Privacy Policy

1. Who we are

CareerPilot is operated by Tolo Goods LLC, operating under the Tolopilot brand (“we”, “us”, or “our”). CareerPilot is a job search platform accessible at https://career.tolopilot.com. This Privacy Policy explains how we collect, use, and protect your information when you use our service.

2. Information we collect

We collect the following categories of information:

• Account information: Your name and email address when you create an account via email or Google OAuth.
• Resume data: Resume files you upload and the information extracted from them (skills, work history, education, certifications).
• Job search data: Applications, interviews, recruiter contacts, notes, and tasks you create within CareerPilot.
• Match analysis data: Job descriptions you submit for match analysis, and the resulting match scores and insights.
• Application materials: Material CareerPilot prepares for a role you choose to pursue. This is a tailored version of your resume, a cover letter, draft answers to the questions a listing asks, and interview preparation written for you.
• Usage data: Pages visited, features used, and interactions with the platform, collected via PostHog analytics.
• Payment information: Billing details are collected and processed directly by Stripe. We do not store credit card numbers.

3. How we use your information

We use your information to:

• Provide and improve the CareerPilot service
• Generate match scores and career profile insights
• Process payments and manage subscriptions
• Send product updates, support responses, and account notifications
• Analyze usage patterns to improve the product
• Comply with legal obligations

4. Who receives your information

We do not sell your personal data. Two different kinds of recipient are described here, and the difference matters, because we can hold one of them to our instructions and we cannot hold the other.

Service providers acting on our instructions. These companies process your data for us, for the purposes set out above, and for nothing else:

• Supabase: database, authentication, and storage of your resume file
• Anthropic: analysis of resumes and job descriptions, and preparation of application material
• Stripe: payment processing
• Vercel: hosting and deployment
• PostHog: product analytics
• Sentry: error monitoring

That is the complete list of the companies that process your data on our instructions. It is not a list of everyone who could ever receive your information, because an employer you apply to is a recipient of a different kind. Section 5 describes that separately.

We may also disclose information where the law requires it, or to establish or defend a legal claim.

5. Applications, employers, and their hiring systems

CareerPilot does not currently submit applications.It prepares the material and hands you the employer’s own form, and you send it yourself. Submitting an application directly from CareerPilot is not available today, and while that remains true nothing about you reaches an employer through this product.

If direct submission is made available in future, it will happen only for an application you authorize, one application at a time. There is no setting that turns it on for everything, and consent given for one role is not consent for another. What would be sent is limited to:

• Your first name, last name, and email address
• Your resume file, as you uploaded it or as tailored for that role
• Your cover letter for that role

Your match scores, the reasoning behind them, and your interview preparation are written for you. They are not sent to employers.

An employer is not one of our service providers. An employer that receives an application reads it, judges it, and keeps it for its own hiring purposes, under its own privacy policy and its own retention schedule. It does not act on our instructions. The same is true of the applicant tracking system that employer runs or has hired, which is frequently the system that receives the application in the first place. We have no contract with either of them about your data.

What that means for you.Once an employer has received an application, we cannot retrieve it, correct it, or delete it. We can delete our own record of it, and we will if you ask. To reach the employer’s copy you must contact the employer, and rights you may have against that employer are exercised against them, not against us.

If you want to know exactly what an application would contain before anything is sent, write to support@tolopilot.com and a person will answer with the specifics for your account. You can ask this at any time, and asking changes nothing about your account.

6. Where your information is processed

The data controller is Tolo Goods LLC, operating under the Tolopilot brand. It is based in the United States, and your information is processed there. The service providers named in section 4 operate infrastructure in more than one country, so your information may be processed outside the country you live in.

If you apply to an employer in another country, that employer receives your application in the country it operates in, and it is subject to the law that applies to it rather than the law that applies to you.

We are still confirming the specifics of these arrangements with legal counsel, and we will state them here rather than leave them vague. If your decision to use CareerPilot depends on the answer, write to support@tolopilot.com and we will tell you what we know today.

7. Data retention and deletion

We retain your data for as long as your account is active. Deleting your account is one action in your account settings, at any time, whether or not you are paying. It cancels any active subscription, removes your resume files from storage, and deletes your profile, prepared material, applications, notes, and everything else tied to your account. It takes effect immediately rather than on a schedule, and it cannot be undone.

You can also export everything we hold about you, as a single file, from the same place. If you would rather we did either of these for you, write to support@tolopilot.com.

Two limits, stated plainly. Backups and legally required payment records may persist for a period after deletion. And if an employer has already received an application, deleting your CareerPilot account does not delete the employer’s copy, because that copy is theirs and is outside our reach. Section 5 explains why.

8. Cookies and tracking

CareerPilot uses cookies and similar technologies for authentication (session management) and analytics (PostHog). We do not use advertising cookies or third-party tracking networks.

9. Your rights

You can, at any time:

• Access the personal data we hold about you
• Ask us to correct data that is wrong
• Export your resume, your job search data, and everything else we hold, as one file
• Delete your account and its data
• Withdraw an authorization you gave for a specific application, at any point before it is sent
• Ask us what an application would contain before anything is sent
• Opt out of marketing emails

Export and deletion are both available in your account settings. For anything else, or if you would rather a person did it, write to support@tolopilot.com and a person will reply.

One boundary applies to all of these. They reach what we hold. They do not reach an application an employer has already received, which is described in section 5.

10. Security

We implement industry-standard security measures including encrypted data storage, HTTPS for all connections, row-level security in our database, and secure OAuth for authentication. No method of transmission over the internet is 100% secure, but we take reasonable steps to protect your information.

11. Children

CareerPilot is not directed to children under 13, and we do not knowingly collect personal information from them. During the controlled beta, participation is open only to people aged 18 and over. The eligibility clause in our Terms of Service still states 13, and we are reconciling the two.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via an in-app notice. Continued use of CareerPilot after changes take effect constitutes acceptance of the updated policy.

13. Contact

Questions about this Privacy Policy, or about what an application would contain before you send one? Write to support@tolopilot.com and a person replies. Not a form, and not a bot.