Privacy Policy

1. Who this policy applies to

This policy applies when you visit the Job Seeker Copilot landing page, join the early-access list or send us an enquiry. The main Job Seeker Copilot product is still in development; a separate product privacy notice will be provided before public accounts are opened.

2. Information we collect

We collect only the information needed for the service you choose to use:

• Waitlist details: the email address you submit, pending or confirmed status, consent version, source, timestamps and hashed single-use confirmation-token information.
• Email-delivery details: Amazon SES delivery, hard-bounce and complaint events used to protect recipients and suppress further messages where necessary.
• Contact details: your name, email address, message subject and message when you use the contact form.
• Optional aggregate analytics: only after you choose “Allow analytics”, we may record a controlled event name, approved page path, form location, broad viewport category, production or smoke-test traffic class, a coarse acquisition category and approved non-personal campaign labels.
• Technical information: limited server, security and diagnostic information such as IP address, browser type, requested pages and timestamps may be processed by our hosting provider.

We do not ask for a password, payment information, CV, employment history or application documents on this website.

3. How we use information

When you submit the waiting-list form, the address is stored as pending and Amazon SES sends a confirmation email. The address becomes confirmed only after its secure, single-use link is used. Launch and early-access messages must not be sent to pending records. Each future update will support unsubscribe.

The early-access offer does not add any fields to the waiting-list form. Only confirmed addresses may be considered for early access and the promotional offer; we do not ask for employment details, phone numbers, CVs, referrals or profiling information for this offer.

We use contact-form information only to understand and respond to the enquiry; sending a contact message does not add anyone to the waiting list. Technical information may be used to operate, secure and improve the website. Optional aggregate analytics help us understand which public pages and forms are useful and whether the waiting-list and contact journeys work.

Where UK data-protection law applies, the intended lawful bases are consent for optional waitlist communications and our legitimate interests in responding to enquiries, protecting the service and understanding basic website performance. You may withdraw consent to waitlist updates at any time.

4. Cookies and similar technologies

We do not use advertising cookies, advertising pixels, cross-site tracking, fingerprinting or visitor profiles. Optional first-party analytics are disabled by default and send nothing until you choose “Allow analytics”. “Refuse analytics” is presented at the same level, the website continues to work after refusal and you can revisit the choice through “Analytics choices” in the footer.

Your choice is stored in local browser storage against this policy version. After acceptance, session storage may hold only controlled campaign labels, a coarse acquisition category, a production-or-smoke marker and a boolean that prevents the same browser tab from counting more than one visit. These values contain no visitor identifier and expire with the browser session, except for the saved choice.

The analytics request does not include a name, email address, contact message, confirmation token, full URL, raw referrer, IP address, user-agent value or advertising identifier. Campaign values are limited to an approved non-personal vocabulary. The dashboard reports visits as a privacy-preserving session count, not as a count of unique people.

5. Storage, sharing and international transfers

Waitlist addresses and registration records are stored in Amazon DynamoDB. Amazon SES processes the address to deliver confirmation and later permitted messages. Hard-bounce and complaint information may be retained for suppression and compliance so further email is not sent improperly. Contact messages are intended to be delivered through Amazon SES to an authorised private mailbox. Optional analytics events are sent to our own restricted AWS collector and CloudWatch logs in the deployed UK Region (currently eu-west-2); AWS necessarily processes network traffic to provide that infrastructure, while our analytics event and API access-log design omits full IP addresses and user-agent values. Access is limited to authorised operators and contracted providers that host, deliver or secure the service. We may also disclose information when required by law. We do not sell personal information.

If a provider processes information outside the UK, we will use an approved transfer mechanism and appropriate safeguards where required.

6. How long we keep information

Confirmation links expire after 48 hours by default. Pending records are configured for deletion after 30 days if confirmation is not completed. Confirmed records remain until unsubscribe, an approved deletion request or the end of the waiting-list purpose. Bounce and complaint suppression records are retained only as long as necessary for compliance and safe delivery. DynamoDB expiry is asynchronous, so deletion may occur shortly after the stated retention point rather than immediately.

Contact messages will normally exist in the receiving mailbox and be retained only as long as needed to respond, keep an appropriate business record and meet legal obligations. Optional analytics and security log groups have a 30-day retention setting. Aggregate CloudWatch metrics may remain available for operational reporting without containing visitor identifiers or submitted form content.

7. Security

We use proportionate technical and organisational measures to protect personal information, including access controls, HTTPS in production and restricted use of service credentials. No internet service is completely secure, so we cannot guarantee absolute security.

8. Your rights

Depending on your circumstances, UK data-protection law may give you rights to request access, correction, deletion, restriction or transfer of your personal information, to object to certain processing and to withdraw consent. You may also complain to the UK Information Commissioner’s Office at ico.org.uk.

9. Children

This website is intended for people managing their own job search and is not directed at children under 16. Please do not submit a child’s personal information.

10. Changes and contact

We may update this policy as Job Seeker Copilot develops or its providers change. The effective date above will be updated when material changes are published.

Privacy questions, stored-data export requests and deletion requests can be sent to privacy@jobseekercopilot.com. Waiting-list messages will include a link that immediately marks the address unsubscribed without requiring an account.