CAREEROS · TEST VERSION
Privacy notice
Version 2026-11-04. CareerOS is an early test version. This notice explains, in plain language, what we collect, why, who helps us run the service, and the choices you have.
The short version
- We only collect what you give us to run your account and its features.
- We do not sell your data, show ads, or share it with employers, recruiters or the organisation that told you about CareerOS.
- AI features only run after you agree. Your name and email are never sent to the AI.
- You can download everything or delete your account at any time from Your account.
1. Who we are
CareerOS is operated by Quiet Loop Labs, an individual developer, based in Taiwan ("we", "us"). We decide how your personal data is used, so we are the "controller" of it. Contact us about privacy at privacy@quietlooplabs.com.
2. What we collect
- Account: your email address and display name.
- Sign-in records: when you signed in, and the IP address and browser details of each signed-in session. A session lasts up to 30 days. Sign-in codes expire after 10 minutes and are stored only in scrambled (hashed) form.
- Your story: the answers you write in “Tell us what you've done”, and the situation and goal you choose, so we can remember where you are and suggest your next step.
- Career records you add: profile summary, work experience, education and courses, skills, projects, achievements, certificates, languages, preferences, and links to evidence.
- Résumé imports: when you import a résumé, the file is read inside your own browser. Only the extracted text is sent to us and saved so you can review it. The file itself is not uploaded.
- Jobs and applications: job descriptions you save and the progress of your applications.
- AI results and your feedback: career directions, job comparisons, improvement plans and résumé versions, plus your ratings of them and your plan progress.
- Your choices: a record of the consents you gave or withdrew, and when.
Please do not enter sensitive details we do not need, such as health information, religion, ethnicity, political views, sexual orientation, criminal records, or identity or bank numbers.
3. How we use it, and why we are allowed to
| What we do | Legal reason |
|---|---|
| Create your account, sign you in by email code, store and show your records, and provide the features you use | Needed to provide the service you asked for (contract) |
| Send your career records and a chosen job description to our AI provider to produce your analyses and résumé drafts | Your consent, given before the first AI use |
| Use your feedback and results, with names and contact details removed, to improve CareerOS | Your optional, separate consent |
| Keep the service secure: limit repeated requests, prevent abuse, investigate errors | Our legitimate interest in a safe, working service |
| Keep a record of the consents you gave or withdrew, while your account exists | Legal obligation to be able to show your consent |
We do not use your data for advertising and we do not sell it.
4. How the AI works with your data
- When you organise your story or run an analysis, we send your answers or career records (and the job description you choose) to Cloudflare Workers AI. Your name, email and contact details are not sent.
- When the AI organises your story, it only uses your own words, and nothing is added to your profile until you have checked it.
- Cloudflare states that it does not use this content to train AI models and does not keep it after the request has been processed.
- AI can be wrong. Every result points to the records it is based on, and anything that cannot be linked to your records is removed or marked as unknown. You decide what to use. We do not make decisions about you that have legal or similarly significant effects.
- We do not currently train our own AI model. If we do in future, we will only use data from people who gave the optional product-improvement consent, and we will update this notice first.
5. Who helps us run the service
These companies process data for us under data processing agreements and only on our instructions:
- Cloudflare — hosts the website on its global network, runs the AI, and keeps technical request logs for up to 3 days.
- Neon — hosts the database, in AWS Europe (London).
- Resend — sends sign-in code emails. It stores data in the United States and keeps email logs for up to 30 days.
Some of these providers are in, or use, countries outside the UK and European Economic Area, including the United States. Where that happens, transfers are protected by the providers' standard contractual clauses (including the UK Addendum) or an equivalent legal safeguard.
We may also disclose data if the law requires it.
6. How long we keep it
- Your account and records are kept until you delete them or your account.
- When you delete your account, it is removed from our live database straight away. Copies can remain for a short time in database recovery history (up to 6 hours), email delivery logs (up to 30 days) and technical logs (up to 3 days), after which they are gone.
- If we close the test service, we will email you at least 30 days before, so you can download your data. Then we delete everything.
7. Your rights
- See and take your data: download all of it as one file on Your account.
- Correct it: edit any record in your profile.
- Delete it: delete single records, or your whole account on Your account.
- Withdraw consent: change your AI choices on Your account at any time. This does not affect what was done before.
- Object or ask us to limit use: email privacy@quietlooplabs.com.
We reply within one month. If you are unhappy with how we handled your data, you can complain to your data protection authority — in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, the authority in your country. We would appreciate the chance to fix it first.
8. Cookies
We only use cookies that are needed to keep you signed in. We do not use analytics, advertising or tracking cookies.
9. Do Not Track and US privacy rights
We do not track you across other websites and we do not use tracking or advertising cookies, so the site works the same whether or not your browser sends a “Do Not Track” or Global Privacy Control signal. We do not sell your personal information or share it for targeted advertising. If you live in a US state that gives you privacy rights (for example California), you can use the rights in section 7, and we will never treat you differently for doing so.
10. Security
Connections are encrypted. Each account's data is separated inside the database, so one account cannot read another's. Sign-in uses one-time codes, so there is no password to steal. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.
11. Age
CareerOS is for people aged 16 or older.
12. Changes
If we change this notice in a way that matters, we will tell you by email or in the app before the change applies, and ask again where your consent is needed.