Privacy Policy

1. Introduction

This Privacy Policy describes how DeckStack ("DeckStack", "we", "us") collects, uses, discloses and safeguards information when you use our website and application (the "Service"). By using the Service, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

We may collect the following categories of information:

• Contact information you provide, such as your name and email address.
• Career materials you choose to share, such as CVs, cover letters, application history and LinkedIn profile details.
• Usage data, such as pages visited, features used, how you move through the Service, and device/browser information, collected automatically through analytics. This includes recordings of how you use our pages (“session replays”), in which anything you type and the contents of your documents are masked so they are never recorded.
• Any other information you voluntarily provide when communicating with us.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate and improve the Service, including generating your application diagnosis.
• Communicate with you about your account, requests and updates to the Service.
• Monitor and analyze usage and trends to improve user experience.
• Detect, prevent and address technical issues, fraud or abuse.

4. How We Share Your Information

We do not sell your personal information. We may share information with:

• Service providers who perform services on our behalf (e.g. hosting, analytics, email delivery), under obligations of confidentiality.
• Professional advisors, such as legal or financial consultants, where necessary.
• Authorities where required by law, regulation or valid legal process.
• A successor entity in connection with a merger, acquisition or sale of assets, with notice to you.

5. Service Providers and Sub-processors

We use the following service providers to operate the Service. Each handles user data only to provide its part of the Service:

• Amazon Web Services (Bedrock): AI analysis and generation of uploaded documents.
• CloudConvert: converting uploaded documents to text.
• Mindcase: looking up a LinkedIn profile URL the user provides.
• PostHog: product analytics and session replay, hosted in the European Union (Frankfurt, Germany).
• Stripe (including Link): payment processing, and merchant of record for purchases.
• Supabase: database, authentication and file storage.
• Vercel: hosting.

6. Data Retention

We retain your information for as long as necessary to provide the Service and fulfill the purposes described in this policy, unless a longer retention period is required by law. You may request deletion of your archive at any time; see Section 8.

When your pass ends, your archive, DeckStack Resume, application packages and Check reports stay in your account until you delete them. You can still view and download them. New AI generations and Checks need an active pass. Coming back later costs nothing to rebuild. You can delete your archive at any time in Settings.

7. Cookies & Analytics

We use PostHog to understand how DeckStack is used and where it could be easier. It records the pages you view, the actions you take, your device and browser, and your approximate location (country and city, worked out from your IP address, which is not stored). Once you sign in, this is linked to your account by an internal ID, never your email address. Session replays show how pages are used; your documents, anything you type, and your personal details are masked and never recorded. Replays are kept for 30 days.

If you are in the UK, the European Economic Area or Switzerland, we ask before setting analytics cookies. Until you agree, visits are counted anonymously without cookies and nothing is recorded. You can change your choice at any time with “Cookie settings” at the bottom of every page.

If you decline, we also don’t send analytics about your account from our servers, such as what you’ve purchased or how your Checks ran.

Cookies we set:

• ph_<id>_posthog (analytics): a random identifier, so visits can be linked across deckstack.ai and app.deckstack.ai. Up to 1 year.
• ph_<id>_posthog_cpm (analytics): PostHog’s cached settings for this visitor, such as which features are switched on. Up to 1 year.
• __ph_opt_in_out_<id> (preference): your cookie choice. Up to 1 year.
• ds_consent_region (necessary): whether we need to ask for your choice, based on your country. 1 day.

You can also block or delete cookies in your browser settings.

8. Your Rights & Choices

Depending on your jurisdiction, you may have rights to access, correct, export or delete your personal information, or to object to or restrict certain processing. To exercise any of these rights, contact us using the details in Section 11.

9. Data Security

We take reasonable technical and organizational measures designed to protect your information from unauthorized access, disclosure, alteration or destruction. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will indicate the date of the most recent revision below and, where changes are material, provide additional notice.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights over your information, contact us at hello@deckstack.ai.