information collected about you.
Right to Access: Obtain a copy of your Personal Information.
Right to Delete: Request deletion of Personal Information, subject to legal and operational exceptions.
Right to Correct: Request correction of inaccurate Personal Information.
Right to Opt Out of Sale/Sharing: You have the right to opt out of the "sale" or "sharing" of your Personal Information for cross-context behavioral advertising. We do not exchange Personal Information for money, but our use of third-party advertising technologies may constitute a "sale" or "share" under state law. You can opt out as described in Section 10.C.
Right to Non-Discrimination: We will not deny services or provide differing levels of service based solely on your exercise of your rights.

To submit a privacy request, contact us at [email protected]. We may require verification of your identity before fulfilling requests.

14. Accessing, Updating, or Deleting Your Information

You may be able to access, modify, or delete certain Personal Information directly within your account settings. If this is not possible, you may submit a request through our support channels.

We offer two levels of deletion:

Self-service account deletion. When you delete your account from your settings, your account is disabled and you can no longer sign in, and we promptly remove or replace the information that directly identifies you — including your name, email address, profile photo, external profile links, and demographic answers. After this step the remaining information is no longer reasonably attributable to you, and we may retain that de-identified and aggregated information indefinitely for analytics, service improvement, model improvement, and research, as described in the "Data Retention" section.
Full erasure on request. You may request complete removal of the underlying content associated with your account — including resume files, uploaded documents, interview transcripts, and voice recordings — by contacting us through our support channels. Verified full-erasure requests are reviewed and carried out by an administrator.
Voice recordings. Where you have given an explicit, separate opt-in, your voice interactions may be used and retained to improve voice features and quality. You can decline at any time, and voice recordings are removed when you request a full erasure.
Backups may retain information temporarily for disaster recovery.

15. Third-Party Websites and Links

The Service may include links to third-party websites, platforms, or tools. We do not endorse or control third-party practices, and we are not responsible for the privacy, security, or content of such third-party services. Your interactions with those parties are governed by their own terms and privacy policies. We encourage you to review the privacy policies of any third-party service you visit.

16. Organizational and Educational Institution Integrations

Certain users may access the Service through a university, employer, or other organizational program. When the Service is made available through such partnerships, the following additional terms apply:

We may provide aggregated or de-identified information, including:

User participation metrics
Progress summaries
Usage trends and engagement statistics
General insights about job readiness performance

These disclosures do not include personally identifiable information unless expressly authorized by the user or required for a specific institution-provided program feature.

B. FERPA Disclaimer

We are not the custodian of official academic records and are not directly subject to the Family Educational Rights and Privacy Act ("FERPA"). Any FERPA-protected information submitted through the Service (for example, GPA listed in a resume) is processed solely as user-submitted content, governed by this Policy and not by FERPA. Educational institutions remain responsible for compliance with their own FERPA obligations and privacy practices.

17. De-Identified and Aggregated Information

We may convert Personal Information into de-identified or aggregated data by removing or obscuring identifiers. We may use or disclose such information for:

Research, analytics, and reporting
Service optimization and performance insights
Trend analysis and usage analytics
Internal business purposes
Sharing with educational institutions or partners in aggregate form

This information cannot reasonably be used to identify an individual.

18. California-Specific Disclosures (CCPA / CPRA)

If you are a resident of California, the California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act ("CPRA") provide specific rights regarding your Personal Information. This section supplements the information elsewhere in this Policy.

