Privacy Policy

1. Personal data we process

Account and identity

• Name, email, password hash (or Google account identifier and profile photo if you use Google Sign-In), role (member, college admin, HOD, staff), and tenant.
• Email verification status and optional referral code.

Career profile

• Résumés and other documents you upload (up to 15 MB for a résumé).
• Assessment answers, career stage, target roles, skills, education, and work history.
• Job-search activity, saved jobs, evaluations, ATS and cover-letter drafts.
• Learning progress, Skill Lab state, interview-prep tracks, Office simulation work, and generated decks.
• Coach memory facts you allow us to keep, until you edit or forget them.

Communications and voice

• Prep chat, tutor, interview, and group-discussion messages.
• In-product messages, stored with AES-256-GCM on our servers. This is not end-to-end encryption. Career Matrix can decrypt messages when operating the product.
• Voice audio for the session you start. Audio is sent to the speech provider to transcribe or speak. We do not build a voiceprint to identify you.

College and public forms

• College name, city, country, website, departments, staff emails, and student invite emails.
• College-intake partnership forms and internship applications (name, email, phone, education, links, résumé).
• Contact-us messages and the topic you select.

Technical data

• IP address used for rate limiting and abuse control, user agent, and approximate timestamps.
• Auth tokens in your browser (localStorage) and a short-lived Google OAuth state cookie.
• Credit usage and feature counters.
• If you buy a credit pack: billing name, email, address, optional tax ID, Stripe customer id, checkout session id, amount, currency, and payment status. We do not collect or store card numbers, CVC, or full PAN. Stripe does.

We do not run advertising pixels or analytics SDKs on the public site or the workspace.

2. Why we process it

• Create and secure your account, verify email, and keep you signed in.
• Provide the career workspace: parse documents, evaluate job fit, generate drafts, run Learning Studio, Skill Lab, Office, and voice sessions.
• Remember facts you asked the coach to keep, until you delete them.
• Show a college the fields you have opted to share.
• Send transactional email (verification, invites, replies to contact forms).
• Enforce acceptable use, rate limits, and credit meters, and investigate abuse.
• Meet legal duties, including data-principal requests and breach notice.

3. Lawful bases (EU/UK GDPR)

• Contract: account, core workspace, credits, and the features you request.
• Consent: optional AI processing (models, voice, web search) recorded at sign-up, invite accept, or Google sign-in. You can withdraw consent by stopping use of AI features and emailing us. Some features then cannot run.
• Legitimate interests: securing the service, preventing abuse, measuring feature reliability, and answering contact forms from people who wrote to us.
• Legal obligation: tax or regulatory requests, and breach notification where a law requires it.

Under India's DPDP Act we process on consent (the checkboxes at sign-up and invite) and on legitimate use where you voluntarily give data for a specific purpose, such as a contact form or internship application, unless you indicate you do not consent.

4. Processors and international transfers

Production application servers run on Google Cloud, us-central1 (Iowa, United States). Production databases and files use Supabase. That means personal data is stored and processed in the United States, and may be processed in other countries where a named processor operates.

LangSmith tracing is off unless we explicitly enable it for debugging. If enabled, prompts and completions can be sent to LangChain's tracing service. We do not sell personal data. We do not use your content to train our own foundation model.

Stripe is used only if you start a paid checkout. Until then no payment data is sent to Stripe. Payment records are kept as long as tax and accounting law requires (typically six to seven years), even if you erase the rest of the account.

Transfers from the EEA/UK rely on the processor's standard contractual clauses or another GDPR Chapter V mechanism. Transfers from India follow the DPDP Act: we do not send personal data to a country the Government of India has restricted.

5. Who else can see data

• You, on your own account.
• College staff, only the fields you enable under Workspace → Privacy (visibility is off by default).
• People you message inside ICM.
• Career Matrix operators, when needed to run support, security, or a legal request.
• A successor if we transfer the service, under the same protections.
• Law enforcement or regulators when the law requires it.

6. Retention

• Account and profile data: for as long as the account is active, then until erasure or a short backup rotation.
• Voice audio: processed for the live session. We do not keep a biometric voiceprint.
• Messages: while the conversation exists, encrypted at rest.
• Consent records: kept so we can show what you agreed to.
• Security logs and rate-limit counters: typically days to months.
• Erased accounts: email is replaced with a tombstone, documents and memory are deleted, and the login is deactivated. We may keep what the law requires (for example a fraud record).

