Privacy Policy

Careering Ltd (company number 17148691), registered in England and Wales at Harborough House, 1-3 London Road, Leicester, United Kingdom, LE2 5DL, is the data controller for the personal data described here.

For anything to do with your data, email privacy@careering.com.

You write personal things in Careering. We treat that seriously.

• We do not sell your data, and we never have.
• We do not use what you write to train AI models, and our AI providers are contractually barred from doing so with data sent through their APIs.
• You can export or delete everything, whenever you want.

The rest of this page is the detail behind those three statements.

Account information. Your email address, which is how you sign in. If you fill in your profile: your name, country and anything else you choose to add.

What you write. Your answers to the career journal's guided questions, journal entries, reflections, and any image you upload - for example a sketch of your future day. This is the most personal data we hold, and it is the data we are most careful with.

Purchases. What you bought, when, and the reference our payment provider gives us. We never see or store your card number - that goes directly to Stripe.

Conversations with AI features. The messages you send and the responses you get, so you can come back to them.

Technical and usage data. IP address, browser and device type, and which pages you visited. We use a privacy-focused analytics tool that does not build advertising profiles or follow you across other websites.

Coach applications and enquiries. If you apply to be a coach, or make a business enquiry, whatever you put in the form - for coach applications that includes the intro video, if you upload one, and the referee details you give us. We use a referee's details only to take your reference; please make sure they are happy to be contacted before you name them.

To provide the service you have asked for - your account, your career journal, your cohort place, your coaching block. Legal basis: performance of a contract.

To take payment and keep financial records. Legal basis: performance of a contract, and legal obligation for the records we must keep.

To send you service messages - sign-in codes, receipts, cohort reminders, and the check-in nudges you have turned on. Legal basis: performance of a contract, and our legitimate interest in a service that works.

To keep Careering secure and working - spotting abuse, rate limiting, fixing faults. Legal basis: our legitimate interests.

To understand how the service is used, in aggregate, so we can improve it. Legal basis: our legitimate interests.

To send you marketing about Careering, if you have asked for it. Legal basis: consent. Every marketing email has a one-click unsubscribe, and we honour it.

Some features send what you have written to an AI provider so it can generate a response.

We use two providers, and which one handles your text depends on the feature. Anthropic powers the discovery quiz and the AI career coach. OpenAI powers the coach matcher and the AI mentor inside courses.

When you use one of those features, the relevant text is sent to that provider's API for the time it takes to produce a response. Both are contractually prohibited from using data submitted through their APIs to train their models.

We do not use your content to train any model of our own.

If you would rather no AI touched what you write, do not use those features - nothing is sent unless you use one.

Coaches can choose to connect a Google Calendar to Careering. It is optional, and none of what follows happens unless a coach connects one. We never ask clients for access to their Google account.

What we can access. When you connect, you give Careering permission to:

• See when you are busy. Google tells us only the start and end times of the busy periods in your calendar - not what the events are, who is in them or where they are. We use this so clients cannot book you at a time you are already busy.
• Create, change and delete the events for your Careering bookings. When a client books you, we add the session to your calendar, and if it is moved or cancelled we update or remove that event. If you have not given us your own meeting link, we ask Google to add a Google Meet link to the event.
• See the email address of the Google account you connected, so your coach portal can show which account is linked.

Your other events. We do not use the titles, descriptions, attendees or locations of your other events. There is one narrow case where Google sends us your events rather than just busy times: when a booking is being moved, we ask for the events in that booking's time slot, so we can tell the booking itself apart from your other commitments. From that answer we use only each event's identifier, its start and end time, whether it is cancelled or marked as free, and whether you declined it. We do not store any of it.

What we store:

• The tokens Google gives us when you connect, so we can keep your calendar up to date without asking you to sign in to Google each time. They are encrypted before they are saved.
• The email address of the connected Google account, when you connected, and a short note of the last error if a request to Google fails, so the portal can explain it.
• A copy of the busy times we last fetched (start and end times only), so we are not asking Google every time someone looks at your availability. We treat it as current for two minutes, then ask Google again; each new answer replaces the last.
• For each booking we add to your calendar, the event's identifier and, if we created one, the Google Meet link. These are kept with the booking record so we can update or cancel the event later.

