Privacy Policy

1. What We Collect

We collect the following categories of data to deliver and improve the Trajectry service:

• Account data: email address, password hash, and authentication tokens
• Profile data: target role, industry, skills, preferences, location, experience, and career goals
• Conversation data: chat messages with Akira, session context, and interaction history
• Resume data: uploaded files, parsed content including work experience, education, and skills
• Voice data: LiveKit session transcripts collected only with your explicit consent
• Analytics data: PostHog usage events collected only after you opt in
• Technical data: Sentry error reports, IP addresses for rate limiting, and browser metadata for debugging

2. How We Use Data

Your data is used for the following purposes:

• Personalizing company and job recommendations based on your profile and preferences
• Generating AI-powered career advice, outreach drafts, and portfolio content
• Parsing and analyzing your resume to build and enrich your profile
• Conducting voice onboarding sessions to capture your preferences hands-free
• Delivering email communications you initiate through the outreach features
• Maintaining platform security, preventing abuse, and enforcing rate limits
• Providing customer support and responding to your inquiries
• Improving the service through aggregated, de-identified analytics (opt-in only)

3. Legal Basis for Processing

Under GDPR Article 6, we process your data on the following legal bases: contract performance (delivering the service you signed up for), legitimate interest (security, fraud prevention, and service improvement), and consent (analytics tracking via PostHog and voice recording via LiveKit).

You may withdraw consent for optional processing at any time through the app settings without affecting the lawfulness of processing performed prior to withdrawal.

4. Service Providers

We share data with the following third-party providers only as necessary to deliver specific features:

• Supabase: database hosting and authentication infrastructure
• Google Gemini: AI processing of conversations, resume content, and profile data to generate recommendations and advice
• LiveKit: voice session hosting and real-time communication (with your consent)
• Resend: email delivery for outreach messages you initiate
• PostHog: product analytics (opt-in only, no data sent until you consent)
• Sentry: error monitoring and crash reporting for service reliability
• Apollo and Prospeo: contact lookup for networking features (no user PII is sent to these providers)
• PredictLeads: company intelligence and job data enrichment (no user PII is sent)
• Stripe: payment processing for subscription billing

5. Cookies and Tracking

Trajectry does not use advertising or marketing cookies. We use only essential cookies required for authentication and session management.

PostHog analytics tracking is disabled by default and activates only after you explicitly opt in through your account settings. Sentry collects error data for service reliability but does not track individual user behavior.

6. Data Security

All data in transit is protected with TLS 1.2 or higher encryption. Data at rest is encrypted using AES-256 encryption provided by Supabase (hosted on AWS infrastructure).

Access to production systems is restricted through role-based access controls. Credentials and API keys are never stored in plaintext and are managed exclusively through environment variables.

7. Data Retention

We retain your data for the following periods:

• Account and profile data: retained while your account is active, plus 30 days after a deletion request to allow for recovery
• Conversation logs: retained for 12 months, then automatically purged
• Voice transcripts: retained for 90 days after the session, then deleted
• Analytics data (PostHog): retained for 12 months if you opted in
• Error reports (Sentry): retained for 90 days
• Billing records: retained as required by applicable financial regulations

8. Your Rights and Choices

Under GDPR and similar privacy regulations, you have the right to access, rectify, erase, restrict processing of, port, and object to the processing of your personal data.

You can exercise these rights directly in the app: export your data from settings, delete your account and all associated data, opt out of analytics tracking, and withdraw voice recording consent at any time. For requests that cannot be handled in-app, contact us through the support channel listed in your account.

9. International Data Transfers

Your data may be processed in the United States and the European Union through our infrastructure providers (Supabase on AWS, Vercel, and Google Cloud). Where data is transferred outside the EEA, we rely on standard contractual clauses or other appropriate safeguards to ensure adequate protection of your personal data.

10. Children’s Privacy

Trajectry is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 16, we will take steps to delete that data promptly.

11. CCPA Notice

If you are a California resident, you have the right to know what personal information we collect, request deletion of your data, and opt out of the sale of personal information. Trajectry does not sell your personal data to third parties.

We will not discriminate against you for exercising any of your CCPA rights. To submit a request, use the in-app settings or contact us through the support channel.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through in-product notifications and, where feasible, via email. We encourage you to review this page periodically. Your continued use of Trajectry after changes are posted constitutes acceptance of the updated policy.

13. Contact

For privacy questions, data access requests, or deletion requests that cannot be handled through the in-app settings, contact the Trajectry team through the support channel listed in your account settings or deployment communication.