Privacy Policy

1. Introduction

This Privacy Policy describes how DeckStack ("DeckStack", "we", "us") collects, uses, discloses and safeguards information when you use our website and application (the "Service"). By using the Service, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

We may collect the following categories of information:

• Contact information you provide, such as your name and email address.
• Career materials you choose to share, such as CVs, cover letters, application history and LinkedIn profile details.
• Usage data, such as pages visited, features used, how you move through the Service, and device/browser information, collected automatically through analytics. This includes recordings of how you use our pages (“session replays”), in which anything you type and the contents of your documents are masked so they are never recorded.
• Your conversations with DeckSter, our in-product AI assistant, and the records of what it read and did on your behalf. Section 8 describes these in full.
• Any other information you voluntarily provide when communicating with us.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate and improve the Service, including generating your application diagnosis.
• Communicate with you about your account, requests and updates to the Service.
• Monitor and analyze usage and trends to improve user experience.
• Provide DeckSter, our AI assistant, and check its conversations for quality and safety.
• Detect, prevent and address technical issues, fraud or abuse.

4. How We Share Your Information

We do not sell your personal information. We may share information with:

• Service providers who perform services on our behalf (e.g. hosting, analytics, email delivery), under obligations of confidentiality.
• Professional advisors, such as legal or financial consultants, where necessary.
• Authorities where required by law, regulation or valid legal process.
• A successor entity in connection with a merger, acquisition or sale of assets, with notice to you.

5. Service Providers and Sub-processors

We use the following service providers to operate the Service. Each handles user data only to provide its part of the Service:

• Amazon Web Services (Bedrock): AI analysis and generation of uploaded documents when OpenRouter is unavailable, and running DeckSter, our AI assistant; processing may take place in AWS regions in Australia or overseas.
• CloudConvert: converting uploaded documents to text.
• Mindcase: looking up a LinkedIn profile URL the user provides.
• OpenRouter, Inc. (United States): routing AI processing requests to model providers.
• PostHog: product analytics and session replay, hosted in the European Union (Frankfurt, Germany).
• Stripe (including Link): payment processing, and merchant of record for purchases.
• Supabase: database, authentication and file storage.
• Vercel: hosting.

DeckStack Check, DeckStack Resume and DeckStack Apply are routed through OpenRouter. OpenRouter passes each request to a provider that hosts the model being used. The models we use include models from Anthropic, Google and OpenAI. For reliability, OpenRouter may route a request to another provider hosting the same model, but only to providers that keep no data.

Every request we send requires zero data retention, and our OpenRouter account enforces it as well. OpenRouter and the model providers do not store the prompts or the results, and do not use them to train AI models. OpenRouter keeps information about each request, such as token counts, cost and timing, but not its content.

This means AI processing may take place outside Australia, including in the United States. If OpenRouter is unavailable, requests go instead to our own Amazon Bedrock account, where processing may also take place in AWS regions in Australia or overseas. Where your files, archive, reports and account data are stored has not changed. DeckSter, our AI assistant, is not routed through OpenRouter; Section 8 describes how it works.

6. Data Retention

We retain your information for as long as necessary to provide the Service and fulfill the purposes described in this policy, unless a longer retention period is required by law. You may request deletion of your archive at any time; see Section 9.

When your pass ends, your archive, DeckStack Resume, application packages and Check reports stay in your account until you delete them. You can still view and download them. New AI generations and Checks need an active pass. Coming back later costs nothing to rebuild. You can delete your archive at any time in Settings.

DeckSter conversations are kept until you delete them or delete your account; they do not expire on their own. Section 8 explains what deleting one removes.

7. Cookies & Analytics

We use PostHog to understand how DeckStack is used and where it could be easier. It records the pages you view, the actions you take, your device and browser, and your approximate location (country and city, worked out from your IP address, which is not stored). Once you sign in, this is linked to your account by an internal ID, never your email address. Session replays show how pages are used; your documents, anything you type, and your personal details are masked and never recorded. Replays are kept for 30 days.

If you are in the UK, the European Economic Area or Switzerland, we ask before setting analytics cookies. Until you agree, visits are counted anonymously without cookies and nothing is recorded. You can change your choice at any time with “Cookie settings” at the bottom of every page.

If you decline, we also don’t send analytics about your account from our servers, such as what you’ve purchased or how your Checks ran.

If you allow analytics, we also record that DeckSter was used — for example that it was opened, that a message was sent, that a card was approved, or that a conversation ended. These records never contain what you wrote or anything from your archive, and the DeckSter panel is hidden from session replays.

Cookies we set:

• ph_<id>_posthog (analytics): a random identifier, so visits can be linked across deckstack.ai and app.deckstack.ai. Up to 1 year.
• ph_<id>_posthog_cpm (analytics): PostHog’s cached settings for this visitor, such as which features are switched on. Up to 1 year.
• __ph_opt_in_out_<id> (preference): your cookie choice. Up to 1 year.
• ds_consent_region (necessary): whether we need to ask for your choice, based on your country. 1 day.

You can also block or delete cookies in your browser settings.

8. DeckSter, Our AI Assistant

DeckSter is an optional chat assistant inside the DeckStack portal. It helps you review your archive: the record of your career we build from the resumes, cover letters and LinkedIn profile you upload. It explains items, asks questions and proposes changes.

DeckSter never changes your archive on its own. Every change is shown on a card, and happens only if you approve it. You can always use the review screens instead.

For each conversation, we store:

• The messages you write and DeckSter’s replies.
• A record of each change it proposed, and whether you approved or declined it.
• The details DeckSter used to answer: the parts of your archive it read, and the inputs and results of the actions it took.
• Any thumbs up or down you give a reply.
• Usage and cost information: when each turn happened, how long it took, and the AI usage and cost.

You can see a conversation while it is open. Once it is finished, it appears in the Contact section of your account as a read-only transcript. DeckStack administrators can read conversations in full to check quality and safety, and to investigate problems. Every time an administrator opens a conversation, that access is recorded.

Messages you write are checked automatically for attempts to misuse the assistant, and for content it should not respond to. If a message looks like an attempt to manipulate the assistant, the conversation is paused and an administrator reviews it before it can continue; you can keep using the rest of DeckStack meanwhile. DeckSter has daily usage limits per person.

DeckSter runs on Amazon Web Services’ AI service, Amazon Bedrock, and processing may take place in AWS regions in Australia or overseas. Your messages and the details from your archive are processed by AI models provided through Amazon Bedrock, to generate replies and to run the safety checks. Under AWS’s terms, this content is not used to train AI models. Conversation records are stored in our database with the rest of your account’s data.

Conversations are kept until you delete them or delete your account; there is no automatic expiry. You can delete any finished conversation from the Contact section of your account. When you do, we remove the content: the messages, the details DeckSter used, the contents of the change records, and your feedback notes. We keep only non-content figures, such as how many turns a conversation had, how long it took, the AI usage and cost, and which kinds of action were used and whether they succeeded, so our quality and cost figures stay accurate. Deleting your account deletes all of its conversations, figures included.

Changes you approved in a conversation stay in your archive after the conversation is deleted. They are part of your archive, not the conversation.

9. Your Rights & Choices

Depending on your jurisdiction, you may have rights to access, correct, export or delete your personal information, or to object to or restrict certain processing. To exercise any of these rights, contact us using the details in Section 12.

10. Data Security

We take reasonable technical and organizational measures designed to protect your information from unauthorized access, disclosure, alteration or destruction. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will indicate the date of the most recent revision below and, where changes are material, provide additional notice.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights over your information, contact us at hello@deckstack.ai.