1. What We Collect
When you use Adam & Seth ("the Service"), we collect and process:
- Account data — email address, full name, password (hashed, never stored in plaintext)
- Consent data — timestamp and IP address when you agree to these terms during signup
- Interview data — conversations with Seth, extracted knowledge entries, writing samples
- CV data — generated CV content and PDF files
- Recruiter chat data — conversations between recruiters and your digital twin (Adam)
- Recruiter consent data — when a recruiter uses Adam chat, we collect their email, consent timestamp, IP address, and browser information
- Job configuration — job labels, system prompt extensions, recruiter links
- Usage analytics — anonymized data about how you use the Service, including pages visited, features used, and interaction timing. This data is pseudonymized and does not include the content of your conversations.
2. How We Use Your Data
- Consent tracking — we record when you agree to our terms and your IP address at signup for legal compliance and security purposes. Recruiter consent data (email, IP, timestamp) is stored to ensure Terms of Service acceptance before chat access.
- AI processing — your interview data, knowledge entries, and writing samples are sent to an AI service to generate responses as your digital twin. This data is sent over encrypted connections and is not used to train AI models.
- CV generation — your knowledge base is processed by AI to generate structured CV data.
- Recruiter interactions — when a recruiter chats with Adam via a shared link, your knowledge base and writing samples are used to generate responses. Chat messages are stored.
- Product improvement — anonymized usage analytics are used to understand how the Service is used and to improve its features and user experience.
3. Third Parties
- Supabase — database hosting, authentication, file storage (EU infrastructure, SOC 2 Type II compliant)
- AI Gateway — AI response generation (data transmitted over HTTPS, not used for model training)
- PostHog — product analytics platform. Anonymized usage events (page views, feature interactions) are sent to PostHog. No conversation content is included. PostHog is GDPR-compliant; see posthog.com/privacy.
We do not sell your data to third parties.
4. Data Storage & Security
- Data at rest is encrypted (AES-256 via infrastructure-level encryption)
- Data in transit is encrypted (TLS/HTTPS)
- Passwords are hashed with bcrypt
- Row-level security ensures users can only access their own data
- Access to the Service requires authentication; signup is by invitation only
5. Your Rights (GDPR)
You have the right to:
- Access — view all data we hold about you (available in your dashboard)
- Rectification — edit your profile, knowledge entries, and other data at any time
- Deletion — delete your account and all associated data from your Profile page
- Data portability — export your data in a machine-readable format
- Withdraw consent — you may withdraw consent at any time by deleting your account
6. Data Retention
Your data is stored for as long as your account exists. When you delete your account, all associated data is permanently removed. There is no recovery after deletion.
Consent records (including IP addresses and timestamps) are retained as part of your account data and deleted when you delete your account. Recruiter consent data associated with your links is also deleted when you delete your account.
7. Special Category Data
We do not intentionally collect special category data (health information, political opinions, religious beliefs, sexual orientation, etc.). Our Terms of Service prohibit users from inputting such data. While we include guidance in our AI prompts to avoid soliciting sensitive information, AI instructions are not enforceable technical controls. Users are responsible for the data they provide.
8. AI Limitations
The Service uses AI to generate responses. AI-generated content may be inaccurate, incomplete, or inappropriate. The Service is not a substitute for direct communication with the person it represents. We provide the Service on a best-effort basis and do not guarantee the accuracy of AI outputs.
9. Contact
For privacy-related inquiries, contact the data controller at the email address provided in the application.