Privacy Policy

1. Who we are

StillSharp LLC, 4601 E. Douglas Ave., STE 150, Wichita, KS 67218, USA. Privacy questions and requests: support@stillsharp.ai.

2. What we collect

• What you give us: your email address, and if you provide them, your name, company, role and phone number.
• What you tell us: the content of enquiries, scoping call requests and emails.
• How you use the site: pages viewed, actions taken, approximate location from IP address, browser type and similar technical data.

3. How we use it

To respond to you, deliver what you asked for, send service messages and, if you opt in, the newsletter. To operate and secure the site. To meet legal, tax and accounting obligations. You can unsubscribe from marketing email at any time.

4. SMS communications

If you give us your phone number and opt in, we may text you about your enquiry, scheduling, and transactional updates related to a service you requested.

Message frequency varies. Message and data rates may apply. Consent to receive text messages is not a condition of purchase. Reply STOP to opt out or HELP for help, or email support@stillsharp.ai.

5. Mobile information sharing

We do not sell or rent your personal information. We do not share mobile opt-in information, including phone numbers collected for SMS consent, with third parties or affiliates for their marketing or promotional purposes.

We share information with service providers who help us operate the site, communications, scheduling and support, only as needed and under confidentiality obligations.

6. Cookies

We use only the cookies needed to make the site work. We do not run third-party advertising or analytics cookies, and we do not use tracking pixels. You can control cookies through your browser; disabling some affects functionality.

We sometimes show two versions of a page to learn which one helps people more. Your browser keeps a note of which version you saw (in local storage, not a cookie) so you see the same one next time. It holds no personal information.

If that changes we will say so here before it takes effect.

7. What we collect

• Assessment answers and profile details: role, industry, years of experience, situation, goal.
• Resume and profile content if you buy a Rebuild: the resume you upload or paste, your target role, your achievements, and any LinkedIn headline, About text or profile URL you give us.
• Free ATS resume checker: the role you want next, your industry, the resume you upload or paste, and a job posting if you paste one. Your email address only if you give it to unlock the full report. We use the resume and posting only to run the check and write your free samples, and we don't keep them, apart from the AI copy described in section 9.
• Free LinkedIn headline generator: the titles, industry and results you type. We use them only to write your headlines and we don't keep them, apart from the AI copy described in section 9.
• Reviews: if you leave one, your star rating, your review, and the name and role you choose to show. Published only if you tick the box, and removed if you ask.
• Job postings you paste so we can write a cover letter for them, and any note you add.
• Your account: your email address and when and how you signed in. We don't use passwords; you sign in with a link or a one-time code we email you.
• If you sign in with Google: Google tells us your Google email address, that Google has verified it, and an ID number for your Google account. We don't get your Google password, contacts, files or anything else, and we don't post to or read from your Google account. If you link a Google account, we keep that email and ID with your account until you unlink it or delete your account.
• Documents we make for you: each resume version, your LinkedIn content and your cover letters, kept in your account.
• Payment information is collected by Stripe. We never receive or store your card number. We receive the confirmation, the amount and your email. When the AI coach is offered at checkout, Stripe also saves your card for coach payments you choose later; we keep only Stripe's reference to it.
• AI coach plan: which plan you chose, its dates and whether it's active, paused or cancelled.
• Your coach chat and saved items: what you and the coach write to each other, the jobs and offers you save (including posting text and offer terms), and drafts you accept.
• Your practice interviews and exercises: the questions you were asked, the answers you typed, the exercises you were given and the scores and feedback on them.
• Your career tools: the wins you log, the new job you tell the coach about and your notes on it, your 90-day plan and what you tick off, the self-reviews and promotion cases the coach drafts (and any review questions you paste in), resume updates made from your wins, and your weekly check-ins.

8. How we use it

To score your assessment, generate your report, run the free ATS resume checker and headline generator (and limit how often each can be used), run the AI coach from what you've saved in your account, and for paying customers produce and deliver your rewritten documents and cover letters. To keep those documents in your account so you can come back to download them, revise them and write new cover letters. To send receipts, sign-in emails and other service messages, and, while your coach is on, a short weekly check-in or a monthly wins reminder. Each of those reminder emails has a one-click link to stop them, and you can turn them off on your coach page.

