Privacy Policy

Who this applies to

• Visitors to the marketing site, including the waitlist.
• People who create a Profili account (candidates).
• People who talk to a published voice page (visitors / recruiters).

What we collect

We only keep what the product needs to run.

Account

• Name, email, password hash (handled by Supabase Auth), and Google account identifiers if you sign in with Google.
• Profile fields you edit: display name, slug, greeting, parsed resume JSON, publish status.
• The resume file you upload, stored in private object storage.

Voice calls on a published page

• Visitor name, stated purpose, and email (you type these before the call).
• A one-way hash of your IP address, used only to rate-limit abuse.
• Call start and end times, duration, and a random transcript token.
• Transcript turns (who spoke, and the text).
• Derived insight fields: intent, query, summary, citation, and scores.
• AssemblyAI session id so we can fetch the timeline after the call. We do not store recording URLs.

Waitlist

The landing waitlist currently stores your email in this browser only (profili-waitlist-email). It is not sent to our servers until we add a waitlist backend. If you choose Necessary only, we will not keep that value.

Preferences on this device

• Theme (light / dark), if you allow preference storage.
• Your cookie choice (profili-consent).
• Signed-in workspace extras in local storage, needed to keep agent settings on this device.

Hosting logs

Vercel and our database host may log IP address, user agent, and request metadata for security and uptime. We do not run advertising pixels or third-party analytics scripts today.

Why we use it

• Create and secure your account.
• Parse a resume into a draft profile (Google Gemini). The parse step is instructed to strip phone numbers, street addresses, and emails from the structured profile.
• Run the public voice agent (AssemblyAI) using published profile JSON as context.
• Show the profile owner call insights after a conversation.
• Limit call spam (hashed IP and visitor email windows).
• Remember theme and waitlist state on this device, if you allow it.

Processors

We use these providers to operate the service:

• Supabase: authentication, Postgres, and file storage (EU region when configured that way).
• Vercel: hosting and edge delivery.
• Google (Gemini and, if you choose it, Google sign-in).
• AssemblyAI: live speech to text and voice agent sessions.
• Inngest: background jobs (resume parse, call finalize, stale-call sweep).

Audio leaves the browser for AssemblyAI during a live call. Resume text and call transcripts are sent to Gemini to produce structured JSON and insights. Those vendors process data under their own terms.

Cookies

See the Cookie Policy and the banner on first visit. Necessary cookies keep you signed in. Preference storage is optional.

How long we keep it

• Account, resume, and profile data: until you delete the account or we delete it at your request.
• Calls, transcripts, and insights: until the owner deletes the profile or account, or we delete them on request.
• Hashed IP rate-limit buckets: short rolling windows (about an hour).
• Browser waitlist and theme: until you clear the site data or switch those preferences off.

Your rights

Depending on where you live, you can ask for access, correction, deletion, export, or restriction. Email privacy@profili.fyi from the address we have on file. You can also close your account from the product when that control ships; until then, email us. You may lodge a complaint with your local data protection authority.

Children

Profili is for people 16 or older. We do not knowingly collect data from children.

Changes

If this policy changes in a material way, we will update the date at the top of this page.