Privacy Policy

WorkScout (“WorkScout”, “we”, “us”, or “our”) operates the myworkscout.com web application, our backend microservices, and our companion Chrome extension (collectively, the “Services”). This Privacy Policy explains our practices regarding the collection, use, disclosure, and protection of your personal information.

We collect personal information that you voluntarily provide to us when you register for the Services, upload resumes, save jobs, or participate in mock interview simulations:

• Account & Identity Data: Name, email address, password hashes (handled via Clerk Auth), OAuth provider tokens (e.g. Google Sign-In or GitHub), contact preferences, and profile avatar URLs.
• Resume & Career Materials: Work history, educational background, professional certifications, technical skillsets, project portfolios, baseline resumes (in PDF, DOCX, or text format), and cover letters.
• Job Application Pipeline Records: Target company names, job titles, job listing URLs, job specifications, salary ranges, application statuses (Wishlist, Applied, Interviewing, Offer, Rejected), interview dates, and custom notes.
• Recruiter & Professional Contacts: Recruiter names, emails, LinkedIn profile URLs, phone numbers, and networking interaction logs saved in your WorkScout Contact Book.
• Interview Practice & Speech Transcripts: Text transcriptions of your spoken answers generated during STAR mock interview practice sessions.
• Billing & Purchase Records: Stripe customer IDs, payment receipt tokens, transaction timestamps, pass purchase history, and active access pass expiration dates (we do NOT store full credit card numbers or CVC codes).

When you visit or navigate our Services, certain technical and usage information is collected automatically by our servers and infrastructure:

• Log & Diagnostic Telemetry: IP addresses, browser user agent, operating system, referral URLs, timestamps, request durations, error logs, and system crash dumps.
• Device & Network Data: Device type, display resolution, preferred language, internet service provider, and approximate geographic location (at city/region level inferred from IP address; we do not collect high-precision GPS coordinates).
• Essential Session Cookies & Local Storage: We utilize essential cookies and browser LocalStorage solely to maintain authenticated sessions (via Clerk), store UI theme preferences (dark mode), preserve client-side draft resume state, and prevent Cross-Site Request Forgery (CSRF).

We do NOT deploy intrusive cross-site third-party tracking pixels or behavioral advertising beacons that follow your activity across unrelated third-party websites.

We process your personal information exclusively for legitimate, candidate-serving operational purposes:

• To provide, maintain, and personalize the WorkScout CRM and pipeline interface.
• To execute AI-assisted resume tailoring and cover letter drafting tailored to target job specifications.
• To calculate ATS keyword match scores, lexical overlaps, and semantic similarity ratings via pgvector embeddings.
• To power real-time STAR interview prep and deliver speech-to-text analysis and delivery cadence feedback.
• To facilitate salary counter-offer scenario modeling and executive negotiation scripts.
• To manage billing transactions, 90-day block access pass authorizations, and quota allowances under our Fair Use Policy.
• To protect platform security, enforce burst velocity rate limits, detect botting/abuse, and comply with legal obligations.

If you are located in the European Economic Area (EEA), the United Kingdom (UK), or jurisdictions with comparable data protection frameworks, we process your personal data only under recognized legal bases:

• Performance of a Contract (Article 6(1)(b) GDPR): Processing is required to deliver the core job tracking, resume tailoring, and interview coaching features you requested upon creating an account or purchasing an access pass.
• Consent (Article 6(1)(a) GDPR): When you grant explicit browser camera and microphone permissions for the Video Studio, or voluntarily upload optional career profile details. You may revoke consent at any time.
• Legitimate Interests (Article 6(1)(f) GDPR): For securing our servers, detecting scraping bots, preventing payment fraud, and improving server performance without overriding your fundamental privacy rights.
• Legal Compliance (Article 6(1)(c) GDPR): When processing is mandatory to satisfy financial record retention, tax reporting, or lawful court subpoenas.

WorkScout employs Google Cloud Gemini enterprise API instances for semantic extraction, resume tailoring, and interview question generation:

• Stateless Transmission: Prompts containing your resume text and target job specifications are transmitted over encrypted TLS 1.3 connections, evaluated in isolated memory, and returned to your active session.
• No Data Sharing with Other Users: Your career history is segregated within your user-specific PostgreSQL vector partition. No other candidate or company has access to your prompt context.
• Human In The Loop: WorkScout does not make automated legal or employment decisions regarding your candidacy. You retain absolute control over whether and how to use any AI-generated suggestions.

Our interactive Video Studio assists candidates in rehearsing behavioral interview questions under realistic simulation conditions:

• No Biometric Identifiers: WorkScout does NOT collect, capture, store, or process “biometric identifiers” or “biometric information” as defined under the Illinois Biometric Information Privacy Act (BIPA), Texas Capture or Use of Biometric Identifier Act (CUBI), or similar statutes. We do not generate facial geometry templates, iris scans, or voiceprints.
• Client-Side Visual Framing: Visual posture and head alignment telemetry are processed locally in your browser’s client-side runtime using WebRTC and HTML5 canvas APIs. Video streams are not stored on our permanent cloud servers unless you manually choose to record and download a practice file.
• Speech Transcription: Audio from your practice answers is converted into text solely to evaluate your adherence to the STAR framework (Situation, Task, Action, Result) and measure pace (words per minute) and filler word frequencies.

