Privacy Policy

1. Information We Collect

1.1 Information You Provide

When you use our Service, you may provide:

• Account Information: Name, email address, and password when you create an account
• Career Profile Data: Information you enter in career planning exercises, including job history, skills, target roles, and professional goals
• Resume Data: Uploaded resumes and the parsed content from them
• AI-Generated Content: Cover letters, interview preparation materials, and other content generated using our AI tools
• Communications: Messages you send to recruiters or our support team
• Job Search Outcome Data: Application activity, interview details, and offer information you voluntarily log through the Outcomes Tracker
• Job Search Queries: When you use the Job Leads feature (Pro tier), your search keywords and location preferences are sent to third-party job listing APIs (such as Adzuna and USAJobs) to retrieve relevant job postings. Your Job Blueprint data is used by our AI to rank results but is not shared with these external services

1.2 Information Collected Automatically

When you access our Service, we may automatically collect:

• Device Information: Device type, operating system, and browser type
• Usage Data: Pages visited, features used, and time spent on the Application
• Login History: IP address, device type, browser, and approximate location associated with each sign-in, used to detect unauthorized access and send new-device login alerts
• Session Activity: We monitor session idle time to enforce automatic sign-out after prolonged inactivity, helping protect your account if you leave a session unattended
• Analytics Data: Aggregated usage statistics collected via Google Analytics (with your consent)

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our Services
• Personalize your career planning experience
• Generate AI-powered content tailored to your profile
• Facilitate connections with recruiters (only with your explicit consent)
• Send you service-related communications (subject to your email notification preferences)
• Retrieve and rank job listings from third-party job boards based on your search criteria and career profile (Pro tier Job Leads feature)
• Send deadline reminder emails for your saved job leads (Pro tier, configurable per-lead or in bulk)
• Analyze usage patterns to enhance our platform
• Produce anonymized, aggregated research analytics to measure career outcome effectiveness (only with your explicit opt-in consent — see Section 5.7)
• Protect against fraud and maintain security

3. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience:

• Essential Cookies: Required for authentication and basic functionality (no consent needed)
• Analytics Cookies: Used via Google Analytics to understand how visitors use our platform (requires your consent)

You can manage your cookie preferences at any time through our cookie consent banner or in your Account Settings.

4. Data Sharing and Disclosure

We do not sell your personal information. We may share your data in the following circumstances:

• With Recruiters: Only when you explicitly approve a contact request
• Service Providers: Third parties who assist in operating our platform (e.g., cloud hosting, payment processing, job listing APIs). This includes the HaveIBeenPwned API, to which we send only a partial, anonymized hash prefix of your password to check whether it appears in known data breaches — your actual password is never transmitted
• Anonymized Research Data: De-identified, aggregated data may be included in research reports, grant applications, or academic publications. This data contains no personally identifiable information and cannot be traced back to individual users. Only data from users who have opted in is included (see Section 5.7)
• Partner Referrals: LaunchPath may display contextual referral links to partner services (such as Pebl, an Employer of Record platform) when relevant to your job search — for example, when you are targeting remote or international roles. These referrals are informational only: no personal data is shared with partner organizations through referral links. UFO Chaser™ LLC may receive referral compensation when users visit partner platforms through these links. You can dismiss any referral callout at any time.
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In connection with a merger, acquisition, or sale of assets

5. Your Rights and Choices

Depending on your state or jurisdiction of residence, you may have some or all of the following rights regarding your personal data. We honor these rights for all users regardless of location, unless noted otherwise.

5.1 Data Access and Export (Right to Access / Data Portability)

You can download a copy of all your data at any time from your Account Settings. This includes your career exercises, resume data, AI-generated content, saved job leads, company openings searches, email notification preferences, and account information. Your data is provided in a portable, machine-readable format (JSON) that can be transferred to another service.

5.2 Right to Correct Inaccurate Data

You have the right to correct inaccurate personal data we maintain about you. You can edit your career exercises, profile information, resume data, and other personal data directly within the Application at any time. If you need to correct information that cannot be edited through the Application interface (such as your account email address), you can update your email from Dashboard → Settings, or contact us at [email protected] and we will assist you.

5.3 Account Deletion (Right to Delete)

You can delete your account at any time from your Account Settings. Deleting your account permanently removes all personally identifiable information from our active systems, including your name, profile data, resume uploads, career exercise responses, AI-generated content, saved job leads, and notification preferences.

Anti-abuse retention (legitimate interest): When you delete your account, we retain a one-way cryptographic hash of your email address (SHA-256, salted) for up to 90 days to prevent a narrow category of abuse in which deleted accounts are immediately re-created to reset free-tier usage limits. The hash alone cannot be reversed to reveal your original email; it is only used to match against new signup attempts during the 90-day window. Alongside the hash, we retain a minimal snapshot of your monthly AI-usage counters at the moment of deletion — specifically, for each AI feature (e.g., resume generation, cover letter, AI Assist), the feature name, the count of generations used in the current monthly window, and the next monthly reset date. No email address, name, resume content, exercise responses, job leads, or other personal data is retained. After 90 days the hash and the usage-counter snapshot are automatically purged together.

