Legal Privacy Policy
Last updated: October 2026 · Governing jurisdiction: Florida, USA
AiProof CareersHub ("we", "us", or "our") is operated by Kinson Digital Hub LLC, Jacksonville, FL, USA. This policy explains what personal data we collect, why we collect it, how it is stored, and your rights regarding that data. We comply with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and applicable US data privacy standards.
1. What Data We Collect
- Email address — collected when you ask us to email your diagnostic results, give it to unlock 2 more free tests in a day (we keep it as a contact and email you your next result; this does not sign you up to our newsletter unless you tick that separate box), subscribe to our newsletter, send us a message through the contact form, or buy a paid product (from your Stripe checkout). Asking for your results by email sends you one email and does not subscribe you to anything; the newsletter is a separate tick-box.
- Newsletter consent record — if you subscribe, we store your email address (and name, if you gave it) together with a record of your consent: the page and exact wording you agreed to, the date and time, and your IP address. We then send one email asking you to confirm your address, and we send no newsletter until you click it; when you do, we also record the date, time and IP address of your confirmation. We keep this so we can prove your consent and honour your choices.
- Contact form submissions — if you use the "Send a Message" form, we store the name, email address, reason for contact and full message you enter, so that we can reply to you and keep a record of the conversation. Sending a message does not subscribe you to our newsletter; that is a separate tick-box you must opt into.
- Organisation enquiries: if you use the enquiry form on our For Organizations page, we store the name, work email, organisation, job title, organisation size and type, and any message you enter, so that we can respond about a Workforce AI Exposure Audit. Netlify Forms also records technical details such as your IP address and browser type, which are used to filter spam. Sending an enquiry does not subscribe you to our newsletter. Data an organisation later shares with us for an audit is governed by the engagement agreement signed for that audit, not by this policy.
- Newsletter profile tags — if you tick the newsletter box on the diagnostic results screen, we attach two non-identifying tags to your newsletter record: which persona you selected (student, professional or manager) and your AI-exposure band (lower, moderate or high). We use these only to send relevant career content. We do not attach your job title, tasks or score.
- Career quiz answers — your job title or field of study, task descriptions, years of experience, skills, and location. For the free score, these are saved in your browser's
localStorage and sent to Anthropic's API for analysis, but are not retained on our servers (apart from the anonymous statistics record described below). If you purchase a paid product (the Personalised 90-Day AI Career Action Plan or a consultation), the details you entered are stored on our servers (hosted on Netlify) with your purchase, so we can deliver it; for the plan, the generated report is stored too, so that your private report link keeps working on any device. - Anonymous diagnostic statistics — each time a free score is calculated, we keep one anonymous statistics record made only of grouped values: your exposure band (lower, moderate or high), a 10-point score range (for example 40–49), the persona you chose (student, professional or manager), a country group and a broad industry group and a broad occupation group (both worked out from what you typed, such as your job title, and kept only as a category, never as your words), where your visit came from as a broad group (for example our QR code, Facebook or a search engine, taken from the link you followed), a years-of-experience bracket and the week (not the day) it was calculated. The record contains no name, email address, IP address, job title, task descriptions, skills or any other text you typed, and it is not linked to your browser, payment or account. Separately, we keep anonymous counts of how many people open the diagnostic page, start it and finish it, by the same broad source group, the type of ad placement they came from (for example a Facebook feed or Instagram Stories) and the date, with no cookie, ID or anything else about you. We use these records only in aggregate, for example to publish figures such as "X% of diagnostic users scored high exposure", and we never show or publish a figure for a group of fewer than 10 people.
- Payment information — if you purchase a paid product, payment is processed by Stripe. We do not store card numbers or payment credentials. We receive and store a confirmation that payment was successful and the email address you used at checkout (to prevent duplicate charges and to help you recover your purchase).
- Analytics data — Google Analytics 4 (GA4), measurement ID
G-B7HWQ0TSL8, collects usage data including pages visited, time on page, referring site, device and browser type, and approximate geographic location derived from your IP address. GA4 does not load at all until you press "Accept Analytics" on our cookie banner — if you decline, or ignore the banner, no Google Analytics script is loaded and no analytics cookies are set. This processing is subject to Google's own privacy policy. - Account data — if you create an account after purchasing a paid report, Clerk stores your email address and payment confirmation status.
