Privacy policy

Last updated 12 September 2026

Everpath AB (org. no. 559512-1491, Ursviks Allé 49, 17466 Sundbyberg, Sweden) is the controller of the personal data Sherpa processes. Write to support@sherpaai.app about anything on this page.

This site, sherpaai.app, collects nothing: no form, no analytics script, no advertising tracker, no cookie. Everything below is about the product at app.sherpaai.app, which you reach by signing in.

1. What Sherpa stores about you

Your account. Your email address, the name your Google account offers if you sign in with Google, the time zone of the browser you signed up from, and the plan you are on. Sherpa keeps no password: sign-in is a Google account or a link sent to your address.

What you give it about yourself. Your resume, including the contact details, work permit and languages in it; your search preferences, which are the job title you want, the places and work modes you accept, the employment types, and the pay you expect; your answers to Sherpa's questions about you; and any free-text instructions. Every version of these documents is kept, so you can see what Sherpa was working from at any point.

What Sherpa produces. For each advertisement it reads for you: a rating, its reasons, and the key facts it extracted. For each application you ask it to prepare: the drafted answers, cover letter and resume variant, the critic's report on them, and any rewrites you request. PDFs you export are kept with your account.

Your applications. What you record about each one: its status, the interview rounds, dates, interviewers, links, your prep notes and debriefs, and comparisons between postings.

Your mailbox, only if you connect it. Connecting Gmail is a separate, explicit consent with read-only access. On each check Sherpa searches your mailbox for messages that look like replies to your applications and reads those messages to work out what changed. It keeps the message and thread ids, the status change it concluded, up to a few hundred characters of a message that changed a status (a rejection or an invitation), and interviewer names when a message gives them. The full message bodies are deleted at the end of every check, and the access token that lets Sherpa read your mailbox is stored encrypted. Disconnecting on your account page deletes that token at once; to also withdraw the grant on Google's side, remove Sherpa at myaccount.google.com/permissions.

Billing. Your Stripe customer id, the currency you bought in, and a record of each purchase (plan, term, amount). Card details are entered on Stripe's form and never reach us.

Technical records. Each piece of work Sherpa does for you is logged with its timings, token counts and cost, and each status change with its time and who made it. The model's inputs and outputs, which is to say your documents and the drafts, are not exported to our logging system.

2. Data about other people

Advertisements name recruiters and hiring managers, and replies to your applications are written by people. Sherpa keeps those names, and the public profile link an advertisement carries, to help you follow your own applications and for nothing else. They are never contacted, profiled or shared.

3. Why, and on what basis

To provide the service you signed up for, which is the agreement in the terms of service: reading and rating advertisements, preparing applications, and tracking them. To keep the service secure and fair, which is our legitimate interest: the technical records above, and the refusal of disposable addresses. With your consent, which you give when you connect Gmail and withdraw by disconnecting it. We do not use your data for advertising, we do not sell it, and we do not use it to train language models, ours or anyone else's.

Sherpa makes no decision about you with legal or similar effect. A rating is a suggestion you read; an application is sent by you, never by Sherpa.

4. Language models

The rating, the drafting and the reading of replies are done by Google's Gemini models through Google Cloud's Vertex AI in the European Union. Your documents, the advertisement and, for a mailbox check, the messages are sent to the model for that piece of work and are not retained by Google to train its models, under Google Cloud's data processing terms.

5. Where your data is, and for how long

Everything is held on Google Cloud in Belgium (region europe-west1). The database is backed up daily; backups are kept for 14 days, with point-in-time recovery over the same window. Cached copies of the advertisements Sherpa read and the logs of its work are deleted after 90 days. Your documents, ratings, applications and exported PDFs are kept for as long as your account exists.

When you ask us to delete your account we do so within 30 days, after which the data leaves the backups within a further 14 days. Records of purchases are kept for as long as bookkeeping law requires, by Stripe as the seller and by us as receipts.

6. Who else processes it

Google Cloud (Google Ireland Ltd): hosting, the database, file storage, the language models, sign-in (Firebase Authentication / Identity Platform) and logging. Data stays in the EU region above.

Stripe (Stripe Payments Europe Ltd and affiliates): payments, as the merchant of record for every purchase. Stripe receives your email address and whatever you enter on its checkout form, under Stripe's own privacy policy.

Public job sources. To find advertisements Sherpa fetches public pages from LinkedIn, company career sites and applicant tracking systems. Those requests carry no data about you. The one exception is the place you type into a search: its name is sent to LinkedIn's public location lookup and to komoot's Photon geocoder to turn it into a region, exactly as a search box on those sites would.

Google for Gmail, when you connect it, under the consent you give at that point.

Nobody else. Your data is never shared with employers, job boards, recruiters or advertisers.

7. Use of Google user data

Sherpa's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is used only to update the status of your own job applications inside Sherpa, is never used for advertising, and is never read by a person except with your explicit permission for a support request or where the law requires.

8. The browser extension

The optional Chrome extension fills application forms on the page you are looking at with the answers Sherpa prepared. To know who you are it reads Sherpa's session cookie for app.sherpaai.app; it sends nothing anywhere but to Sherpa, reads nothing from other sites, and never submits a form.

9. Cookies

Sherpa sets one cookie: the session that keeps you signed in, for 14 days or until you sign out. There are no analytics or advertising cookies, here or in the product.

10. Your rights

You can ask to see the data we hold about you, have it corrected, have it deleted, have its processing restricted, receive a copy in a portable form, or object to a processing based on our legitimate interest. Your documents are already yours to edit and download inside Sherpa; for everything else, write to support@sherpaai.app and we answer within 30 days. You can withdraw the Gmail consent at any moment by disconnecting it on your account page. If you believe we are handling your data wrongly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se) or to the supervisory authority of your own country.

11. Age

Sherpa is for adults. You must be 18 or older to hold an account; we delete an account we learn belongs to someone younger.

12. Changes

If this policy changes, the date at the top changes with it. Material changes are announced by email to everyone with an account before they take effect.