Privacy policy

• —We collect the bare minimum we need to make the tool work for you.
• —We never sell your data. We never share it for marketing.
• —You can ask us to delete everything at any time.
• —Sub-processors we use are listed below, including what each one sees.
• —EU and California residents: you have GDPR / CCPA rights and we honor them.

• —Email address: if you create an account, ask for a download, or subscribe to hiring tips. Used to send you the magic-link sign-in and the emails you opted into.
• —Company information you type in: name, mission, values, culture notes, role descriptions, KPIs, the things you tell the chat. Stored alongside your account so you can come back to your kits.
• —Talent Traction System content the tool generates: the documents we build with you. Stored alongside your account.
• —Shared kit views: when someone opens a kit you shared, we count the view and the rough timing. We do not capture the viewer’s identity unless they opt in.
• —Technical telemetry: IP address (for abuse prevention and rate limiting), browser type, and basic device info. Held briefly.
• —Optional analytics: page views and button clicks, only after you accept the cookie banner.

• —Candidate identifying details for shared kit links. Shared kits never include candidate names or contact details.
• —Payment information. The Talent Traction System is free, so we do not process payments here.
• —Sensitive personal information (health, financial, racial, religious). Please do not enter it. We are not set up to safely store it.

Your data is stored in Supabase Postgres databases in US-East. We use TLS for everything in transit and encrypted storage at rest. Backups are managed by Supabase.

• —Shared kit links: ninety days from when the kit was first shared. After that the link stops working and the snapshot is deleted within thirty days.
• —Your account and kits: until you delete your account. Delete the account and everything cascades within seven days (we hold a short cooldown so accidental deletes can be recovered).
• —Email list (hiring tips): until you unsubscribe. One click in any email.
• —Server logs and rate-limit data: thirty days, then purged.

These are the services that touch your data so the tool can run. We share the bare minimum each one needs.

Some services above are planned, not yet active. Resend, Sentry, and PostHog are being added during launch. Anything that goes live will be reflected here.

We use a small number of cookies:

• —Essential: keeps you signed in, remembers your cookie choice, remembers your email so we do not ask twice.
• —Analytics: only set if you click "Accept all" on the cookie banner.

You can:

• —See what we hold about you. Email us and we will send it back within thirty days.
• —Correct anything that is wrong. Edit it in the app, or email us.
• —Delete your account and everything in it. Use the "Delete my account" option, or email us. We confirm by email and act within seven days.
• —Take it with you. Request a copy of your data in a portable format.
• —Stop emails — one click in any email.

EU residents: you also have the right to lodge a complaint with your local data protection authority. California residents: you have specific rights under the CCPA / CPRA — the same rights above, plus the right to know about sales (we do not sell data).

If we change anything that affects how your data is handled, we will update this page. For material changes that affect users in a meaningful way, we will note the change at the top of this page for thirty days.