When we look at your account. To help with a problem, StillSharp can see your account's status, plan, documents and usage. Your coach chat stays closed unless we need it to fix something you've raised or to keep someone safe; opening it needs a written reason, is recorded, and the date shows on your account page.

9. AI processing

We use third-party AI providers to generate your report and documents, so the text you provide is sent to them. Under our agreements, they process it to produce your result and do not use it to train their models.

We keep a copy of what we send to and receive from the AI provider for up to 30 days so we can check quality and fix problems, then delete it. Records of cost and usage, which contain none of your content, are kept longer.

AI output can contain errors. You are responsible for reviewing it before you use it. Nothing here makes decisions with legal or similarly significant effects about you.

10. Who we share it with

We share it with service providers only, and only as needed to deliver the service. The categories are:

• Payment processing. Handled by Stripe, which collects your card details directly. We never see or store your card number.
• Google sign-in, only if you choose it. Google handles the sign-in under its own privacy policy.
• Hosting and database, in the United States.
• Bot protection on the free ATS resume checker and LinkedIn headline generator, by Cloudflare Turnstile. It looks at your browser and IP address to tell people from scripts. We get only a pass or fail.
• Transactional email, to send your results and receipts.
• Newsletter delivery, if you subscribe.
• AI model providers, to generate your report and documents, under the terms in section 9.

We will name any of these on request. Email support@stillsharp.ai.

11. How long we keep it

• Your account and its documents (your resume, the versions we write, LinkedIn content, cover letters and the job postings you paste) are kept while your account is active, so they're there when you need them.
• Resume Rebuild orders without an account. Your resume, your answers and the files we made for you are kept while your private page is open and for 12 months after it closes, so you can come back for them. Then they're deleted automatically. A record of the payment is kept as tax and accounting law requires. If an order is never delivered, its content is deleted 12 months after the order date.
• Reviews. Published reviews stay up until you ask us to remove them. Unpublished ones are deleted with the order under the rule above.
• Delete any time. Account settings has a Delete account button, or email support@stillsharp.ai. We delete your account and its documents within 30 days, usually right away. Copies in routine backups are overwritten within a further 30 days.
• Inactive accounts. If you don't sign in for 24 months, we email you. If you still don't sign in within 30 days of that email, we delete the account and its documents.
• Free ATS resume checks. We don't keep the resume or the job posting. We keep a record that the check happened, its scores, and a scrambled (hashed) form of the resume text and your network address, plus a scrambled form of your email if you unlock the full report, so we can limit free checks. Kept for 13 months.
• Headline generator runs. We keep a record that a run happened and a scrambled form of your network address, never what you typed, for 13 months.
• Copies of AI requests and replies: up to 30 days, as described in section 9.
• Your coach plan record is kept with your account and deleted with it. Deleting your account also cancels the plan straight away.
• Coach chat, saved jobs, offers and drafts are kept while your account is active, so the coach remembers your search. Clear the chat or remove any item yourself at any time; deleting your account removes all of it.
• Practice interviews and exercises, with their scores, are kept with your account so you can see how you're improving. Delete any of them yourself at any time; deleting your account removes all of them.
• Wins, plans, reviews and check-ins are kept with your account so the coach can build on them. Delete any win, review or plan yourself at any time; deleting your account removes all of it. A resume update you accept becomes a new version of your resume and is kept like your other versions.
• Payment and accounting records are kept as long as tax and accounting law requires. Stripe keeps its own records under its own policy.
• Enquiries are kept until you ask us to delete them.

12. Your data is yours

The data inside an application we build or host belongs to you. You decide what goes in, what it is used for and how long it stays. We handle it on your documented instructions and for nothing else. You are the controller; we are the processor.

The binding terms are in the Data Processing Addendum to your agreement. This part summarizes them. Where they differ, the signed DPA governs.