If you need to re-create an account with the same email before the 90-day window elapses (for example, if you deleted by mistake), return to the signup page, enter your email, and click "Send me a reactivation link." You will receive an email with a one-time link (valid for 60 minutes) that clears the cooldown so you can create a new account. Fair-use note: to keep our free-tier AI generation limits fair for all users, your monthly AI-usage counters (the count of AI generations used this month and the existing monthly reset date) are carried over from the deleted account into your new account; they reset naturally on your normal monthly reset date, exactly as they would have for the original account. No other personal data from your prior account is restored — resume, exercises, job leads, and preferences all start fresh. If you cannot receive the reactivation email for any reason, contact [email protected] and we will assist you.

5.4 Right to Opt-Out of Targeted Advertising and Data Sales

We do not sell your personal data to third parties, nor do we share your personal data with third parties for cross-context behavioral advertising or targeted advertising purposes. We do not use your personal data for profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

Google Analytics, when enabled with your consent, collects aggregated usage data to help us understand how visitors interact with our platform. This data is not used for targeted advertising, and you can opt out of Google Analytics at any time via our cookie consent banner or your Account Settings.

5.5 Universal Opt-Out Preference Signals

We respect browser-level privacy preference signals, including the Global Privacy Control (GPC). When we detect a GPC or similar universal opt-out signal from your browser, we treat it as a valid request to opt out of any sale of personal data or processing for targeted advertising. Because we do not sell personal data or engage in targeted advertising, the GPC signal confirms and reinforces our existing practice. If you have previously provided consent to analytics cookies, a GPC signal will override that consent and disable analytics tracking for your session.

5.6 Cookie Preferences

You can accept or decline analytics cookies at any time. Your choice is stored locally and respected across sessions. You may also manage cookie preferences through your browser settings or by using a Global Privacy Control (GPC) signal.

5.7 Research Data Consent

You may opt in to contribute anonymized data for research purposes through your Account Settings. When enabled, we include your de-identified exercise completion rates, AI tool usage counts, and job search outcome statistics (such as application-to-interview and interview-to-offer conversion rates) in aggregated research analytics.

What is never included: Your name, email address, company names, resume content, notes, or any other personally identifiable information.

This data may be used in aggregate research reports and grant applications to measure whether structured career planning exercises and AI tools improve real-world job search outcomes. You can withdraw consent at any time from your Account Settings, and your data will be excluded from future analyses.

5.8 Email Notification Preferences

You can control which non-transactional emails you receive from LaunchPath Careers. Configurable categories include login alerts, recruiter interest notifications, career summary shares, and job deadline reminders.

Manage your preferences at any time from Dashboard → Settings → Email Notification Preferences, or use the unsubscribe link included in every non-transactional email. Transactional emails (password resets, email verification) cannot be disabled as they are essential for account security.

5.9 Response Timeframe

We will respond to verifiable consumer rights requests (access, correction, deletion, opt-out) within 45 days of receipt. If we need additional time due to the complexity or volume of requests, we may extend the response period by an additional 45 days, and will notify you of the extension and the reason within the initial 45-day period. There is no fee for the first request within a 12-month period. Subsequent requests, or requests that are manifestly unfounded or excessive, may be subject to a reasonable fee or declined with an explanation.

5.10 Right to Appeal

If we decline or are unable to fully fulfill your privacy rights request, we will provide you with a written explanation of the reasons. You have the right to appeal our decision by contacting us at [email protected] with the subject line "Privacy Rights Appeal." We will respond to your appeal within 60 days.

If your appeal is denied and you believe your rights have been violated, you may file a complaint with your state's Attorney General:

• Colorado: Colorado Attorney General
• Connecticut: Connecticut Attorney General
• Utah: Utah Division of Consumer Protection
• Virginia: Virginia Attorney General
• California: California Attorney General

5.11 Non-Discrimination

We will not discriminate against you for exercising any of your privacy rights. This means we will not deny you services, charge you different prices, provide a different level or quality of service, or suggest that you will receive different treatment as a result of exercising your rights under this policy or applicable privacy law.

5.12 Sensitive Data

Under various state privacy laws, "sensitive data" includes information revealing racial or ethnic origin, religious beliefs, mental or physical health conditions, sexual orientation, citizenship or immigration status, genetic or biometric data, precise geolocation data, and data from children under 13.

LaunchPath Careers does not intentionally collect or process sensitive data as defined above. Our Service collects career-related information (job history, skills, professional goals) which is not classified as sensitive data under these laws. If we ever expand our data collection to include categories of sensitive data, we will update this policy and obtain your explicit opt-in consent before processing such data, as required by applicable law.

6. State-Specific Privacy Rights

In addition to the general rights described in Section 5, residents of certain U.S. states have additional rights under their respective state privacy laws. The rights described above apply to all users, but the following sections summarize specific statutory frameworks.

6.1 California (CCPA/CPRA)

California residents have the right to know what personal information we collect, request deletion, request correction, and opt out of the sale or sharing of personal information. We do not sell your personal data. You may exercise your rights by contacting us at [email protected] or through your Account Settings.

