Privacy Policy

• Account — name, email, hashed password (or an OAuth identifier if you sign in with Google, GitHub, or LinkedIn), locale, and authentication metadata.
• Career profile — the CV, work history, skills, target roles, and preferences you add to build applications.
• Job & application data — jobs you search, save, or paste, and the application pipeline, documents, and interview sessions you generate.
• Connected-account tokens — encrypted OAuth tokens for optional integrations you enable (e.g. Google Calendar), stored encrypted at rest.
• Usage & device data — product events, approximate IP, and browser information used to run, secure, and improve the Service.

Each purpose is paired with the UK GDPR lawful basis we rely on:

• Delivering the Service — matching jobs and generating CVs, cover letters, strategies, and interview prep, and operating your account: performance of our contract with you.
• Payments — processing subscriptions and top-ups: performance of our contract; keeping the resulting transaction records: legal obligation.
• Optional integrations (e.g. Google Calendar): consent, which you can withdraw at any time by disconnecting.
• Marketing & digest emails: consent — every message has a one-click unsubscribe.
• Security, fraud prevention, and improving the Service: our legitimate interests in running a safe, reliable product.
• Meeting legal and regulatory obligations: legal obligation.

If you connect Google Calendar, we request the https://www.googleapis.com/auth/calendar.events scope solely to create and manage calendar events you ask us to add — interview times, application deadlines, and follow-up reminders. We store an encrypted refresh token so we can perform these actions on your behalf, and only for as long as the integration is connected.

Career Orchestrator's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, and we do not allow humans to read it except with your consent, for security, or where required by law. You can disconnect Google Calendar at any time in the app, which revokes and deletes the stored token.

Our optional Chrome extension ("Career Orchestrator") lets you save a job and see a Ghost Job authenticity score directly on supported job boards. It runs only on job pages at LinkedIn, Indeed, Glassdoor, and ZipRecruiter, and on careerorch.com (to sign you in). It does not read pages on other websites and does not track your general browsing.

What the extension processes:

• Job posting content — the title, company, location, description, salary, and URL of the job page you are viewing — used to request a Ghost Job score and, when you choose to save it, to add the job to your pipeline.
• Your sign-in token — stored locally in the browser (via the extension storage permission) so you stay signed in and saved jobs are linked to your account. It is not shared with third parties.
• Basic interaction events — e.g. job viewed, score requested, saved — to operate and improve the service.

The extension requests only the permissions it needs: storage (to keep your session) and notifications (to confirm when a job is saved or an application is synced), plus host access limited to the four job boards above and careerorch.com. It does not request access to all websites and contains no remote code.

Job posting content is sent to our backend and to our AI provider (Google Gemini) both when you request a Ghost Job score and when you save a job — solely to produce your score and application tools. It is never sold or used for advertising. You can delete saved jobs at any time from your dashboard.

We share the minimum necessary data with vetted processors that run the Service, under data-processing terms:

• AI providers (Google Gemini, Anthropic Claude) — to generate documents and analysis from the content you submit. Inputs are not used to train their models under our API terms.
• Payments (Stripe) — to process subscriptions and top-ups. We never see your full card details.
• Email (Resend) — to send verification, notifications, and digests.
• Job data sources — aggregators we query to return listings.
• Infrastructure & monitoring (Railway, Vercel, Sentry) — hosting, delivery, and error diagnostics.
• Product analytics (PostHog, hosted in the EU) — to see which features are used and where people get stuck, so we can improve them. This one runs only if you accept it in the cookie banner: decline, and nothing is sent. When you are signed in and have accepted, it receives your account ID, email, name, and plan so activity can be tied to your account. You can change your mind at any time by clearing this site’s data in your browser and choosing again.

We keep data only as long as needed for the purpose it was collected:

• Account & career data — kept while your account is active. Deleting your account immediately removes your personal data and cascade-deletes the records you own, except the limited records we're legally required to keep (payment records below) and anonymised audit entries; any residual copies in backups are then purged within the backup window below.
• Payment & transaction records — invoices and records of payments, refunds, and subscriptions are kept for 6 years from the end of the accounting period they relate to, as required by UK tax and accounting law (longer only where a specific rule requires it).
• Connected-account tokens (e.g. Google Calendar) — held only while the integration is connected; deleted immediately when you disconnect.
• Security-audit logs — up to 180 days.
• Backups — encrypted backups are retained on a rolling basis for up to 30 days and then overwritten, so a deletion is fully purged from backups within that window.
• Copies held by our processors — we instruct processors to delete data within 90 days of our request or the end of our contract, in line with their terms.
• Inactive accounts — if an account stays inactive for 24 months we email you at least 30 days beforehand, then delete it if you don't return.

Where we must retain limited records for legal reasons we keep only what's necessary, and audit entries that must persist are anonymised.

Under the UK GDPR you can access, correct, export, restrict, object to, or delete your data, and withdraw consent. You can do the main ones yourself in the app: Export downloads a JSON copy of your data, and Delete account removes it — subject to the limited legal-retention and backup exceptions described under Retention above. For anything else, email privacy@careerorch.com. You may also complain to the UK Information Commissioner's Office.

Automated decisions & profiling. Our job matching, ghost-job scoring, and ATS analysis rank and annotate listings and drafts to help you decide. They involve profiling in that they analyse your profile against job data, but they do not make decisions producing legal or similarly significant effects about you — you always choose what to apply to and what to send. You can ask how a score was produced, or opt out simply by not using those features.

We protect your data with encryption in transit and at rest for sensitive fields, hashed passwords, and access controls.

Several of our processors are based in the United States — Google (Gemini), Anthropic (Claude), Stripe, Resend, Sentry, Vercel, and Railway — so using the Service involves transferring some data there. Product analytics (PostHog) is hosted in the European Union, so that data is not transferred to the US. Those transfers are covered by the UK Addendum to the EU Standard Contractual Clauses and, where the provider is certified, the UK Extension to the EU–US Data Privacy Framework. You can request a copy of the safeguards for any specific provider by emailing privacy@careerorch.com.

We'll update this page when our practices change and revise the date above. Material changes will be notified in-app or by email.