Privacy notice

Career CoPilot is operated as a personal product venture by Paul Jolliffe from the United Kingdom. For the purposes of UK GDPR and the EU GDPR, Career CoPilot is the data controller for personal data you give us when you use the service.

You can reach us by email at privacy@career-copilot.co.

• Account data: email address, password (hashed), full name, and optionally a TOTP factor if you turn on two-factor authentication.
• Career data you give us: your CV text, target roles, applications, interview notes, salary information, networking contacts, coaching engagements, and the content of any personal website you publish.
• Wellbeing data you give us: mood check-ins, reflections, financial planning entries. This data is encrypted at rest using server-side encryption with a key managed in Supabase Vault — even Career CoPilot operators cannot read these notes without going through the authorised decryption path.
• Operational data: sign-in events, AI feature usage counts (for trial caps and billing), error logs, and payment events from Lemon Squeezy.
• Third-party contact data: when you add a contact to your CRM (their name, role, company, email), you tell us about a third party. We treat this as personal data and only use it to provide the service to you.

• We do not sell your data to anyone.
• We do not train AI models on your career data. AI prompts go to Anthropic under the Anthropic API terms; they do not train on API data.
• We do not set tracking cookies for advertising networks.

We process your data on the following lawful bases under UK GDPR Art. 6:

• Contract (Art. 6(1)(b)): processing necessary to deliver the service you signed up for — your career workspace, AI features, personal site, payments.
• Legitimate interests (Art. 6(1)(f)): minimal operational logging to keep the service secure and debuggable.
• Consent (Art. 6(1)(a)): for optional analytics and partner referral tracking, set only after you opt in via the cookie banner.

All personal data is hosted in EU/UK regions:

• Primary database and storage: Supabase (eu-west-2, London, United Kingdom).
• Application hosting: Vercel EU edge.
• AI processing: Anthropic API (US-hosted). Anthropic processes prompts under their Data Processing Agreement and does not train on API data.
• Payments: Lemon Squeezy (Merchant of Record, US-based, UK-registered for VAT/sales tax purposes).
• Video hosting (optional): Mux. Used only if you upload an intro video to your personal site.

We use the following sub-processors. Each has a DPA in place. We will update this list with at least 30 days’ notice before adding a new one.

• Supabase Inc. — database, auth, storage
• Vercel Inc. — application hosting
• Anthropic PBC — AI inference
• Lemon Squeezy LLC — payment processing
• Mux Inc. — video hosting (only if you upload a video)
• Adzuna, Reed, Findwork, Impact.com — job aggregation and affiliate tracking

• Active account data: for as long as your account is open.
• Interview transcripts and audio (if enabled): 90 days, unless you ask us to retain them longer.
• Deleted account data: when you delete your account via Settings, every row of your data is removed immediately, including storage buckets and Mux video assets. Encrypted backups roll off within 30 days.
• Payment records: kept as long as required for tax law (typically 6 years in the UK).

Under UK GDPR you have the right to:

• Access your data — exercise via Settings → My Data, which delivers a complete JSON export of every row.
• Rectification — edit your data directly in the app at any time.
• Erasure — one-click delete via Settings → My Data. Wipes every table, every storage bucket, every Mux asset.
• Restriction and objection — email privacy@career-copilot.co and we’ll respond within 30 days.
• Portability — the JSON export is standard, human-readable, and contains your data in full.
• Complain — you can lodge a complaint with the UK Information Commissioner’s Office at ico.org.uk.

Career CoPilot is for adults aged 18 and over. If we learn that we have inadvertently collected data from someone under 18, we will delete it.

We will post material changes to this notice on this page and notify active accounts by email. The ”last updated” date at the top reflects the most recent change.