Eureka Roles Privacy Policy
Effective date: Provisional: [date]. Who we are: Eureka Tech LLC, a Tennessee limited liability company, Nashville, Tennessee ("Eureka Roles", "we"). Contact: Provisional: [privacy contact address].
Eureka Roles helps you find jobs that fit and present yourself honestly. Your career data is yours. We collect what the product needs to work, and we delete it when you ask.
During the pre-launch beta, Eureka Roles is only for people in the United States.
1. What we collect and why
| What | Why we use it |
|---|---|
| Account: email, name, sign-in method (Google, LinkedIn or email and password), sessions | To sign you in, verify your email and keep your account secure. We never export your password hash or sign-in tokens. |
| Your profile: facts you add or accept (roles, achievements, skills, education, certifications, projects), About me (name, headline, summary, location, links, languages) | To match you to jobs and write résumé content that rests on your own facts |
| Documents you upload: résumé files and the text we extract from them | To suggest profile facts for you to review |
| Search settings: titles, seniority, locations, workplace, pay floor, industries, exclusions, relocation, availability, and work authorization and sponsorship | To find and rank jobs for you, and to pre-fill application answers you review (when released). Work authorization and sponsorship have stricter limits (section 4). |
| Your activity: postings you hide, the search signals behind them, the search text you type | To stop showing jobs you don't want and to search by meaning |
| Fit results: scores, the evidence behind them, explanations you ask for, and a numeric summary of your profile (an "embedding") | To show how well a job fits you and why |
| Documents we generate (when released, if you use them): tailored résumés, every version you or we create, and each claim with the facts it cites | To give you documents you can edit, restore and download |
| Applications you track (when released, if you use it): the posting, stage, dates, next actions, notes and history, and your reviewed answers | To help you run your job search |
| Usage counts: how many AI requests you made and their cost, with no prompt text | To enforce fair-use limits and track our costs |
| Plan: your beta plan, how and when it was granted, its end date, the invite code you redeemed, and a log of grants and revokes | To give you beta access and tell you before it ends |
| Feedback you send: its category, your message, and the page you sent it from (never the rest of the web address), linked to your account | To fix problems and improve the product. We never send it to an AI model. |
| Waitlist (if you join before signing up): email, and optionally your sector and target role | To invite you when we open |
| How you use the site: pages you visit and their web addresses, where you click and scroll, page speed, errors and what our code logged, recordings of your sessions (what's on screen and what you type, except passwords), and your browser, device, screen size, time zone, language and IP address. Linked to your account when you're signed in. | To understand how the site is used and to find and fix problems |
We don't ask for your date of birth, photos or government IDs. If a document you upload contains them, such as a license number on a certification, we keep it as part of that document. We don't put your personal data in web addresses or file names we store, and we don't write your résumé, profile or application content into our logs.
We also keep daily totals of sign-ups and subscription events (trial starts, paid conversions, upgrades and cancellations) that aren't linked to your account, to see how the product is doing.
We don't sell your personal information, and we don't share it for cross-context behavioral advertising.
Cookies. We use a cookie to keep you signed in, and PostHog's analytics cookie (and a matching entry in your browser's storage) so we recognize your visits. We don't use advertising cookies.
How you use the site. We use PostHog to understand how people use the site and to fix problems: which pages you visit and their full web addresses, where you click, how fast pages load, errors the site hits and what our code logged, and recordings of your sessions. A recording shows the page as you saw it, including your profile, résumé and other content, and what you type, except passwords. When you're signed in, this is linked to your account, with your email and name. PostHog also receives your browser and device type, screen size, time zone, language and IP address. We never send it demographic information (section 5). When you delete your account, we delete your data in PostHog too. Do Not Track: because we don't track you across other sites, we treat every visitor the same whether or not their browser sends a Do Not Track signal. (CalOPPA, Bus. & Prof. Code §22575(b)(5)–(6).)
2. How AI is used, and the truthfulness promise
Some features use an AI model (Anthropic's Claude) to draft text for you. Every model call goes through one gateway that records its use and enforces limits. We use AI only when you take an action:
- Drafting profile facts from a résumé you upload. You accept, edit or reject each one.
- Explaining a fit score when you ask.
- Writing résumé bullets for a job when you ask (when released).
Every statement we generate about you cites the facts from your profile that support it. A statement with no supporting fact is shown as flagged, never as fact. Our fit scores are calculated by our own rules, not by the AI model.
Application answers (when released) about work authorization, sponsorship, start date and relocation are built from your search settings by a fixed rule, with no AI.
We don't use your data to train AI models.
3. Who we share it with (processors)
We use these service providers to run Eureka Roles. They process your data for us, under contract, and only for the purpose listed (GDPR Art. 28; CCPA "service provider", §1798.140(ag)).
