Privacy Policy

OpenToPoach (“OpenToPoach”, “we”, “us”) operates an AI-assisted platform that helps professionals present their experience and helps recruiters discover talent. We are the data controller for the personal data described below. For any privacy question, contact us at privacy@opentopoach.com.

We collect the following categories of data:

• Account & identity — when you sign in with LinkedIn, we receive your name, email address, profile photo, and professional headline.
• Profile & professional content — the résumés, CVs, work history, skills, writing/voice samples, job preferences, and target markets or roles that you create, upload, import, or generate on the platform.
• Connected accounts (optional) — if you connect GitHub, we read your public profile and repository signals to inform your professional summary.
• Communications — messages and interview/chat content you exchange through the platform (for example, between candidates and recruiters).
• Billing — if you subscribe or buy credits, our payment processor (Stripe) handles your card details. We store your subscription status and a customer reference, never full card numbers.
• Usage & device data — profile views, interactions, referral sources, and standard log data such as IP address, browser type, and timestamps.

• Provide and operate the service — building your profile, generating optimizations, and matching candidates with recruiters.
• Process your content through AI to produce analysis, scores, and rewritten materials at your request (see “AI processing” below).
• Maintain security, prevent abuse, and enforce rate limits and our terms.
• Process payments and manage subscriptions and credits.
• Communicate with you about your account, support requests, and material changes to the service.
• Understand and improve how the product is used, using aggregated or first-party analytics.

Our legal bases (where the GDPR or UK GDPR applies) are: performance of our contract with you, your consent (which you can withdraw), our legitimate interests in operating and securing the service, and compliance with legal obligations.

Core features send the professional content you choose to analyze or rewrite to third-party AI providers (via OpenRouter and the underlying model providers, such as Anthropic and Google) so they can generate the output you asked for. We send only what is needed to perform the task, and we do not use your content to train our own models. These providers process your content under their own privacy terms to return a result to us. Where providers offer controls to limit further use of submitted content, we use them, but we encourage you to review the terms of the underlying providers.

OpenToPoach is a two-sided platform, so some sharing is the point of the service. We share data in these ways and no others:

• With recruiters and for talent discovery — the profile and materials you choose to publish or make discoverable may be shown to recruiters and other users as part of the service. You control what you publish; unpublished drafts stay private to your account.
• With service providers (subprocessors) — LinkedIn (sign-in), OpenRouter and its model providers (AI), Stripe (payments), GitHub (optional signals you connect), and our hosting/infrastructure provider. They may process your data only to provide their service to us.
• For legal and safety reasons — where we must comply with law, enforce our terms, or protect the rights and safety of users.
• In a business transfer — if OpenToPoach is involved in a merger, acquisition, or asset sale, with notice to you.

We do not sell your personal data.

We use a small number of strictly necessary cookies to keep you signed in and to remember preferences such as your light/dark theme. Stripe may set cookies during checkout to process your payment securely. We do not use third-party advertising or cross-site tracking cookies.

We keep your account data for as long as your account is active. When you delete your account, we delete or anonymize your personal data, except where we must retain limited records (for example, billing records) to meet legal obligations. Waitlist sign-up data, including the IP address used to submit it, is retained only for a limited period for anti-abuse purposes and then removed.

Depending on where you live (including under the GDPR, UK GDPR, and the CCPA), you have rights to access, correct, export, delete, and restrict or object to the processing of your personal data, and to withdraw consent.

• Access & export — you can export a copy of your data from your account settings at any time.
• Deletion — you can delete your account and associated data from your account settings.
• Other requests — email us at privacy@opentopoach.com and we'll respond within the timeframe the law requires.

If you're in the EU/UK and believe we've mishandled your data, you also have the right to complain to your local data protection authority.

We protect your data with encryption in transit (HTTPS), scoped access controls, hashed credentials, and other safeguards appropriate to the sensitivity of the data. No system is perfectly secure, but we work to keep your information safe and to notify you of any breach affecting you as required by law.

We and our subprocessors may process your data in countries other than your own, including outside the EU/UK. Where we transfer personal data across borders, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

OpenToPoach is intended for working professionals and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it.

We may update this policy as the product evolves or the law changes. When we make material changes, we'll update the date above and, where appropriate, notify you. Your continued use of OpenToPoach after an update means you accept the revised policy.

Questions, requests, or concerns about your privacy? Email privacy@opentopoach.com.