2. Why We Collect It (Legal Basis)
- Email address — collected with your consent to deliver your diagnostic report and, if opted in, our career intelligence newsletter. Legal basis: consent (GDPR Art. 6(1)(a)).
- Payment confirmation — processed to fulfil the paid service contract. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
- Analytics — used to improve the platform. Legal basis: legitimate interest (GDPR Art. 6(1)(f)) for aggregated analytics; consent for cookies where required.
- Anonymous diagnostic statistics — used to understand and publish aggregate trends in AI exposure. The records are designed so that no individual can be identified from them; to the extent any law treats them as personal data, the legal basis is legitimate interest (GDPR Art. 6(1)(f)).
3. Third-Party Data Processors
We use the following third-party services to operate the platform. Each is a data processor acting under our instructions:
- Resend (resend.com) — delivers our emails: the results email you request, our newsletter if you subscribe, and internal notifications when you contact us. Resend receives your email address and the content of the email being sent, and keeps delivery logs. Your newsletter consent record is kept on our own servers (Netlify), not only with Resend. Resend Privacy Policy.
- Stripe (stripe.com) — processes one-time payments. Stripe Privacy Policy.
- Netlify (netlify.com) — hosts the website and serverless functions, and stores purchased diagnostic reports (including the career details you entered) so your report stays retrievable, payment-confirmation records (a Stripe session reference and your checkout email), any message you send through our contact form, and enquiries submitted through the For Organizations page (Netlify Forms). Server logs (IP addresses, request paths) are retained for 30 days. Netlify Privacy Policy.
- Anthropic (anthropic.com) — powers the AI diagnostic report. Your quiz answers are sent to Anthropic's API to generate a personalised report. Anthropic does not use API inputs for model training by default. Anthropic Privacy Policy.
- Google Analytics (google.com/analytics) — collects website usage analytics (GA4 property
G-B7HWQ0TSL8), and only after you have given consent on our cookie banner. Google Privacy Policy. - Calendly (calendly.com) — used to schedule your session if you purchase the paid consultation, and to book free scoping calls from the For Organizations page. When you book, Calendly collects your name, email address and chosen time slot directly. For the paid consultation, we only send you to Calendly after Stripe confirms your payment. Calendly Privacy Policy.
- Clerk (clerk.com) — provides user authentication and account management for users who create an account after purchasing a paid diagnostic report. Stores your email address, account details, and payment confirmation status. Clerk Privacy Policy.
4. Cookies
We use the following cookies:
- _ga, _gid, _ga_* — set by Google Analytics 4 (property
G-B7HWQ0TSL8) for traffic analysis, and only after you accept analytics on the cookie banner. Duration: up to 2 years. Decline, and these are never set. - apch_state_v2 (and legacy apch_state, apch_lite_state, apch_result) — set by our own site in browser
localStorage (not cookies). Used to save your diagnostic progress across the Stripe payment redirect. You can clear them at any time by restarting the diagnostic or clearing site data. They do not leave your device except as described in section 1. - Cookie consent preference — stored in
localStorage to remember your analytics consent choice. - apch_device — a random number stored in
localStorage so we can give each phone or browser 2 free tests a day (2 more if you enter your email). Our server keeps only a scrambled form of it with a daily test count; it is not linked to your name, your email address or your answers. It is needed for the free test to work fairly, so it is set without asking.
You can control or delete cookies through your browser settings at any time. Disabling analytics cookies will not affect your ability to use the diagnostic tool or receive your report.
5. Data Retention
- Newsletter subscribers — your email address and consent record are retained until you unsubscribe or ask us to delete them. After you unsubscribe we keep only the minimum needed to honour that choice.
- Results emails — we do not store the address you use to request your diagnostic results. Resend keeps its own short-term delivery logs.
- Free quiz answers — not retained server-side; they live only in your browser's localStorage.