6.2 Colorado (Colorado Privacy Act)

Colorado residents have the right to access, correct, delete, and obtain a portable copy of their personal data. You may also opt out of the sale of personal data, targeted advertising, and certain profiling. We honor universal opt-out preference signals including Global Privacy Control. We do not sell your data or process it for targeted advertising. To exercise your rights, use your Account Settings or contact [email protected]. You may appeal a denied request per Section 5.10.

6.3 Connecticut (Connecticut Data Privacy Act)

Connecticut residents have the right to access, correct, delete, and obtain a portable copy of their personal data. You may opt out of the sale of personal data, targeted advertising, and profiling that produces legal or similarly significant effects. We honor universal opt-out preference signals including Global Privacy Control. We do not sell your data or process it for targeted advertising. To exercise your rights, use your Account Settings or contact [email protected]. If we deny your request, you have the right to appeal (see Section 5.10), and if your appeal is denied, you may file a complaint with the Connecticut Attorney General.

6.4 Utah (Utah Consumer Privacy Act)

Utah residents have the right to access, delete, and obtain a portable copy of their personal data, and to opt out of the sale of personal data and targeted advertising. Effective July 1, 2026, Utah residents also have the right to correct inaccurate personal data. We do not sell your data or process it for targeted advertising. To exercise your rights, use your Account Settings or contact [email protected].

6.5 Virginia (Virginia Consumer Data Protection Act)

Virginia residents have the right to access, correct, delete, and obtain a portable copy of their personal data. You may opt out of the sale of personal data, targeted advertising, and profiling that produces legal or similarly significant effects. We do not sell your data or process it for targeted advertising. To exercise your rights, use your Account Settings or contact [email protected]. If we deny your request, you have the right to appeal (see Section 5.10), and if your appeal is denied, you may file a complaint with the Virginia Attorney General.

6.6 EU/EEA (GDPR)

EU/EEA residents have rights including access, rectification, erasure, restriction of processing, data portability, and the right to withdraw consent. You may also lodge a complaint with your local data protection authority.

7. Data Security

We implement industry-standard security measures to protect your data, including:

• Encryption of data in transit (TLS/SSL)
• Secure password hashing
• Multi-factor authentication with encrypted backup codes (optional)
• Rate limiting and account lockout protection
• CSRF (cross-site request forgery) protection on all state-changing operations
• Password breach screening against known compromised credentials
• Email verification for new accounts
• Automatic session timeout after prolonged inactivity
• New-device login alerts via email
• File upload validation (type and content verification)
• AI prompt injection safeguards
• Regular security audits

8. Data Retention

We retain your data for as long as your account is active. Inactive accounts may be deleted after extended periods of inactivity, in accordance with our data retention policy. You will be notified before any such deletion.

Post-deletion hash retention: As described in Section 5.3, a salted one-way hash of your email address is retained for up to 90 days after account deletion for anti-abuse purposes and is then automatically purged. This hash cannot be reversed to recover your email address.

Automated data minimization: In accordance with our annual Data Minimization Assessment and applicable state privacy laws (CPA, CTDPA, VCDPA), we enforce the following rolling retention windows via automated daily cleanup:

• Landing-page visitor IP addresses — deleted after 48 hours (used only for deduplication of visit counts)
• Profile view IP addresses & browser information — removed after 30 days; only aggregate view counts and referrer data are kept long-term
• Profile Q&A visitor IP addresses — removed after 7 days (used only for short-term rate limiting)
• Login history records — deleted after 90 days on a rolling basis
• Recruiter sign-up IP addresses — removed after 90 days (used only for initial fraud prevention)
• Referral metadata (IP address and browser info) — removed after 90 days

We no longer collect device type or last-feature-used metadata in micro-surveys, reducing unnecessary behavioural data capture.

8.1 Career Archetype Assessment Data

When you complete the Career Archetype assessment, we collect your responses to four personality-related questions. These responses are used to:

• Generate your career archetype profile — your personality dimension answers are processed to determine a primary and secondary career archetype.
• Personalize AI-generated guidance — if you have AI personalization enabled, your archetype results (primary and secondary archetype only, not raw answers) are used to tailor advice from Cosmo Counsel, our AI career chatbot.

Consent: Explicit consent is required before starting the assessment. You may revoke consent and delete all assessment data at any time from your Settings page.

AI personalization: You can disable AI personalization from Settings, which prevents your archetype data from being included in Cosmo Counsel prompts. Your stored assessment data is not affected by this toggle.

Data minimization: Only your primary and secondary archetype labels are shared with the AI for personalization. Raw assessment answers, confidence scores, and retake counts are never included in AI prompts.

Third-party AI providers: AI features are powered by models accessed through the Abacus.AI API. Your archetype labels (not raw answers) are included in prompts sent to these models only when AI personalization is enabled. We do not sell or share your assessment data with any other third parties.

Retention: Assessment data is retained for as long as your account is active. You can delete it at any time via Settings, and it is automatically removed when you delete your account.

Your rights: You may access, export (via DSAR), delete, or opt out of AI personalization of your assessment data at any time.

9. Children's Privacy

Our Service is not intended for children under 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected data from a child under 16, we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last Updated" date.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: