Privacy Policy

1. Introduction & Our Privacy Commitment

CareerWin ("we," "our," or "us") is owned and operated by CareerWin AI LLC, a Washington limited liability company organized in King County, Washington, USA.

This Privacy Policy explains with uncompromising clarity how we collect, process, secure, and handle your information when you access or use careerwin.ai, our web application, browser companions, and associated services (collectively, the "Service").

Our Foundational Privacy Promise: Your career history is confidential intellectual property. We do not sell your personal data, we do not monetize your job search with third-party advertising brokers, and we never use your private career records or interview transcripts to train our own foundation models.

2. Categories of Information We Collect

We collect personal information solely to provide, calibrate, and maintain our career intelligence platform:

• Identifiers & Account Data: Name, email address, password hashes or magic link authentication tokens managed securely through Supabase.
• Career & Professional History: Resumes and CVs you upload, job titles, dates of employment, company names, scope descriptions, key accomplishments, metrics, portfolio highlights, skills, education credentials, degrees, and professional certifications.
• Public Profile Text: Public narrative text from your LinkedIn profile or personal portfolio that you choose to submit for alignment and discrepancy audits.
• Interview & Diagnostic Transcripts: Audio transcripts or text responses you provide during Evidence Deep-Dive interviews to detail project metrics, engineering decisions, and leadership scope.
• Payment & Transaction Records: All commercial transactions are handled directly by Stripe, Inc. under PCI-DSS Level 1 compliance. CareerWin stores only transaction reference IDs, subscription tier status, and billing cycle renewal dates. We never store or process raw credit card numbers or security CVVs on our servers.
• Technical Telemetry: Anonymized server logs, operating system, browser user-agent, error logs, and IP addresses used strictly for crash diagnosis, rate limiting, and defensive cybersecurity operations.

3. Purpose and Legal Basis for Processing

We collect and process your personal information strictly for the following legitimate business purposes:

• Performance of Contract: To structure your private Master Work Record, cross-reference resume and LinkedIn discrepancies, generate Opportunity Kits, and administer your subscription.
• Legitimate Interests: To detect malicious access attempts, prevent fraud and chargeback abuse, secure platform endpoints, and maintain system stability.
• Legal Compliance: To satisfy tax, accounting, statutory corporate record-keeping, and legal discovery obligations under Washington State and U.S. federal law.
• Explicit Consent: Where you affirmatively choose to connect optional features, such as the Gmail job alert integration or browser companion.

4. Enterprise Infrastructure Sub-Processors & AI Data Governance

We do not sell your personal data or share it with advertisers, recruiters, or commercial data brokers. To deliver the Service, we engage carefully selected enterprise service providers (sub-processors) bound by strict confidentiality and data protection agreements:

• No Internal Foundation Model Training: CareerWin does not use candidate data, resumes, career narratives, or interview recordings to train or fine-tune proprietary foundation models.
• Contractually Bound AI Processors: We utilize enterprise API access with Google Cloud Platform (Vertex AI / Gemini) and Anthropic (Claude API). Under our executed enterprise terms of service, customer inputs are processed ephemerally in server RAM and processors are contractually prohibited from using customer data to train, retrain, or improve public foundation models.
• Operational Telemetry & Log Retention: Data retention in operational logs occurs solely under configured provider security policies (typically 30 days or less) for rate limiting, DDoS defense, and fraud prevention.
• Candidate-Controlled Custody: User content is retained in CareerWin's encrypted database only until you delete it or close your account, whereupon all records are purged immediately from active production databases.
• Cloud Database & Auth: Supabase, Inc. (hosted in US data centers via Amazon Web Services) providing AES-256 encryption at rest and PostgreSQL Row-Level Security isolation.
• Payment Infrastructure: Stripe, Inc. under PCI-DSS Level 1 compliance for secure subscription billing. CareerWin never stores raw credit card numbers.
• Transactional Delivery: Resend for authenticated account verification and notification emails.

5. Optional Gmail Job Alert & Application Status Sync Privacy

Connecting your Gmail account is completely optional. If you choose to enable this feature via Google OAuth 2.0:

• Restricted Scope: We request restricted read-only access limited strictly to scanning incoming job alert notifications and employment application status communications (such as recruiter screens, interview invitations, and status updates) from recognized job platforms and employer domains.
• Ephemeral Raw Email Destruction: Raw email message bodies, headers, and sender correspondence are parsed transiently in volatile server RAM and permanently discarded immediately after extracting structured metadata. Raw email content is never written to disk, databases, or backups.
• Candidate-Controlled CRM Metadata: CareerWin extracts only structured opportunity attributes (company name, job title, recruiter contact name, interview stage, dates, and salary ranges). Inferred status changes are presented in your CRM for candidate review and confirmation before being permanently recorded.
• Zero Access to Personal Correspondence: We do not read personal conversations, view contacts, access Google Drive files, or monitor calendar schedules.
• Instant Pause, Disconnect & Deletion: You can pause sync, disconnect your Gmail integration with one click in your dashboard or at myaccount.google.com/permissions, and purge all imported CRM records at any time.

