WorkHistoryAILegal & Privacy
Self-service account privacy & data lifecycle controls:
My Data ExportReset or Delete Account

Privacy Policy

Last Updated: November 4, 2026

1. Introduction & Scope

WorkHistoryAI is a private, evidence-grounded career intelligence platform organized around a three-stage user journey: 1. My Career → 2. My Opportunities → 3. My Applications. We process personal and professional career information so you can reconstruct your full work history, evaluate real job opportunities, and generate truthful, evidence-backed application materials across our web and mobile interfaces.

This Privacy Policy describes the verified operational data flows, user controls, and technical boundaries implemented in WorkHistoryAI. Availability of specific controls depends on the deployed version and environment configuration. This notice describes platform operations and does not constitute formal legal advice or a blanket regulatory certification.

2. Categories of Personal Data We Collect & Process

WorkHistoryAI acts as a Data Controller for your account identity, billing metadata, and platform telemetry, and processes your uploaded career documents and structured career records at your direction:

  • Identity & Profile Data (Account): Name, email address, authentication identifiers, session timestamps, and optional external profile links (such as your LinkedIn URL or portfolio URL, which you can update or unlink at any time in /account/general or clear via /account/delete).
  • Uploaded Source Documents (My Files): Résumés, CVs, PDFs, and DOCX documents (up to 100 MB per file) uploaded to private, user-scoped storage buckets (career-source-documents), along with file-signature, SHA-256 hash, and processing-attempt metadata.
  • Structured Career Intelligence (1 · My Career):
    • Career Fragments (career_fragments): Extracted and conversational career statements, employment roles, timeframes, organizations, project/contract-renewal phases, explicit user approval state (is_approved), review timestamps, verification classifications (source_verified, user_confirmed, needs_verification, hypothesis), and source provenance links.
    • My Career Explorer Sessions & Claims: Guided interview transcripts (including chronological oldest-to-newest position coverage reviews), "Here's what I heard" reflections, proposed structured claims (fact, interpretation, hypothesis), and durable contradiction-resolution records.
    • My Career Inventory & Assets: Immutable, versioned My Career Inventory snapshots (master_inventory_versions), My Projects / Products, My Interview Stories, and My Skills citations.
    • Private Career Preferences (career_preferences): Remote/hybrid/on-site preferences, relocation openness, travel boundaries, compensation floors and targets, desired roles and industries, management preferences, learning goals, and private context notes. Private career preferences are strictly isolated from external document generation and are never automatically inserted into résumés, cover letters, or employer application answers.
  • Opportunity & Application Data (2 · My Opportunities & 3 · My Applications):
    • Saved job descriptions, source URLs, HTTP verification and freshness timestamps (last_verified_at), multidimensional My Match fit evaluations, My Coach sessions, opportunity-scoped My Mosaic plans, My Application Package drafts, My Resumes, My Cover Letters, and Application Question drafts.
    • Optional Integration Keys: If you generate a LinkedIn Easy Apply integration key (/account/integrations/linkedin), WorkHistoryAI stores a cryptographic key hash, a masked preview, usage timestamps, and application event logs; plaintext keys are displayed only once at creation.
  • Security, Rate-Limiting & Operational Telemetry:
    • Server-authenticated request quotas and concurrency counters (enforced via Redis), plus model telemetry recording task category, model identifier, token counts, latency, and HTTP outcome. Operational diagnostics and model metrics omit private prompts, uploaded document text, career preferences, and generated career narratives.

3. AI Processing & The Career Truth Boundary

The model proposes; you confirm; WorkHistoryAI stores career truth.

  1. Context Sent to Model Providers:
    • Document Extraction & Career Explorer: Uploaded document text (parsed in a bounded worker) and bounded Career Explorer conversation context are sent to the configured AI model provider to extract candidate claims, review positions from oldest to newest, and synthesize immutable My Career Inventory versions.
    • Opportunity Analysis & Job Discovery: My Job Search sends your search criteria and relevant career preferences to a configured web-search service. My Match and My Coach send bounded career context and the target job description to evaluate multidimensional fit.
    • Factual Application Generation: When generating My Resumes, My Cover Letters, My Mosaic, My Application Package, or Application Question answers, WorkHistoryAI supplies only your approved Career Fragments (is_approved = true) and the target opportunity context. Selecting an interview story supplies its approved underlying source fragments rather than unverified draft prose.
  2. Mandatory Human Review & Revocation on Edit:
    • Automated document extraction, Career Explorer proposals, and Opportunity Coach discoveries are created as unapproved / review-required until you explicitly approve them (individually or via bulk review controls).
    • Editing an approved canonical career_fragment automatically revokes its approval (is_approved = false) until you re-review and confirm the updated wording.
  3. Model Provider Retention (store: false Disclosure):
    • Shared Responses API requests explicitly send store: false and enforce strict request timeouts.
    • Important Limitation: The store: false parameter is a request-level instruction, not a technical or legal guarantee of zero data retention across third-party model providers, AI gateways, abuse-monitoring systems, or infrastructure backups. Actual provider processing and retention depend on the model provider and account terms configured in the active deployment. WorkHistoryAI does not represent that every deployment environment operates under an enterprise zero-data-retention (ZDR) agreement.

