Privacy Policy

This Privacy Policy describes how [COMPANY LEGAL NAME] ("Stellar," "we," "us," or "our"), a Delaware corporation, collects, uses, shares, and protects your personal information when you use our website, applications, and services (collectively, the "Services"). Stellar is a career intelligence platform that helps professionals capture work experiences and leverage them for AI-generated resumes, career documents, and interview preparation.

By accessing or using the Services, you agree to the collection, use, and sharing of your information as described in this Privacy Policy. If you do not agree, please do not use the Services.

This Privacy Policy applies to all users of the Services, including visitors to our website and registered users. It does not apply to third-party websites, applications, or services that we do not own or control.

We collect information in several categories depending on how you interact with the Services.

Account and Profile Data. When you create an account using Google Sign-In, we receive your name, email address, and profile picture from Google. We never receive or store your Google password. You may also provide additional information such as your job title, career function, company, and professional details during onboarding.

Career Content. You may submit career experiences, brain dumps (free-form text describing your work), honors and recognition records, job histories, and education details. This content forms the core of your Stellar profile and is used to generate resumes, coaching, and other career documents.

Voice and Audio Data. If you use voice features (experience capture or interview preparation), audio is captured in your browser and transmitted to OpenAI for transcription. The resulting transcript is stored as your content. Raw audio files are never stored on our servers and are deleted immediately after transcription is complete.

Payment Data. When you purchase credits, payment is processed by Stripe, Inc. Stripe receives and processes your payment card information directly. Stellar never sees, receives, or stores your full card number. We store a Stripe customer identifier and a credit transaction ledger (purchase amounts, credit grants, and usage records).

Usage Data. We automatically collect information about how you use the Services, such as the pages you visit, features you use, actions you take, and timestamps. To diagnose problems and improve performance, our error and performance monitoring provider (Sentry) also collects technical information such as your browser type and device or operating system. We process your IP address transiently to enforce rate limits, prevent abuse, and infer approximate location for security purposes; we do not store your IP address as part of your usage profile.

Data from Third Parties. We may receive information from Google (via Google Sign-In) and from documents you upload (such as resumes in PDF or DOCX format for import).

We use your information for the following purposes:

Stellar uses third-party AI services to process your career content and deliver core features of the platform. We want to be transparent about how your data is used in this context.

AI Providers. We use Anthropic's Claude language models for text processing, including brain dump parsing, experience enrichment, job description analysis, experience-to-job matching, resume generation, and interview coaching. We use OpenAI for voice-to-text transcription of audio recordings.

What Data Is Sent. When you use AI-powered features, the relevant text content (such as your brain dump, experience details, or job description text) is sent to these providers for processing. Only the data necessary for the specific feature is transmitted.

Your Data Is Not Used for Model Training. Our agreements with Anthropic and OpenAI prohibit them from using your data to train their AI models. Your career content is processed solely to generate your requested output and is not retained by these providers beyond what is necessary to complete the request.

AI Output Accuracy. AI-generated content (resumes, coaching feedback, job analysis) may contain inaccuracies or may not fully reflect your experience. You are responsible for reviewing all AI-generated content before using it. See our Terms of Service for more details on your responsibilities regarding AI-generated content.

Automated Decisions. Stellar's AI features generate drafts, suggestions, and analysis that you review and control. We do not use automated processing or profiling to make decisions that produce legal or similarly significant effects about you without human involvement.

When you use the interview preparation feature, audio is captured in your browser during practice sessions. This audio is transmitted directly to OpenAI for transcription. The resulting transcript is stored as part of your interview preparation session content.

Raw audio files are never stored on Stellar's servers. Audio data is deleted immediately after transcription is complete. We retain only the text transcript, which is treated as your content and subject to the same retention and deletion policies described in this Privacy Policy.

We share your information only in the following circumstances:

Service Providers. We share data with third-party service providers that help us operate the Services. These include Anthropic (AI text processing), OpenAI (voice transcription), Supabase (database and authentication), Vercel (hosting), Upstash (rate limiting and abuse prevention, which processes your IP address), Stripe (payment processing), Resend (transactional email), and Sentry (error and performance monitoring). Each provider receives only the data necessary to perform its function and is contractually bound to protect your information.

Consulting Networks (Planned, Opt-In Only). We may in the future offer an opt-in consulting network program that shares a curated professional profile with consulting networks (such as Guidepoint and GLG) that match professionals with consulting opportunities. This program is not currently available. If we launch it, participation will be entirely opt-in: we will share data only after you explicitly consent. If offered, we would share professional profile information (such as your title, function, industry experience, and skills) but not raw brain dump text, private notes, or unpublished content. Stellar may receive a referral fee from consulting networks for successful placements; because of that fee, such sharing would be treated as a "sale" of personal information under the California Consumer Privacy Act. Unless and until you opt in to this program, no such sharing or sale of your personal information occurs. When the program becomes available, you will be able to exercise your opt-out rights as described in Sections 8 and 9.

Career Coaches and Educational Programs (Planned). We may in the future offer a marketplace that connects you with independent career coaches and educational programs. This feature is not currently available. If we offer it and you choose to book a coach or enroll in a program, we would share only the information necessary to facilitate that booking (such as your name, email, and relevant career context you choose to share). Your engagement with any coach or program would be a direct relationship between you and that provider.

Analytics. We use error monitoring (Sentry) and may use product analytics tools (such as Amplitude) to understand how the Services are used and to improve them. These tools may collect usage data, device information, and interaction patterns.

Legal Requirements. We may disclose your information if required by law, court order, subpoena, or other legal process, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

Business Transfers. If Stellar is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

What We Do Not Share. We do not sell your personal information. The only exception would be the planned, opt-in consulting network program described above, which is not yet available and would require your explicit consent. We do not share your information with advertisers in a way that personally identifies you.