6. Browser Companion (Extension) Privacy Protocols

The CareerWin browser extension runs locally within your client browser session:

• Local Client Execution: Form matching and field autofill algorithms execute locally inside your browser DOM.
• No Keystroke Logging: The extension does not record keystrokes, track search engine queries, or monitor general web browsing.
• Explicit Action Only: The extension only interacts with web forms when you affirmatively click "Fill Field" or activate the sidepanel assistant on a job application page.
• Sensitive Field Guard: The extension requires manual user confirmation for sensitive fields (such as work authorization, visa sponsorship, and demographic self-identification).
• Candidate-Controlled Submissions (No Auto-Apply): CareerWin never submits an application for you. The extension is an assistive filling tool that requires your active review, verification, and manual confirmation before any application is submitted.

7. Washington State Privacy Protections (MHMDA & Audio/Biometric Flow)

In compliance with the Washington My Health My Data Act (RCW 19.373) and Washington Biometric Privacy statutes (RCW 19.375):

• CareerWin does not collect, process, infer, share, or sell consumer health data, disability records, medical diagnoses, mental health indicators, or wellness data.
• Audio Processing & Zero Voiceprint Verification: When you use voice dictation or audio interview coaching:
  • Audio streams leave your browser encrypted over TLS and are transmitted directly to enterprise speech recognition endpoints (Google Cloud Speech-to-Text / Gemini Live API) solely for real-time speech-to-text transcription.
  • Under our enterprise data governance agreement with Google Cloud, customer audio transmitted to API endpoints is processed in volatile server memory solely to generate the transcript; it is never retained on Google servers, never logged, and never used to train or improve foundation AI models.
  • CareerWin does not retain the raw audio stream after transcription completes. Raw audio streams are never permanently stored, indexed, or included in database backups.
  • CareerWin does not extract, calculate, or store biometric voiceprints, vocal geometry, voice embeddings, or speaker recognition templates.
  • Generated text transcripts are saved directly into your private, encrypted candidate vault. You have complete control to review, edit, export, or permanently delete any transcript at any time.

8. California Privacy Rights (CCPA / CPRA Notice at Collection)

This section provides mandatory disclosures under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA/CPRA"):

• We Do Not Sell or Share Personal Information: CareerWin has not sold or shared personal information for cross-context behavioral advertising in the preceding twelve (12) months, and will not do so.
• Right to Know & Access: You have the right to request the specific pieces of personal information we have collected about you, the categories of sources, and the business purposes for collection.
• Right to Delete: You have the right to request the deletion of personal information collected from you, subject to statutory legal exceptions.
• Right to Correct: You have the right to request the correction of inaccurate personal information.
• Right to Non-Discrimination: We will never discriminate against you, deny services, or alter pricing because you exercised your statutory privacy rights.
• California Shine the Light (Cal. Civ. Code § 1798.83): We do not disclose personal information to third parties for direct marketing purposes.

To exercise any California privacy right, submit a verifiable consumer request to richardewing@careerwin.ai with the subject line "California Privacy Rights Request."

9. European & UK Data Protection Rights (GDPR / UK GDPR)

If you reside in the European Economic Area (EEA), the United Kingdom, or Switzerland, you possess the following rights under the General Data Protection Regulation (GDPR / UK GDPR):

• Right of Access (Article 15): Obtain confirmation as to whether your personal data is being processed and obtain a copy.
• Right to Rectification (Article 16): Correct inaccurate or incomplete personal data.
• Right to Erasure / "Right to be Forgotten" (Article 17): Have your personal data erased from active databases.
• Right to Restrict Processing (Article 18): Limit the scope of our data processing.
• Right to Data Portability (Article 20): Receive your structured career data in a machine-readable format (JSON/PDF).
• Right to Object (Article 21): Object to processing based on legitimate interests.
• International Data Transfers: When data is transferred to our servers in the United States, we rely on standard contractual clauses (SCCs) and robust technical encryption safeguards.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your national Data Protection Authority (DPA) or the UK Information Commissioner's Office (ICO).

10. Data Retention & Deletion Lifecycle (30-Day SLA)

We retain your personal information for as long as your account remains active or as needed to provide you with the Service.

Deletion Lifecycle & Backup Expiration: When you request account termination or data erasure:

• Immediate Production Wipe: Your account credentials, uploaded resumes, Master Work Record, interview transcripts, and CRM job application logs are purged from all active production databases immediately upon processing.
• Backup Cycle Expiration: Encrypted disaster recovery database backups automatically overwrite and expire within a maximum of thirty (30) calendar days. No personal data is restored from backups following deletion.
• Statutory Retention Exception: Limited financial transaction records (Stripe payment IDs, invoices, and subscription dates) are retained only as required by federal and state tax and corporate accounting statutes.

11. Children's Privacy (Strictly 18+)

The Service is strictly intended for adult working professionals. In compliance with the Children's Online Privacy Protection Act (COPPA), we do not knowingly solicit or collect personal information from children under eighteen (18) years of age. If we learn that an individual under 18 has registered an account, we will immediately terminate the account and purge their data.

12. Security Architecture

We employ defense-in-depth technical and organizational measures to safeguard your personal information:

• Encryption: AES-256 encryption at rest across all database volumes, and TLS 1.3 encryption in transit.
• PostgreSQL Row-Level Security: Mathematical tenant isolation enforced at the database engine layer.
• Ephemeral Edge Execution: Stateless API microservices deployed across Vercel's global edge network.

For deeper technical specifications, inspect our Security Architecture Documentation.

13. Contact Our Data Protection Office

If you have questions, feedback, or requests regarding this Privacy Policy or our data governance practices, contact our Data Protection Office: