Privacy Policy

The Career Machine ("we", "our", "us") operates https://www.thecareermachine.com as a free career intelligence platform. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and the rights you have. We do not sell your personal data. We do not run targeted advertising based on your career profile. We do not require payment or credit card details.

We collect only the data necessary to provide the Platform: Account and authentication: • Email address, display name, encrypted password (via Supabase Auth). Career profile (when you create one): • Job title, industry, years of experience, target role, target location, education, skills, and links you choose to add (LinkedIn, GitHub, portfolio). Resume text (when you upload or paste one): • Text extracted from your resume for ATS analysis and gap detection. Original files are processed in memory and discarded — we do not store the raw PDF/DOCX. Applications and alerts: • Records of jobs you save, apply to, or set alerts for. AI conversations: • Coach chat history is stored so you can resume conversations. Personal identifiers are stripped before your text is sent to AI providers. Behavior data: • Page views, feature usage, and search queries. Used to improve the Platform. Purged after 90 days. Communications: • If you email us or submit feedback, we retain that correspondence for support and quality. We do NOT collect: • Government IDs, SSN, national identification numbers. • Biometric data. • Payment card details (we do not process payments).

We use your data to: • Provide, operate, and improve the Platform. • Calculate your employability score, gap analysis, and recommendations. • Match your profile with relevant jobs and resources. • Deliver AI-assisted career coaching, resume analysis, and interview preparation. • Send account-related emails (welcome, password reset, alert digests, weekly progress). • Prevent fraud, abuse, and security incidents. • Comply with legal obligations. We do NOT: • Sell your personal data to third parties. • Use your private resume text to train third-party AI models. • Share your profile with employers without your explicit action (such as clicking "Apply"). • Run behavioral advertising on your career data.

If you are in the UK, EU, or another region with similar laws, we rely on the following legal bases: • Performance of a service you requested (e.g. running the Platform). • Legitimate interests (e.g. security, fraud prevention, platform improvement) — balanced against your rights. • Consent (e.g. optional analytics cookies where required by law). • Legal obligation (where applicable).

When you use AI features (career coach, resume analysis, gap analysis, hub career plans, and other AI tools), your input is sent to AI providers to generate a response. Before sending, we automatically remove: • Email addresses • Phone numbers • Physical addresses • SSN, national IDs, credit card numbers • LinkedIn and GitHub URLs (in most contexts) We use a chain of AI providers. We do not permit AI providers to train on your input under the terms we have with them. If AI is temporarily unavailable, some features may return empty or degraded responses. You can always retry.

We share data only with vetted service providers that support platform operations: • Supabase — authentication and encrypted database hosting. • Hosting providers — for our frontend and API. • Resend — for transactional emails (welcome, alerts, weekly digest). • AI providers — for the AI features listed above, receiving your input with PII removed. • External data sources — we consume data from public job boards, government portals, ESCO, O*NET, and similar. We do not send them your personal data. • Analytics — anonymous aggregated usage (Google Analytics if enabled) to understand platform health. All service providers are bound by contracts requiring data protection and are prohibited from using your data for their own purposes. We may disclose data if legally required by court order or valid government request, or to protect the rights, safety, or property of the Platform or its users. If The Career Machine is ever involved in a merger, acquisition, or transfer of assets, we will notify you in advance and give you the opportunity to delete your data before the transition.

We implement technical and organizational safeguards to protect your data: • Encrypted transport (HTTPS/TLS) for all connections. • Encrypted storage at the database level via Supabase. • Row Level Security policies restrict access to your own data. • Role-based access controls limit which team members can access production systems. • Regular security review and monitoring. No system is completely immune to risk. Use a strong unique password and enable multi-factor authentication where available.

You have the following rights over your personal data: • Access — request a copy of the data we hold about you. • Rectification — correct inaccurate or incomplete data in your Account Settings. • Erasure — permanently delete your account and personal data. • Portability — export your data in a machine-readable format (JSON). • Restriction — ask us to limit how we use your data. • Objection — object to processing based on our legitimate interests. • Withdraw consent — where processing is based on consent. Two of these are one-click on the Platform: • Export: Account Settings → Privacy & Data → Export • Delete: Account Settings → Privacy & Data → Delete Account Deleted data is purged within 30 days. To exercise other rights, email contact@thecareermachine.com. We aim to respond within 30 days. If you believe we have not addressed your concerns, you may contact your local data protection authority.

We use only essential cookies and technologies necessary to run the Platform: • Session cookies for authentication. • Preference storage (theme, language) in browser storage. • Basic analytics to understand platform performance. We do NOT use third-party advertising cookies. We do NOT track you across unrelated websites. Where required by law, we ask for consent before enabling non-essential analytics.

We retain your data for as long as your account is active or as needed to provide the Platform. Specific retention: • Active account data — kept while your account is active. • AI conversations — 180 days, then purged. • Behavior tracking data — 90 days, then purged. • Job listings — active listings only. Older than 90 days are deactivated automatically. • Deleted account data — purged within 30 days of deletion request. • Anonymized aggregate statistics — may be retained indefinitely. • Legal or fraud investigation data — retained as long as legally required.

We may transfer and process your data in countries outside your own. When we do, we rely on appropriate safeguards such as Standard Contractual Clauses or the provider's certification under recognized frameworks.

The Platform is intended for people 16 years and older. We do not knowingly collect data from anyone under 16. If you believe a child under 16 has created an account, contact contact@thecareermachine.com and we will delete the account and associated data.

We may update this Privacy Policy from time to time. Material changes will be announced by updating the "Last updated" date at the top of this page and, where appropriate, by email or in-app notice. Continued use of the Platform after changes take effect means you accept the updated Policy.

Questions or concerns about privacy? Email contact@thecareermachine.com. We aim to respond within 30 days.