We use a limited number of cookies and similar technologies to operate the Services.

Strictly Necessary Cookies. We use authentication cookies provided by Supabase to maintain your login session. These cookies are essential for the Services to function and cannot be disabled.

Analytics (Planned). We may implement product analytics tools (such as Amplitude) that use cookies to help us understand how users interact with the Services. When implemented, you will be able to control these cookies through your browser settings.

Advertising (Future). We may in the future use advertising and analytics technologies to deliver relevant content. If we implement advertising cookies, we will update this Privacy Policy and provide appropriate notice and controls.

You can control cookies through your browser settings. Disabling strictly necessary cookies may prevent you from using the Services.

Do Not Track. Some browsers transmit "Do Not Track" (DNT) signals. There is no industry-standard response to DNT signals, and we do not currently respond to them. We do honor Global Privacy Control (GPC) signals as described in Section 9. We do not authorize third parties to collect personally identifiable information about your online activities across different websites when you use the Services.

Depending on your state of residence, you may have rights regarding your personal information under the California Consumer Privacy Act (CCPA/CPRA) and similar state privacy laws. Residents of other U.S. states with comprehensive privacy laws have analogous rights, as described in Section 9.

Under the CCPA, your rights include:

To exercise any of the rights described above, contact us at [CONTACT EMAIL]. We will respond to verifiable requests within 45 days. If we need additional time (up to an additional 45 days), we will notify you of the reason and extension period.

Right to Appeal. If we decline to act on your request, you may appeal our decision by contacting us at [CONTACT EMAIL] with the subject line "Privacy Request Appeal." We will respond to your appeal within 45 days (or the period required by your state's law), explaining the action we have taken or declined to take and the reasons for our decision. If we deny your appeal, you may submit a complaint to your state Attorney General.

Residents of States Other Than California. If you reside in a U.S. state with a comprehensive privacy law (such as Virginia, Colorado, Connecticut, Texas, Oregon, Montana, or Utah), you have rights similar to those described above. These may include the right to access, correct, delete, and obtain a portable copy of your personal information, and the right to opt out of targeted advertising and the sale of personal information. To exercise these rights or to appeal a decision, contact us at [CONTACT EMAIL].

Sensitive Personal Information. To the extent we process sensitive personal information as defined under the CCPA, we use and disclose it only to provide the Services you request and for other purposes permitted without an opt-out under applicable law. We do not use sensitive personal information to infer characteristics about you. If our practices change, we will update this Privacy Policy and provide any controls required by law.

We honor Global Privacy Control (GPC) signals. If your browser sends a GPC signal, we will treat it as a valid request to opt out of the sale or sharing of your personal information and, where applicable under state law, targeted advertising.

You may designate an authorized agent to make requests on your behalf. We may require the agent to provide proof of authorization and may still require you to verify your identity directly.

Data Portability. You can export your career data at any time using the data export feature in your account settings. This produces a portable file containing your experiences, jobs, education, and other career content.

We retain your personal information for as long as your account is active and as needed to provide the Services.

Account Deletion. You may close your account at any time through your account settings or by contacting us. When you close your account, we initiate a 30-day grace period during which your account is deactivated but your data is preserved. You may reactivate your account during this period. After 30 days, your data is permanently and irreversibly deleted.

What Is Deleted. Upon permanent deletion, we remove all career content (experiences, brain dumps, resumes, decoded briefs, interview preparation sessions, coaching data), profile information, credit balances, and account settings.

What Is Retained After Deletion. We retain the following even after account deletion: (a) anonymized, aggregated usage data that cannot be used to identify you, used for product analytics and improvement; (b) financial transaction records in anonymized form, retained for up to seven years as required by tax and accounting laws; (c) Stripe maintains its own authoritative financial records as required by law.

Voice Recordings. Audio is never stored. Only transcripts are retained, and these are deleted with your account.

We implement appropriate technical and organizational measures to protect your personal information, including encryption of data in transit and at rest, row-level security policies on our database, independent authentication verification on every request, and regular security reviews.

No method of transmission or storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at [CONTACT EMAIL].

The Services are intended for working professionals and are not directed to individuals under 18 years of age. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from someone under 18, we will delete it promptly. If you believe a minor has provided us with personal information, please contact us at [CONTACT EMAIL].

If you submit an access request through our waitlist, we collect your name, email address, and any optional information you provide (such as career pain points or goals). This information is used to evaluate your request, communicate with you about your application status, and understand the needs of prospective users.

Waitlist data is stored separately from user account data. It is retained as part of our customer relationship management records and is not automatically deleted if you later create an account and subsequently delete it. To request deletion of your waitlist data, contact us at [CONTACT EMAIL].

In the event of a data breach that affects your personal information, we will notify you without unreasonable delay, consistent with applicable state and federal law. Notification will be sent to the email address associated with your account and will describe the nature of the breach, the types of information involved, and the steps we are taking in response.

We may update this Privacy Policy from time to time. For material changes (such as new categories of data collection, new third-party sharing, or changes to your rights), we will notify you by email before the changes take effect. For non-material changes, we will update the "Last updated" date at the top of this page.

Your continued use of the Services after changes become effective constitutes your acceptance of the updated Privacy Policy. If you do not agree with the changes, you may close your account.

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us at:

[COMPANY LEGAL NAME]

Email: [CONTACT EMAIL]

Address: [REGISTERED ADDRESS]

The following table describes the categories of personal information we collect, as defined by the California Consumer Privacy Act, whether we disclose or sell each category, and how long we retain it. Unless a longer period is stated below, we retain personal information for the life of your account plus the 30-day deletion grace period described in Section 10.