4. Sub-Processors, Infrastructure & External Job Verification

WorkHistoryAI integrates with the following categories of infrastructure and sub-processors (exact providers depend on deployment configuration):

  • Supabase: Authentication (Supabase Auth), PostgreSQL database hosting with Row-Level Security (RLS), and private object storage (career-source-documents and derived-artifacts).
  • Vercel: Application hosting, edge routing, and operational analytics.
  • Upstash / Redis: Atomic request rate-limiting and per-account quota protection.
  • AI Gateways & Model Providers (e.g., OpenAI, Google, and where configured AWS Textract/S3): AI inference, structured claim extraction, embedding generation, and hosted web search for job discovery.
  • External Employer & Job Websites: When you inspect, verify, or import a job posting URL in My Job Search or My Opportunities, our server contacts the external posting website using SSRF-hardened, DNS-pinned HTTP requests. AI search citations and reachable URLs establish source traceability at check time (last_verified_at), not a guarantee that the position remains open.

5. Your Data Lifecycle Controls: Export, Selective Removal, Reset & Deletion

You control the lifecycle of your career records through dedicated self-service controls:

5.1 Data Portability & Export (/account/export)

  • Use My Data Export (/account/export) to download a structured JSON archive (workhistoryai-private-account.json, up to 25 MB synchronous limit) containing your owned career fragments, review states, provenance links, Career Explorer sessions, inventory versions, preferences, opportunities, and application drafts, plus a manifest of stored files.
  • Original uploaded files and generated artifacts are downloaded separately using authenticated session links provided on the export page. Integration secrets and key hashes are excluded.
  • Because the database snapshot (export_career_account) and object-storage file listing execute as separate operations, changes made while an export is running may affect snapshot consistency. If your account exceeds the 25 MB synchronous export limit, contact support for a complete export.

5.2 Selective File & Conversation Removal (My Files & My Career Explorer)

  • Removing an Original File: Deleting a source document in My Files removes the stored file binary and marks the original source unavailable, while retaining your extracted career_fragments and their historical provenance lineage so you do not lose reviewed career facts.
  • Removing a Career Explorer Conversation: Deleting a conversation in My Career Explorer clears the conversation transcript and recorded message excerpts (and sets a tombstone to reject late writes), while retaining your reviewed claims, durable conflict resolutions, and immutable My Career Inventory versions.

5.3 Clear Career Data / Start Fresh (/account/delete → "Clear Career Data")

  • If you want a clean slate without losing your login account, navigate to Reset or Delete (/account/delete), select Clear Career Data, and type RESET.
  • This operation (POST /api/account/data-clean) purges your stored files across career-source-documents and derived-artifacts, deletes all user-scoped career records (including documents, career_fragments, career_claims, career_claim_conflicts, career_explorer_sessions, career_explorer_messages, master_inventory_versions, career_assets, biography_versions, job_descriptions, opportunity_analyses, application_question_drafts, generated_resumes, generated_cover_letters, coach_sessions, user_skills, career_preferences, and linkedin_integration_keys), and clears linked linkedin_url and portfolio_url fields on your profile—while preserving your authenticated login identity.

5.4 Permanent Account Deletion (/account/delete → "Delete Account")

  • Use Reset or Delete (/account/delete) and type DELETE to permanently delete your account (DELETE /api/account/delete).
  • Security Guards: Permanent deletion requires explicit confirmation (DELETE) and a recent sign-in within the last 15 minutes.
  • Execution Sequence: The application verifies database cascade coverage (verify_career_deletion_cascades), records a deletion lock (career_account_deletion_requests) that blocks new career file writes, recursively purges your files from active application storage, deletes your Supabase Auth identity and dependent profile/career records, and signs out your session.
  • Failure Recovery & Retention Limits: If an intermediate step fails, the application reports incomplete deletion so you can sign in and retry; some storage objects may already have been removed. Account deletion removes your records from active application tables and storage buckets, but does not promise immediate erasure from immutable infrastructure backups, third-party model provider logs, or legally retained operational records.

6. Security & Account Isolation

  • Row-Level Security & Server Identity: All user-owned career tables enforce PostgreSQL Row-Level Security (RLS). Server API routes derive user identity strictly from your authenticated session cookie; client-supplied userId parameters are never trusted as authoritative.
  • Bounded Document Parsing: Uploaded PDFs and DOCX files are validated for file signatures, size limits (up to 100 MB on resume upload endpoints), archive header consistency, inflation ratios, and XML/macro safety inside bounded worker processes, and served privately with X-Content-Type-Options: nosniff and Cache-Control: private, no-store. Structural parser guards reduce processing risks but are not a substitute for independent antivirus certification.

7. Contact Us

For privacy inquiries, data export assistance, or questions regarding deployment-specific retention arrangements, please contact privacy@workhistoryai.com.