A. Categories of Information Collected

Within the last 12 months, we may have collected information in the following categories defined under the CCPA:

Identifiers (e.g., name, email address, device identifiers)
Personal information categories defined in state law
Commercial and professional information (resume data, job preferences)
Internet or network activity (usage data)
Geolocation data (approximate)
Sensory data (voice recordings if submitted)
Inferences drawn from user activity

We do not exchange Personal Information for money. However, we use third-party advertising technologies — currently the Reddit pixel (and we may add Meta and Google in the future) — that share limited information with advertising partners for conversion measurement and retargeting: the pages (URLs) you visit on the Service, your IP address, your browser/device information, and a pseudonymous internal account identifier. Under California and other state privacy laws, this "sharing" for cross-context behavioral advertising may be treated as a "sale" or "share" even though we receive no money for it. We do not "sell" or "share" sensitive personal information for advertising, and we suppress advertising pixels on sensitive or health-adjacent pages. The categories of Personal Information "shared" in this manner are identifiers and internet or network activity, as described above. You can opt out of this sharing at any time — see Section 18.C below.

C. CCPA/CPRA Rights Summary

California residents have the following rights, subject to certain limitations:

The right to know what Personal Information is collected
The right to request deletion of Personal Information
The right to correct inaccurate information
The right to access collected information
The right to opt out of the "sale" or "sharing" of Personal Information for cross-context behavioral advertising. To exercise this right, use the "Your Privacy Choices" / "Do Not Sell or Share My Personal Information" link in our website footer and on our homepage, or toggle off the Advertising controls in your Privacy & Security settings. If your browser sends a Global Privacy Control (GPC) signal, we treat you as opted out automatically (see Section 10.C).
The right to limit the use of sensitive personal information (we do not use or disclose sensitive personal information for advertising or any purpose requiring this right)
The right to non-discrimination

D. Exercising Your Rights

To submit a request under CCPA/CPRA, contact us at [email protected]. We may require identity verification before fulfilling requests.

E. Global Privacy Control

We recognize and honor the Global Privacy Control (GPC) browser signal as a valid universal opt-out preference signal, including for the "sale" or "sharing" of Personal Information for cross-context behavioral advertising as well as analytics collection. When GPC is enabled in your browser, we treat you as opted out automatically and no separate request is required. See Section 10.C for details.

19. Data Storage, Transfers, and International Users

The Service is operated from within the United States. By using the Service, you understand and acknowledge that your Personal Information may be stored, processed, or transferred within the United States.

The Service is designed and intended primarily for users located in the United States. While users outside the United States may access the Service, they do so at their own risk and are responsible for ensuring that their use complies with local law.

By using the Service, international users consent to the transfer, processing, and storage of their Personal Information in the United States, where privacy laws may differ from those in their jurisdiction.

20. Data Breach Notification

In the event of a data breach involving Personal Information, we will follow applicable legal requirements for notification. Depending on the nature of the breach, this may include:

User notification via email or in-app alert
Notification to relevant governmental authorities
Implementation of corrective and preventive measures

We will take reasonable steps to mitigate harm and prevent future unauthorized access.

21. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When changes are made, we will update the "Last updated" date at the top of this page. In the event of material changes, we may also provide notice through:

Email notification
In-app or website banners
Account notifications

Your continued use of the Service following updates indicates your acceptance of the revised Policy.

22. Contact Information

If you have questions regarding this Privacy Policy, or if you wish to submit a privacy request, contact us at:

Olive Independent Study, Inc. ATTN: Privacy Office 770 Juniper Street, Suite 2011 Atlanta, GA 30308 Email: [email protected]

23. Chrome Web Store Compliance

The Olive Auto-Apply Chrome extension's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, data collected by the Olive Auto-Apply extension is:

Used only to provide and improve the extension's single purpose of autofilling job applications
Not transferred to third parties except as necessary to provide the autofill service (e.g., sending form field structure to the Olive backend for AI-generated answer matching)
Not used for advertising, sold to data brokers, or transferred to any information reseller
Not used to determine creditworthiness or for lending purposes
Not read by humans except with your explicit consent, for security purposes (e.g., investigating abuse), or to comply with applicable laws

The extension transmits data exclusively over HTTPS and requires user authentication via Google, Microsoft, or LinkedIn OAuth. All API communication with the Olive backend uses encrypted connections and bearer token authentication.