7. Security

We use TLS in production, hashed passwords (PBKDF2-HMAC-SHA256), short-lived access tokens with refresh rotation, AES-256-GCM for stored messages, role checks, upload size limits, and rate limits on auth, jobs, and model endpoints. No internet service is perfectly secure. If we become aware of a personal data breach we will notify affected people and, where required, the Data Protection Board of India and relevant EU/UK/US authorities. Under the DPDP Rules we aim to notify the Board and affected principals within 72 hours of becoming aware of a breach.

8. Your rights and how to use them

You can review college visibility and coach memory in the workspace at /workspace/privacy. Signed-in members can also:

• Download a copy of their account data from Privacy & visibility, or GET /api/account/export.
• Erase the account from the same page, or DELETE /api/account with password confirmation and the word DELETE.
• Correct profile and résumé data in My Profile.
• Forget individual coach-memory facts.

You can also email support@career-matrix.com. We aim to complete access, correction, export, and erasure requests within 30 days (45 days for CCPA requests; we will say if we need a lawful extension). We may need to verify it is you. You may nominate someone to exercise DPDP rights if you die or lose capacity: email us the nominee's name and email.

9. India (DPDP Act, 2023 and DPDP Rules, 2025)

Career Matrix is the data fiduciary for ICM accounts. You are the data principal. This page is the notice that accompanies consent. It states the data we collect, the purposes, how to withdraw consent, how to exercise rights, and how to complain.

• Consent is free, specific, informed, and unconditional. The sign-up and invite checkboxes are that consent. Withdrawing consent stops further optional AI processing. We may still keep what the law or the core account contract requires.
• Children: a child is anyone under 18. We do not offer the service to children and we do not track, behaviourally monitor, or serve targeted ads to children.
• Grievance Officer: support@career-matrix.com. We acknowledge IT Rules grievances within 24 hours and aim to resolve them within 7 days.
• If a DPDP grievance is not resolved, you may complain to the Data Protection Board of India after using this mechanism.
• We implement reasonable security (encryption in transit, access control, backups, processor contracts).
• We are not, as of this version, designated a Significant Data Fiduciary. If that changes we will appoint a Data Protection Officer and say so here.

10. European Union, EEA, and United Kingdom

• GDPR/UK GDPR rights: access, rectification, erasure, restriction, portability, objection, and withdrawal of consent.
• You may lodge a complaint with your supervisory authority (for example your national DPA, or the UK ICO).
• We do not make solely automated decisions that produce legal or similarly significant effects. Scores and evaluations are tools for you to review.
• Cookies: only strictly necessary storage is used. See the Cookie Policy. We do not need a marketing-cookie banner because we do not set advertising or analytics cookies.
• EU AI Act transparency for chat and generated media is in the AI Practices notice.

11. United States

Sale, sharing, and sensitive information

We do not sell personal information. We do not share personal information for cross-context behavioural advertising. We do not use or disclose sensitive personal information for purposes that require a "Limit the Use of My Sensitive Personal Information" link. Because there is no sale or share, a Global Privacy Control signal has no sale or share to turn off. Categories we collect are listed in section 1. Purposes are in section 2. We disclose those categories to the processors in section 4 so we can provide the service, not to advertise to you on other sites.

CCPA/CPRA and other state laws

If we meet a state law's "business" threshold, residents of California, Virginia, Colorado, Connecticut, Utah, and other comprehensive-privacy states may request know, delete, correct, and (where applicable) opt-out of sale/share/targeted advertising or profiling for legal/similarly significant decisions. Email support@career-matrix.com. We will not discriminate against you for exercising a privacy right. Authorized agents may write on your behalf with proof of authority.

Automated decision-making and biometrics

ICM evaluations are not significant automated decisions about employment, lending, housing, or insurance. We do not create a voiceprint or other biometric identifier from your audio. Audio is used to run the voice feature you started.

COPPA

The service is for adults. We do not knowingly collect personal information from anyone under 13, and we require users to be 18 or older.

12. Children

If you believe we have an account for someone under 18, email support@career-matrix.com. We will delete it.

13. Changes

We will post updates on this page with a new effective date and version. Where the law requires fresh consent (including a material change to AI processors), we will ask for it.

14. Contact

Privacy and rights requests: support@career-matrix.com. General: info@career-matrix.com. Grievance Officer: support@career-matrix.com. Website: https://career-matrix.com.