| Provider | What they receive | Why |
|---|---|---|
| Anthropic (AI model) | Text sections of a résumé you upload; for fit explanations, the calculated fit (score, verdict, summary, years of experience, matched location, relocation and remote preference, pay as a share of your minimum), the job's requirements, and the kind, title and organization of the facts it cites; for tailored résumés (when released), the job's title, company and requirements, and the selected facts with up to 3 recent roles and certifications as context. We never send your saved evidence links, credential IDs, work-authorization or sponsorship settings, or demographics as separate fields. A résumé you upload is sent as written, so anything in its text, such as a license number or a statement about citizenship, goes with it. | Draft facts, explain a fit, write résumé bullets (when released), when you ask |
| Amazon Web Services (S3, SQS, Lambda, CloudWatch) | Your documents, internal job messages (IDs only), and service logs (which must not contain personal data) | Hosting |
| Amazon SES | Your email address and name, your beta plan's end date, and, for feedback you send, only its ID in a notice to us | Verification and account email, the notice before your beta ends, and a notice to us when you send feedback |
| Amazon Bedrock (if search by meaning is on) | Search text you type, and your profile text for recommendations | Search by meaning |
| Neon | Our whole database | Database hosting |
| PostHog | How you use the site (section 1), including session recordings that show your content and what you type except passwords, linked to your account id, email and name. Never demographic information. | Usage analytics and debugging |
| Google, LinkedIn | The sign-in exchange, if you choose to sign in with them | Social sign-in |
| Porkbun (email forwarding) and Provisional: [our mailbox provider] | Messages you send to our addresses, such as privacy@, including anything you put in them | To receive and answer your messages |
We may also disclose information if the law requires it, or to protect the rights and safety of our users or others.
Where your data is stored. Provisional: [AWS region], Provisional: [Neon region].
4. Sensitive information: work authorization and sponsorship
If you fill in your work authorization (the countries you may work in) or whether you need visa sponsorship, those answers can reveal your citizenship or immigration status. California law treats that as sensitive personal information (Cal. Civ. Code §1798.140(ae)).
We use these answers only to pre-fill application answers that you review in your application tracker (when released). We never send these settings to an AI model (text in a résumé you upload is covered in section 3), and never use them to match, rank or filter jobs. We never submit anything to an employer: you copy the answers you choose. If you change a setting after reviewing an answer, we flag the answer for you to review again.
These fields are optional. You can clear them at any time in your search settings.
5. Demographic information is opt-in only
We may offer an optional place to store self-identification answers (such as gender, race or ethnicity, veteran or disability status) so you can fill in voluntary equal opportunity forms on applications you choose. You decide whether to give them, and "prefer not to say" is always an option.
If you do, we keep them apart from everything else. They're never sent to an AI model and never used in matching, scoring or ranking. Their only use is filling the voluntary forms you choose. You can view, export and delete them on their own, without deleting your account.
6. How long we keep it
| Data | How long |
|---|---|
| Account, profile, search settings, documents, fit results, generated résumés, tracked applications | Until you delete them or your account |
| Plan and invite history (your beta plan, the invite code you redeemed, the log of grants and revokes) | Until you delete your account; the redeemed code is deleted with it |
| Feedback you send | 12 months, or until you delete your account if sooner, removed nightly. To have one piece of feedback deleted sooner, ask us at Provisional: [privacy contact address] |
| Draft facts from a résumé | Until you accept or reject them, or delete your account |
| Sign-in state | About 10 minutes, removed nightly |
| Hidden postings' search signals | Until you unhide those postings or delete your account |
| Usage counts | When you delete your account, we remove your ID from them; the counts and costs stay, with no prompt text |
| Waitlist entry | Provisional: [12 months] from sign-up |
| Internal job messages that failed | 14 days, IDs only |
| Service logs | Provisional: [30] days; they must not contain personal data |
| Database backups | Provisional: [Up to 30 days] |
| Deleted file versions in storage | Up to 30 days |
| How you use the site (PostHog) | Provisional: [Recordings: about 30 days; page and click data: up to 1 year], or until you delete your account |
| Emails you send us (for example to privacy@) | Provisional: [Until 30 days after we close your request]; a record of the request, without its content, for Provisional: [24 months] |
| Data sent to Anthropic | Deleted by Anthropic within 30 days. If Anthropic's safety systems flag a request as possibly violating its Usage Policy, Anthropic may keep it up to 2 years, and safety scores up to 7 years (https://privacy.claude.com/en/articles/7996866) |
Hidden applications. When you hide a tracked application, we keep it and its history so you can restore it. It stays until you delete your account, unless you delete it permanently first. To delete one permanently, hide it, then choose Delete permanently; that removes the application, its history and its answers. A copy may remain in database backups for Provisional: [up to 30 days].
You can also delete one generated résumé, and reset one reviewed answer.
7. Your choices: export and delete
- Export. You can download all your data from your account settings, including hidden applications, every résumé version with its claims and cited facts, and your reviewed answers. Your uploaded files can be downloaded too. We exclude passwords and sign-in tokens.
- Delete your account. This deletes your data from our database and every stored version of your files. Remaining copies (failed job messages, logs, database backups) expire within Provisional: [30 days], except as described for Anthropic above.
- Correct. You can edit your profile, settings, documents and answers at any time.
- Waitlist. If you joined the waitlist without creating an account, email Provisional: [privacy contact address] to get or delete your entry.
- Your rights by law. Depending on where you live, you may have the right to know, access, correct, delete and port your data, to limit the use of sensitive information, and not to be treated differently for using these rights (for example Cal. Civ. Code §§1798.100–1798.125; GDPR Arts. 15–21). Email Provisional: [privacy contact address]. We'll verify your request and answer within Provisional: [45 days].
8. Security
Your files are stored privately and encrypted, and are only sent over encrypted connections. Each account can only see its own records. No system is perfectly secure; if we learn of a breach that affects you, we'll tell you as the law requires.
9. Children
Eureka Roles is for people Provisional: [16/18] and older. We don't knowingly collect data from children under 13 (COPPA). If you think a child has signed up, contact us and we'll delete the account.
10. Changes to this policy
We'll post any change here with a new effective date, and email you before a material change takes effect.
11. Contact
Eureka Tech LLC, Nashville, Tennessee, Provisional: [privacy contact address].