The WorkScout Chrome Extension allows you to import job descriptions from public job boards (such as LinkedIn, Indeed, and corporate career sites) into your WorkScout dashboard with one click:

• Minimal Content Permissions: The extension only accesses the DOM of pages you actively choose to bookmark. It does not monitor your general browsing history, personal communications, or banking activity.
• Google API Services User Data Compliance: WorkScout adheres strictly to the Google API Services User Data Policy, including the Limited Use requirements. Our extension and authentication tools never transfer Google user data to third parties, except as necessary to provide or improve user-facing features.

We share personal information strictly with trusted third-party service providers (“Subprocessors”) who assist us in operating the platform under strict confidentiality agreements:

We may also disclose information if required by law, such as to comply with a court order, subpoena, or law enforcement request, or to protect the vital interests, safety, and property of WorkScout, our candidates, or the public.

We retain your personal data and candidate artifacts for as long as your account remains active or as necessary to fulfill the purposes outlined in this policy:

• Document Snapshot Audit Compliance: When a job application in your CRM advances to Applied, Interviewing, or Offer, the tailored resume and cover letter snapshot attached to that card are locked. This prevents accidental deletion or drift, guaranteeing you can always review the exact document submitted to an employer.
• Account Deletion Purge: If you request account termination, all active candidate records, resumes, cover letters, and contact book entries are purged from our live database within thirty (30) days, except where retention is legally mandated for tax or accounting purposes.

We implement robust technical and organizational security controls designed to safeguard your candidate documents against accidental destruction, unauthorized modification, disclosure, or access:

• Encryption in Transit: All HTTP traffic is enforced via modern TLS 1.3 encryption with strict HTTP Strict Transport Security (HSTS).
• Encryption at Rest: Relational data and vector indexes stored in PostgreSQL (pgvector) utilize AES-256 encrypted block storage.
• Authentication Hardening: Multi-factor authentication (MFA) and secure session token revocation managed via Clerk.
• Rate Limiting & Firewalls: Redis-backed token-bucket rate limiting prevents unauthorized credential stuffing and brute-force attacks.

While we utilize industry-standard practices, no internet transmission or electronic storage method is 100% infallible. If you discover a vulnerability, please alert us immediately at [email protected].

Our Services are strictly directed to adult job seekers and working professionals aged eighteen (18) and older. We do not knowingly solicit, collect, or process personal information from children under eighteen (18) years of age.

If we become aware that personal data from a child has been gathered without verified parental consent, we will take immediate measures to delete such data from our servers. If you believe a minor has registered an account, please email us at [email protected].

Regardless of your physical location, WorkScout provides all candidates with comprehensive controls over their personal career data:

• Right to Access & Portability: You can request an export of all candidate cards, notes, resumes, and contacts in standard JSON or PDF format.
• Right to Rectification: You can edit and update your career documents, job stages, and personal contact info at any time directly in your dashboard.
• Right to Erasure (“Right to Be Forgotten”): You can request the permanent deletion of your account and all associated resumes.
• Right to Restrict or Object to Processing: You may object to the processing of your data for specific auxiliary purposes.
• Right to Withdraw Consent: You can withdraw permissions for camera/microphone access directly in your browser settings at any time.

Residents of California, Texas, Virginia, Colorado, Connecticut, Utah, and other US states with comprehensive consumer privacy statutes enjoy specific statutory rights:

• Notice of No Sale or Sharing: WorkScout has NOT sold or shared (as “sale” and “sharing” are defined under the California Consumer Privacy Act and California Privacy Rights Act) personal information to third parties in the preceding 12 months.
• Right to Know & Delete: You may submit a verifiable consumer request to know what categories of personal information we have collected, or request full deletion.
• Non-Discrimination: We will never discriminate against you, charge different prices, or deny service quality because you exercised your privacy rights.
• California “Shine the Light” Law: California Civil Code Section 1798.83 permits California residents to request disclosures regarding third-party direct marketing sharing. As we do not share data with third parties for direct marketing, this is not applicable.

WorkScout operates primarily within the United States. If you access our Services from the European Union, United Kingdom, Canada, or other regions whose laws govern data collection and use that may differ from United States law, please be aware that your personal information will be transferred to, stored, and processed in the United States.

We ensure appropriate safeguards—such as Standard Contractual Clauses (SCCs) approved by the European Commission—are in place with our infrastructure vendors to ensure equivalent data protection.

Most web browsers and operating systems include a Do-Not-Track (“DNT”) feature or Global Privacy Control (“GPC”) signal. Because there is currently no universal industry consensus for interpreting DNT signals, our platform does not alter its operational behavior in response to legacy DNT browser headers.

However, because WorkScout does not sell, trade, or share personal candidate data with third-party tracking networks, our standard operational architecture inherently fulfills the protections sought by GPC signals.

We may update this Privacy Policy from time to time to reflect operational modifications, product enhancements, or regulatory developments. The revised version will be indicated by an updated “Last Revised” date at the top of this page.

If we make material changes that significantly affect your rights or the manner in which we process your personal data, we will provide prominent notification on our website or via email prior to the changes taking effect. We encourage you to periodically review this Privacy Policy.

If you have questions, comments, or concerns regarding this Privacy Policy, or if you wish to exercise your data subject access rights (DSAR), submit a deletion request, or obtain a machine-readable export of your candidate file, please contact our Data Protection Officer: