Privacy Policy

1. Who we are

StillSharp LLC, 4601 E. Douglas Ave., STE 150, Wichita, KS 67218, USA. Privacy questions and requests: support@stillsharp.ai.

2. What we collect

• What you give us: your email address, and if you provide them, your name, company, role and phone number.
• What you tell us: the content of enquiries, scoping call requests and emails.
• How you use the site: pages viewed, actions taken, approximate location from IP address, browser type and similar technical data.

3. How we use it

To respond to you, deliver what you asked for, send service messages and, if you opt in, the newsletter. To operate and secure the site. To meet legal, tax and accounting obligations. You can unsubscribe from marketing email at any time.

4. SMS communications

If you give us your phone number and opt in, we may text you about your enquiry, scheduling, and transactional updates related to a service you requested.

Message frequency varies. Message and data rates may apply. Consent to receive text messages is not a condition of purchase. Reply STOP to opt out or HELP for help, or email support@stillsharp.ai.

5. Mobile information sharing

We do not sell or rent your personal information. We do not share mobile opt-in information, including phone numbers collected for SMS consent, with third parties or affiliates for their marketing or promotional purposes.

We share information with service providers who help us operate the site, communications, scheduling and support, only as needed and under confidentiality obligations.

6. Cookies

We use only the cookies needed to make the site work. We do not run third-party advertising or analytics cookies, and we do not use tracking pixels. You can control cookies through your browser; disabling some affects functionality.

If that changes we will say so here before it takes effect.

7. What we collect

• Assessment answers and profile details: role, industry, years of experience, situation, goal.
• Resume and profile content if you buy a Rebuild: the resume you upload or paste, your target role, your achievements, and any LinkedIn headline, About text or profile URL you give us.
• Payment information is collected by Stripe. We never receive or store your card number. We receive the confirmation, the amount and your email.

8. How we use it

To score your assessment, generate your report, and for paying customers produce and deliver your rewritten documents. To send receipts and service messages.

9. AI processing

We use third-party AI providers to generate your report and documents, so the text you provide is sent to them. Under our agreements, they process it to produce your result and do not use it to train their models.

AI output can contain errors. You are responsible for reviewing it before you use it. Nothing here makes decisions with legal or similarly significant effects about you.

10. Who we share it with

We share it with service providers only, and only as needed to deliver the service. The categories are:

• Payment processing. Handled by Stripe, which collects your card details directly. We never see or store your card number.
• Hosting and database, in the United States.
• Transactional email, to send your results and receipts.
• Newsletter delivery, if you subscribe.
• AI model providers, to generate your report and documents, under the terms in section 9.

We will name any of these on request. Email support@stillsharp.ai.

11. How long we keep it

Resume content is kept to deliver and support your order, then deleted or de-identified within 90 days of fulfillment. Account and enquiry information is kept until you ask us to delete it, subject to legal and accounting requirements.

12. Your data is yours

The data inside an application we build or host belongs to you. You decide what goes in, what it is used for and how long it stays. We handle it on your documented instructions and for nothing else. You are the controller; we are the processor.

The binding terms are in the Data Processing Addendum to your agreement. This part summarizes them. Where they differ, the signed DPA governs.

13. What we handle

Whatever your project requires. Typically:

• Business documents you ask us to index: handbooks, policies, procedures, pricing rules, manuals. These often contain employee personal information, and we treat them accordingly.
• Operational data: enquiries, leads, quotes, job records.
• User accounts for your team.
• Contact and billing information for the people who engage us.

If a scope appears to need health, biometric or financial account data, we raise it before we start rather than after.

14. Your own instance

Your application runs on managed single-tenant hosting in the United States. Your instance and database are yours alone, never shared with another client, never commingled, never used to improve our other work.

15. Sub-processors

Which third-party services a build uses depends on what the build does, so there is no single list that would be true for every project. Publishing a fixed one here would mean either committing to a stack before we understand your requirements, or telling you something that turns out not to apply to you.

Instead: you get the actual list for your build, naming every provider and what each one does, as part of scoping and before you sign anything. It goes into your Data Processing Addendum, where it is contractually binding rather than a web page we could change.

So you know the shape of it before we talk, a build typically involves some combination of:

• application hosting
• a database and file storage
• one or more AI model providers
• transactional email
• SMS, only where the build sends text messages
• error monitoring, on some builds

All US-based. We give you 30 days' notice before adding or changing a provider on your build.

Where you hold your own account with the AI model provider, which is how production builds run, that provider is your processor rather than our sub-processor. It shortens the list your reviewers have to approve.

Where a build sends SMS, the carrier registration for that campaign belongs to whoever owns the sending number. If that is you, your own privacy policy will need the disclosures in sections 4 and 5 before the campaign can be approved. We flag this during scoping rather than after.

16. AI processing, training, retention and deletion

Content sent to a model provider is processed under API terms that prohibit training on it. Production builds run on your own account with that provider, so your agreement with them governs. We set the account up with you and configure the no-training and no-retention settings, and we show you what we configured. Where a build runs on our account, which covers the prototype and the build phase, that commitment is ours and it sits in the DPA.

• Retention is set by your agreement. While your application is live, your data stays until you delete it or tell us to.
• Export: any time, in a standard format, no permission needed and no fee.
• Deletion: on request at any time, and within 30 days of termination we return or delete your data at your election.

17. Security, breaches, and your people's requests

We use measures appropriate to the data: encryption in transit and at rest, access limited to those who need it, and regular backups. No storage or transmission is completely secure.

If we become aware of a breach affecting your data, we notify you without undue delay and no later than 72 hours after becoming aware, with what we know, what data was involved and what we are doing. We help you meet your own notification obligations.

Because your application may hold information about your employees and customers, those people may exercise rights over it. Those requests go to you, not to us. We help you respond, including locating, exporting, correcting or deleting records on your instruction.

StillSharp is a one-person practice. We use no subcontractors, and nobody outside StillSharp has access to your instance or your data. If that ever changes, we will bind any subcontractor to these same obligations and tell affected clients before it takes effect.

18. Your choices and rights

• Access, correction, deletion: email support@stillsharp.ai.
• Marketing email: every one has an unsubscribe link. Service messages such as receipts still come.
• SMS: reply STOP.
• California: you have CCPA and CPRA rights to know, delete, correct, and opt out of sale or sharing. We do not sell your personal information, and we will not discriminate against you for asking.
• EU and UK: where GDPR or UK GDPR applies, our legal bases are consent, performance of a contract, and legitimate interests in operating the service. You have rights to access, rectify, erase, restrict, port and object, and to complain to your supervisory authority. For business engagements, direct requests to the client who controls the application.

19. Children, location, changes, contact

The service is for adults and is not directed to anyone under 18. We do not knowingly collect information from children; tell us and we will delete it.

We operate in the United States. If you use the service from elsewhere, your information is processed here, where privacy law may differ from yours.

We may update this policy. The updated version is posted here with a new date, and we notify you where appropriate.

Questions: support@stillsharp.ai · StillSharp LLC, 4601 E. Douglas Ave., STE 150, Wichita, KS 67218, USA. See also our Terms of Service.