Who sees it. We use your Google Calendar data only to show clients when you are free and to keep your Careering bookings in your calendar. Clients see the times we offer, never your calendar or the events in it. When we create a Google Meet link for a booking, we send it to the client who booked, so they can join.

The calendar event we create for a booking contains the client's name and email address and the session type, so you can see who you are meeting. It is written into your own calendar and is then held by Google under your Google account.

We do not sell Google user data, share it with advertisers or other third parties, or use it for advertising, and we do not use it to train AI models.

Disconnecting. You can disconnect at any time from the Google Calendar card in your coach portal. When you do, we ask Google to revoke Careering's access and delete the stored tokens, account email and busy-time copy straight away. You can also remove Careering's access from your Google Account settings at myaccount.google.com; if you do, the next time we try to reach your calendar Google refuses, and we stop using the connection, delete the stored tokens and busy-time copy, and email you to say so. Events already in your calendar stay there, and the booking records described above are kept for as long as we keep bookings (see How long we keep it).

Careering's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use these providers to run Careering. Each processes data only on our instructions.

• Neon - our database. Hosted in the EU (London).
• Clerk - sign-in and account authentication.
• Vercel - hosting, file storage, and delivery of the website and app.
• Stripe - payments. Stripe is the controller for the card data you give it directly.
• RevenueCat - managing subscriptions across the web and app stores.
• Anthropic - the discovery quiz and the AI career coach.
• OpenAI - the coach matcher and the in-course AI mentor.
• Resend - transactional and service email.
• Bunny - video delivery for course content.
• Umami - privacy-focused, aggregate usage analytics.

Your coach's calendar. If you book a coach who has connected Google Calendar, your name, your email address and the session are added to an event in their calendar, which Google then holds for them. The Google Calendar (coaches) section above has the detail.

Cohorts. Other people in your cohort will see what you say in group sessions and discussion. That is the point of a cohort - but it means what you share there is not private to you.

We will also disclose data where the law requires it, or to establish or defend legal claims. If Careering is ever sold or merged, your data may transfer to the buyer, who would remain bound by this policy.

We do not sell your personal data, and we do not share it with advertisers.

Your account and everything you write are stored in the UK (London).

Some of our providers - including our payment, subscription and AI providers - process data in the United States. Where that happens, transfers are covered by the UK International Data Transfer Addendum, EU Standard Contractual Clauses, or an adequacy decision, as appropriate.

Your account and content: for as long as your account is open. Delete your account and we delete them.

Financial records: six years after the transaction, because tax law requires it. This is limited to the record of the transaction.

Booking records, including any Google Calendar event id and Google Meet link stored against a session: for as long as the account that owns the booking - coach or client - is open, or six years after the transaction where the booking is also the financial record, whichever is longer.

Coach applications, including any video and referee details: while we are actively recruiting and assessing coaches. Email privacy@careering.com at any time and we will delete your application.

Name and email from coach applications, unless the applicant ticked the box asking us not to keep them: retained after the current recruitment round closes so we can get in touch about future opportunities, until the applicant asks to be removed. The legal basis is legitimate interest - talent-pool retention is standard recruiting practice. Email privacy@careering.com to be removed at any time.

Security and rate-limiting logs: a short period, typically no more than 30 days.

Analytics: in aggregate, indefinitely - but not in a form that identifies you.

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data deleted.
• Restrict or object to how we process it, including objecting to processing based on legitimate interests.
• Receive your data in a portable format, or have it sent to another provider.
• Withdraw consent at any time, where we relied on consent.

To exercise any of these, email privacy@careering.com. We will respond within one month. We will not charge you or make it difficult.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, but we would appreciate the chance to put it right first.

We use cookies that are strictly necessary to run the service - principally to keep you signed in. These do not require consent.

Our analytics is cookieless and does not track you across other websites, so we do not show you a consent banner for it.

We do not use advertising or third-party tracking cookies.

Data is encrypted in transit and at rest. Access to production data is limited to the people who need it. Sign-in is by one-time code to your email rather than a password you might reuse elsewhere.

No system is perfectly secure. If a breach ever affects your rights and freedoms, we will tell you and the ICO within the timescales the law requires.

Careering is for adults. It is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us their data, tell us and we will delete it.

If we change this policy in a way that materially affects you, we will tell you by email or in the app before it takes effect. The date at the top always shows when it was last updated.