13. What we handle

Whatever your project requires. Typically:

• Business documents you ask us to index: handbooks, policies, procedures, pricing rules, manuals. These often contain employee personal information, and we treat them accordingly.
• Operational data: enquiries, leads, quotes, job records.
• User accounts for your team.
• Contact and billing information for the people who engage us.

If a scope appears to need health, biometric or financial account data, we raise it before we start rather than after.

14. Your own instance

Your application runs on managed single-tenant hosting in the United States. Your instance and database are yours alone, never shared with another client, never commingled, never used to improve our other work.

15. Sub-processors

Which third-party services a build uses depends on what the build does, so there is no single list that would be true for every project. Publishing a fixed one here would mean either committing to a stack before we understand your requirements, or telling you something that turns out not to apply to you.

Instead: you get the actual list for your build, naming every provider and what each one does, as part of scoping and before you sign anything. It goes into your Data Processing Addendum, where it is contractually binding rather than a web page we could change.

So you know the shape of it before we talk, a build typically involves some combination of:

• application hosting
• a database and file storage
• one or more AI model providers
• transactional email
• SMS, only where the build sends text messages
• error monitoring, on some builds

All US-based. We give you 30 days' notice before adding or changing a provider on your build.

Where you hold your own account with the AI model provider, which is how production builds run, that provider is your processor rather than our sub-processor. It shortens the list your reviewers have to approve.

Where a build sends SMS, the carrier registration for that campaign belongs to whoever owns the sending number. If that is you, your own privacy policy will need the disclosures in sections 4 and 5 before the campaign can be approved. We flag this during scoping rather than after.

16. AI processing, training, retention and deletion

Content sent to a model provider is processed under API terms that prohibit training on it. Production builds run on your own account with that provider, so your agreement with them governs. We set the account up with you and configure the no-training and no-retention settings, and we show you what we configured. Where a build runs on our account, which covers the prototype and the build phase, that commitment is ours and it sits in the DPA.

• Retention is set by your agreement. While your application is live, your data stays until you delete it or tell us to.
• Export: any time, in a standard format, no permission needed and no fee.
• Deletion: on request at any time, and within 30 days of termination we return or delete your data at your election.

17. Security, breaches, and your people's requests

We use measures appropriate to the data: encryption in transit and at rest, access limited to those who need it, and regular backups. No storage or transmission is completely secure.

If we become aware of a breach affecting your data, we notify you without undue delay and no later than 72 hours after becoming aware, with what we know, what data was involved and what we are doing. We help you meet your own notification obligations.

Because your application may hold information about your employees and customers, those people may exercise rights over it. Those requests go to you, not to us. We help you respond, including locating, exporting, correcting or deleting records on your instruction.

StillSharp is a one-person practice. We use no subcontractors, and nobody outside StillSharp has access to your instance or your data. If that ever changes, we will bind any subcontractor to these same obligations and tell affected clients before it takes effect.

18. Your choices and rights

• Access, correction, deletion: email support@stillsharp.ai. If you have an account, you can also do it yourself from your account page: download everything we hold about you in one file, fix your profile, change your email address, or delete the account.
• Marketing email: every one has an unsubscribe link. Service messages such as receipts still come.
• SMS: reply STOP.
• California: you have CCPA and CPRA rights to know, delete, correct, and opt out of sale or sharing. We do not sell your personal information, and we will not discriminate against you for asking.
• EU and UK: where GDPR or UK GDPR applies, our legal bases are consent, performance of a contract, and legitimate interests in operating the service. You have rights to access, rectify, erase, restrict, port and object, and to complain to your supervisory authority. For business engagements, direct requests to the client who controls the application.

19. Children, location, changes, contact

The service is for adults and is not directed to anyone under 18. We do not knowingly collect information from children; tell us and we will delete it.

We operate in the United States. If you use the service from elsewhere, your information is processed here, where privacy law may differ from yours.

We may update this policy. The updated version is posted here with a new date, and we notify you where appropriate.

Questions: support@stillsharp.ai · StillSharp LLC, 4601 E. Douglas Ave., STE 150, Wichita, KS 67218, USA. See also our Terms of Service.