- Anonymous diagnostic statistics — kept for up to 36 months, then deleted automatically. Because they cannot be linked to you, we cannot find or delete an individual record on request.
- Purchased reports — the report and the career details inside it (and, for buyers aged 13 to 17, the parent or guardian's consent record) are retained on our servers so your report link keeps working. Email aiproofcareershub@gmail.com at any time to have a report and its data deleted.
- Payment records — retained by Stripe per their standard retention policy (typically 7 years for financial records).
- Contact form messages — retained for up to 24 months so we have a record of the conversation, then deleted. Email aiproofcareershub@gmail.com to have your message deleted sooner.
- Organisation enquiries: retained for up to 24 months so we have a record of the conversation, then deleted. Email aiproofcareershub@gmail.com to have your enquiry deleted sooner.
- Server logs — retained by Netlify for approximately 30 days.
- Analytics data — retained in Google Analytics for 14 months from your last visit, then automatically deleted by Google.
- Consultation bookings — retained by Calendly until you or we cancel the booking; your calendar record is kept for our own scheduling history.
- Account data (Clerk) — retained until you request account deletion. Email aiproofcareershub@gmail.com to delete your Clerk account and all associated authentication data.
6. Your Rights (GDPR — EU/EEA Users)
If you are located in the European Union or European Economic Area, you have the following rights:
- Right to access — request a copy of the data we hold about you.
- Right to erasure — request deletion of your personal data (for example, your newsletter record and consent log).
- Right to rectification — request correction of inaccurate data.
- Right to portability — receive your data in a machine-readable format.
- Right to object — object to data processing for legitimate interest or direct marketing.
- Right to withdraw consent — withdraw consent at any time (e.g., unsubscribe from the newsletter).
To exercise any of these rights, email us at aiproofcareershub@gmail.com. We will respond within 30 days.
7. Your Rights (CCPA — California Residents)
If you are a California resident, you have the right to:
- Know what personal information we collect and how it is used.
- Request deletion of your personal information.
- Opt out of the sale of personal information. We do not sell personal information.
- Non-discrimination for exercising these rights.
To submit a CCPA request, email aiproofcareershub@gmail.com with the subject line "CCPA Request".
8. Data Security
We implement industry-standard security measures including HTTPS encryption on all pages, server-side storage of all production secrets (Anthropic API key, Stripe secret key, Resend key — stored exclusively in Netlify environment variables), HMAC-signed payment tokens, and CORS restrictions limiting API access to our domain. A non-secret site identifier is embedded in client-side JavaScript by design to authenticate frontend calls to our serverless functions; it is not a credential and does not provide access to any third-party systems. However, no method of electronic transmission or storage is 100% secure. We encourage you to use strong, unique passwords and report any security concerns to us promptly.
9. International Data Transfers
Our service providers (Netlify, Resend, Stripe, Anthropic, Google, Clerk, Calendly) may process your data in the United States and the European Union. We rely on Standard Contractual Clauses and the Data Privacy Framework where applicable to ensure lawful transfer of data from the EU.
10. Children's Privacy
Our platform is not directed at children under 13. We do not knowingly collect personal data from children under 13, and every point on the Platform that collects an email address requires you to affirmatively check a box confirming you are 13 or older before submission is accepted.
Young people aged 13 to 17 may take the free diagnostic and receive their score. Before any purchase, every buyer must state whether they are 18 or older. A buyer aged 13 to 17 can only continue once a parent or legal guardian has entered their full name, relationship and email address and given consent. We store that consent record (the guardian's name, relationship and email, the exact consent wording, and the date, time and IP address) with the purchase, so we can show consent was given. Payment is made through Stripe, which collects the cardholder's name and billing details. Age is self-declared; if a parent or guardian believes a purchase was made without their consent, they can contact us for a refund and deletion of the data.
If you believe we have inadvertently collected such data, please contact us immediately at aiproofcareershub@gmail.com and we will delete it.
11. Changes to This Policy
We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of the platform after changes constitutes acceptance of the updated policy.
12. Contact
For any privacy questions, data requests, or concerns: